# CVEs published 2016-10-06

42 CVEs were published on October 6, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2015-1000000](https://cve.now/CVE-2015-1000000.md): Remote file upload vulnerability in mailcwp v1.99 wordpress plugin (no CVSS)
- [CVE-2015-1000001](https://cve.now/CVE-2015-1000001.md): Remote file upload vulnerability in fast-image-adder v1.1 Wordpress plugin (no CVSS)
- [CVE-2015-1000002](https://cve.now/CVE-2015-1000002.md): Open Proxy in filedownload v1.4 wordpress plugin (no CVSS)
- [CVE-2015-1000003](https://cve.now/CVE-2015-1000003.md): Blind SQL Injection in filedownload v1.4 wordpress plugin (no CVSS)
- [CVE-2015-1000004](https://cve.now/CVE-2015-1000004.md): XSS in filedownload v1.4 wordpress plugin (no CVSS)
- [CVE-2015-1000005](https://cve.now/CVE-2015-1000005.md): Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin (no CVSS)
- [CVE-2015-1000006](https://cve.now/CVE-2015-1000006.md): Remote file download vulnerability in recent-backups v0.7 wordpress plugin (no CVSS)
- [CVE-2015-1000007](https://cve.now/CVE-2015-1000007.md): Remote file download vulnerability in wptf-image-gallery v1.03 (no CVSS)
- [CVE-2015-1000008](https://cve.now/CVE-2015-1000008.md): Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2 (no CVSS)
- [CVE-2015-1000009](https://cve.now/CVE-2015-1000009.md): Open proxy in Wordpress plugin google-adsense-and-hotel-booking v1.05 (no CVSS)
- [CVE-2015-1000010](https://cve.now/CVE-2015-1000010.md): Remote file download in simple-image-manipulator v1.0 wordpress plugin (no CVSS)
- [CVE-2015-1000011](https://cve.now/CVE-2015-1000011.md): Blind SQL Injection in wordpress plugin dukapress v2.5.9 (no CVSS)
- [CVE-2015-1000012](https://cve.now/CVE-2015-1000012.md): Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin (no CVSS)
- [CVE-2015-1000013](https://cve.now/CVE-2015-1000013.md): Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1 (no CVSS)
- [CVE-2016-1000000](https://cve.now/CVE-2016-1000000.md): Ipswitch WhatsUp Gold 16.4.1 WrFreeFormText.asp sUniqueID Parameter Blind SQL Injection (no CVSS)
- [CVE-2016-1000009](https://cve.now/CVE-2016-1000009.md): TP-LINK lost control of two domains, www.tplinklogin.net and tplinkextender.net. (no CVSS)
- [CVE-2016-1000112](https://cve.now/CVE-2016-1000112.md): Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress plugin (no CVSS)
- [CVE-2016-1000113](https://cve.now/CVE-2016-1000113.md): XSS and SQLi in huge IT gallery v1.1.5 for Joomla (no CVSS)
- [CVE-2016-1000114](https://cve.now/CVE-2016-1000114.md): XSS in huge IT gallery v1.1.5 for Joomla (no CVSS)
- [CVE-2016-1000123](https://cve.now/CVE-2016-1000123.md): Unauthenticated SQL Injection in Huge-IT Video Gallery v1.0.9 for Joomla (no CVSS)
- [CVE-2016-1000124](https://cve.now/CVE-2016-1000124.md): Unauthenticated SQL Injection in Huge-IT Portfolio Gallery Plugin v1.0.6 (no CVSS)
- [CVE-2016-1000125](https://cve.now/CVE-2016-1000125.md): Unauthenticated SQL Injection in Huge-IT Catalog v1.0.7 for Joomla (no CVSS)
- [CVE-2016-1000217](https://cve.now/CVE-2016-1000217.md): Zotpress plugin for WordPress SQLi in zp\_get\_account() (no CVSS)
- [CVE-2015-0721](https://cve.now/CVE-2015-0721.md): Cisco NX-OS 4.0 through 7.3 on Multilayer Director and Nexus 1000V, 2000, 3000, 3500, 4000, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 dev (no CVSS)
- [CVE-2015-6393](https://cve.now/CVE-2015-6393.md): Cisco NX-OS 4.1 through 7.3 and 11.0 through 11.2 on Nexus 2000, 3000, 3500, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows rem (no CVSS)
- [CVE-2016-1453](https://cve.now/CVE-2016-1453.md): Buffer overflow in the Overlay Transport Virtualization (OTV) GRE feature in Cisco NX-OS 5.0 through 7.3 on Nexus 7000 and 7700 devices allo (no CVSS)
- [CVE-2016-1454](https://cve.now/CVE-2016-1454.md): Cisco NX-OS 4.0 through 7.3 and 11.0 through 11.2 on 1000v, 2000, 3000, 3500, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows re (no CVSS)
- [CVE-2016-6023](https://cve.now/CVE-2016-6023.md): Directory traversal vulnerability in the Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 befo (no CVSS)
- [CVE-2016-6025](https://cve.now/CVE-2016-6025.md): The Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows remote attac (no CVSS)
- [CVE-2016-6026](https://cve.now/CVE-2016-6026.md): The Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows man-in-the-m (no CVSS)
- [CVE-2016-6027](https://cve.now/CVE-2016-6027.md): The Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 does not enable the (no CVSS)
- [CVE-2016-6422](https://cve.now/CVE-2016-6422.md): Cisco IOS 12.2(33)SXJ9 on Supervisor Engine 32 and 720 modules for 6500 and 7600 devices mishandles certain operators, flags, and keywords i (no CVSS)
- [CVE-2016-6424](https://cve.now/CVE-2016-6424.md): The DHCP Relay implementation in Cisco Adaptive Security Appliance (ASA) Software 8.4.7.29 and 9.1.7.4 allows remote attackers to cause a de (no CVSS)
- [CVE-2016-6425](https://cve.now/CVE-2016-6425.md): Cross-site scripting (XSS) vulnerability in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Center (no CVSS)
- [CVE-2016-6427](https://cve.now/CVE-2016-6427.md): Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact (no CVSS)
- [CVE-2016-6428](https://cve.now/CVE-2016-6428.md): Cisco IOS XR 6.1.1 allows local users to execute arbitrary OS commands as root by leveraging admin privileges, aka Bug ID CSCva38349. (no CVSS)
- [CVE-2016-6433](https://cve.now/CVE-2016-6433.md): The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrar (no CVSS)
- [CVE-2016-6434](https://cve.now/CVE-2016-6434.md): Cisco Firepower Management Center 6.0.1 has hardcoded database credentials, which allows local users to obtain sensitive information by leve (no CVSS)
- [CVE-2016-6435](https://cve.now/CVE-2016-6435.md): The web console in Cisco Firepower Management Center 6.0.1 allows remote authenticated users to read arbitrary files via crafted parameters, (no CVSS)
- [CVE-2016-6436](https://cve.now/CVE-2016-6436.md): Cross-site scripting (XSS) vulnerability in HostScan Engine 3.0.08062 through 3.1.14018 in the Cisco Host Scan package, as used in ASA Web V (no CVSS)
- [CVE-2016-6653](https://cve.now/CVE-2016-6653.md): The MariaDB audit\_plugin component in Pivotal Cloud Foundry (PCF) cf-mysql-release 27 and 28 allows remote attackers to obtain sensitive inf (no CVSS)
- [CVE-2015-6392](https://cve.now/CVE-2015-6392.md): Cisco NX-OS 4.1 through 7.3 and 11.0 through 11.2 on Nexus 2000, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote attacker (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-10-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.