# CVEs published 2016-10-05

52 CVEs were published on October 5, 2016: 2 critical, 0 high. Days are UTC.

- [CVE-2016-6426](https://cve.now/CVE-2016-6426.md): The j\_spring\_security\_switch\_user function in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Cent (no CVSS)
- [CVE-2016-7020](https://cve.now/CVE-2016-7020.md): Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before (no CVSS)
- [CVE-2016-1455](https://cve.now/CVE-2016-1455.md): Cisco NX-OS before 7.0(3)I2(2e) and 7.0(3)I4 before 7.0(3)I4(1) has an incorrect iptables local-interface configuration, which allows remote (no CVSS)
- [CVE-2016-6378](https://cve.now/CVE-2016-6378.md): Cisco IOS XE 3.1 through 3.17 and 16.1 through 16.2 allows remote attackers to cause a denial of service (device reload) via crafted ICMP pa (no CVSS)
- [CVE-2016-6379](https://cve.now/CVE-2016-6379.md): Cisco IOS 12.2 and IOS XE 3.14 through 3.16 and 16.1 allow remote attackers to cause a denial of service (device reload) via crafted IP Deta (no CVSS)
- [CVE-2016-6380](https://cve.now/CVE-2016-6380.md): The DNS forwarder in Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.15 allows remote attackers to obtain sensiti (no CVSS)
- [CVE-2016-6385](https://cve.now/CVE-2016-6385.md): Memory leak in the Smart Install client implementation in Cisco IOS 12.2 and 15.0 through 15.2 and IOS XE 3.2 through 3.8 allows remote atta (no CVSS)
- [CVE-2016-6391](https://cve.now/CVE-2016-6391.md): Cisco IOS 12.2 and 15.0 through 15.3 allows remote attackers to cause a denial of service (traffic-processing outage) via a crafted series o (no CVSS)
- [CVE-2016-6393](https://cve.now/CVE-2016-6393.md): The AAA service in Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 2.1 through 3.18 and 16.2 allows remote attackers to cause a (no CVSS)
- [CVE-2016-6421](https://cve.now/CVE-2016-6421.md): Cisco IOS XR 5.2.2 allows remote attackers to cause a denial of service (process restart) via a crafted OSPF Link State Advertisement (LSA) (no CVSS)
- [CVE-2016-6423](https://cve.now/CVE-2016-6423.md): The IKEv2 client and initiator implementations in Cisco IOS 15.5(3)M and IOS XE allow remote IKEv2 servers to cause a denial of service (dev (no CVSS)
- [CVE-2016-6381](https://cve.now/CVE-2016-6381.md): Cisco IOS 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.18 and 16.1 allow remote attackers to cause a denial of service (memory consum (no CVSS)
- [CVE-2016-6382](https://cve.now/CVE-2016-6382.md): Cisco IOS 15.2 through 15.6 and IOS XE 3.6 through 3.17 and 16.1 allow remote attackers to cause a denial of service (device restart) via a (no CVSS)
- [CVE-2016-6384](https://cve.now/CVE-2016-6384.md): Cisco IOS 12.2 through 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.17 and 16.2 allow remote attackers to cause a denial of service ( (no CVSS)
- [CVE-2016-6386](https://cve.now/CVE-2016-6386.md): Cisco IOS XE 3.1 through 3.17 and 16.1 on 64-bit platforms allows remote attackers to cause a denial of service (data-structure corruption a (no CVSS)
- [CVE-2016-6392](https://cve.now/CVE-2016-6392.md): Cisco IOS 12.2 and 15.0 through 15.3 and IOS XE 3.1 through 3.9 allow remote attackers to cause a denial of service (device restart) via a c (no CVSS)
- [CVE-2016-6416](https://cve.now/CVE-2016-6416.md): The FTP service in Cisco AsyncOS on Email Security Appliance (ESA) devices 9.6.0-000 through 9.9.6-026, Web Security Appliance (WSA) devices (no CVSS)
- [CVE-2016-6417](https://cve.now/CVE-2016-6417.md): Cross-site request forgery (CSRF) vulnerability in Cisco FireSIGHT System Software 4.10.2 through 6.1.0 and Firepower Management Center allo (no CVSS)
- [CVE-2016-6418](https://cve.now/CVE-2016-6418.md): Cross-site scripting (XSS) vulnerability in Cisco Videoscape Distribution Suite Service Manager (VDS-SM) 3.0 through 3.4.0 allows remote att (no CVSS)
- [CVE-2016-1246](https://cve.now/CVE-2016-1246.md): Buffer overflow in the DBD::mysql module before 4.037 for Perl allows context-dependent attackers to cause a denial of service (crash) via v (no CVSS)
- [CVE-2016-4551](https://cve.now/CVE-2016-4551.md): The (1) SAP\_BASIS and (2) SAP\_ABA components 7.00 SP Level 0031 in SAP NetWeaver 2004s might allow remote attackers to spoof IP addresses wr (no CVSS)
- [CVE-2016-5745](https://cve.now/CVE-2016-5745.md): F5 BIG-IP LTM systems 11.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF11, 11.5.0, 11.5.1 before HF11, 11.5.2, 11.5.3, 11.5.4 before (no CVSS)
- [CVE-2016-6652](https://cve.now/CVE-2016-6652.md): SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a re (no CVSS, org.springframework.data:spring-data-jpa)
- [CVE-2016-7161](https://cve.now/CVE-2016-7161.md): Heap-based buffer overflow in the .receive callback of xlnx.xps-ethernetlite in QEMU (aka Quick Emulator) allows attackers to execute arbitr (no CVSS)
- [CVE-2016-7435](https://cve.now/CVE-2016-7435.md): The (1) SCTC\_REFRESH\_EXPORT\_TAB\_COMP, (2) SCTC\_REFRESH\_CHECK\_ENV, and (3) SCTC\_TMS\_MAINTAIN\_ALOG functions in the SCTC subpackage in SAP Net (no CVSS)
- [CVE-2016-7560](https://cve.now/CVE-2016-7560.md): The rsyncd server in Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 has a hardcoded rsync account, (no CVSS)
- [CVE-2016-7561](https://cve.now/CVE-2016-7561.md): Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 allow administrators to obtain sensitive user crede (no CVSS)
- [CVE-2016-7907](https://cve.now/CVE-2016-7907.md): The imx\_fec\_do\_tx function in hw/net/imx\_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmi (no CVSS)
- [CVE-2016-7908](https://cve.now/CVE-2016-7908.md): The mcf\_fec\_do\_tx function in hw/net/mcf\_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmi (no CVSS)
- [CVE-2016-7909](https://cve.now/CVE-2016-7909.md): The pcnet\_rdra\_addr function in hw/net/pcnet.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of servic (no CVSS)
- [CVE-2014-5414](https://cve.now/CVE-2014-5414.md): Beckhoff Embedded PC Images and TwinCAT Components Improper Restriction of Excessive Authentication Attempts (CVSS 9.1, Beckhoff Embedded PC Images · Beckhoff TwinCAT Components f…)
- [CVE-2014-5415](https://cve.now/CVE-2014-5415.md): Beckhoff Embedded PC Images and TwinCAT Components Exposed Dangerous Method or Function (CVSS 9.1, Beckhoff Embedded PC Images · Beckhoff TwinCAT Components f…)
- [CVE-2016-2307](https://cve.now/CVE-2016-2307.md): American Auto-Matrix Aspect-Nexus Building Automation Front-End Solutions application before 3.0.0 and Aspect-Matrix Building Automation Fro (no CVSS)
- [CVE-2016-2308](https://cve.now/CVE-2016-2308.md): American Auto-Matrix Aspect-Nexus Building Automation Front-End Solutions application before 3.0.0 and Aspect-Matrix Building Automation Fro (no CVSS)
- [CVE-2016-4387](https://cve.now/CVE-2016-4387.md): The Filter SDK in HPE KeyView 10.18 through 10.24 allows remote attackers to execute arbitrary code via unspecified vectors, a different vul (no CVSS)
- [CVE-2016-4388](https://cve.now/CVE-2016-4388.md): The Filter SDK in HPE KeyView 10.18 through 10.24 allows remote attackers to execute arbitrary code via unspecified vectors, a different vul (no CVSS)
- [CVE-2016-4389](https://cve.now/CVE-2016-4389.md): The Filter SDK in HPE KeyView 10.18 through 10.24 allows remote attackers to execute arbitrary code via unspecified vectors, a different vul (no CVSS)
- [CVE-2016-4390](https://cve.now/CVE-2016-4390.md): The Filter SDK in HPE KeyView 10.18 through 10.24 allows remote attackers to execute arbitrary code via unspecified vectors, a different vul (no CVSS)
- [CVE-2016-5084](https://cve.now/CVE-2016-5084.md): Johnson & Johnson Animas OneTouch Ping devices do not use encryption for certain data, which might allow remote attackers to obtain sensitiv (no CVSS)
- [CVE-2016-5085](https://cve.now/CVE-2016-5085.md): Johnson & Johnson Animas OneTouch Ping devices do not properly generate random numbers, which makes it easier for remote attackers to spoof (no CVSS)
- [CVE-2016-5086](https://cve.now/CVE-2016-5086.md): Johnson & Johnson Animas OneTouch Ping devices allow remote attackers to bypass authentication via replay attacks. (no CVSS)
- [CVE-2016-5686](https://cve.now/CVE-2016-5686.md): Johnson & Johnson Animas OneTouch Ping devices mishandle acknowledgements, which makes it easier for remote attackers to bypass authenticati (no CVSS)
- [CVE-2016-5892](https://cve.now/CVE-2016-5892.md): Cross-site scripting (XSS) vulnerability in IBM 10x, as used in Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Co (no CVSS)
- [CVE-2016-5901](https://cve.now/CVE-2016-5901.md): Cross-site scripting (XSS) vulnerability in a test page in IBM Business Process Manager Advanced 8.5.6.0 through 8.5.7.0 before cumulative f (no CVSS)
- [CVE-2016-5983](https://cve.now/CVE-2016-5983.md): IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2, and Liberty before (no CVSS)
- [CVE-2016-6419](https://cve.now/CVE-2016-6419.md): SQL injection vulnerability in Cisco Firepower Management Center 4.10.3 through 5.4.0 allows remote authenticated users to execute arbitrary (no CVSS)
- [CVE-2016-6420](https://cve.now/CVE-2016-6420.md): Cisco FireSIGHT System Software 4.10.3 through 5.4.0 in Firepower Management Center allows remote authenticated users to bypass authorizatio (no CVSS)
- [CVE-2016-8343](https://cve.now/CVE-2016-8343.md): Directory traversal vulnerability in INDAS Web SCADA before 3 allows remote attackers to read arbitrary files via unspecified vectors. (no CVSS)
- [CVE-2016-0913](https://cve.now/CVE-2016-0913.md): The client in EMC Replication Manager (RM) before 5.5.3.0\_01-PatchHotfix, EMC Network Module for Microsoft 3.x, and EMC Networker Module for (no CVSS)
- [CVE-2016-6550](https://cve.now/CVE-2016-6550.md): The U by BB&T app 1.5.4 and earlier for iOS does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle att (no CVSS)
- [CVE-2016-6645](https://cve.now/CVE-2016-6645.md): The vApp Managers web application in EMC Unisphere for VMAX Virtual Appliance 8.x before 8.3.0 and Solutions Enabler Virtual Appliance 8.x b (no CVSS)
- [CVE-2016-6646](https://cve.now/CVE-2016-6646.md): The vApp Managers web application in EMC Unisphere for VMAX Virtual Appliance 8.x before 8.3.0 and Solutions Enabler Virtual Appliance 8.x b (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-10-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.