# CVEs published 2016-10-28

35 CVEs were published on October 28, 2016: 0 critical, 5 high. Days are UTC.

- [CVE-2016-4393](https://cve.now/CVE-2016-4393.md): HPE System Management Homepage before v7.6 allows "remote authenticated" attackers to obtain sensitive information via unspecified vectors, (no CVSS, HPE System Management Homepage before)
- [CVE-2016-4394](https://cve.now/CVE-2016-4394.md): HPE System Management Homepage before v7.6 allows remote attackers to obtain sensitive information via unspecified vectors, related to an "H (no CVSS, HPE System Management Homepage before)
- [CVE-2016-4395](https://cve.now/CVE-2016-4395.md): HPE System Management Homepage before v7.6 allows remote attackers to have an unspecified impact via unknown vectors, related to a "Buffer O (no CVSS, HPE System Management Homepage before)
- [CVE-2016-4396](https://cve.now/CVE-2016-4396.md): HPE System Management Homepage before v7.6 allows remote attackers to have an unspecified impact via unknown vectors, related to a "Buffer O (no CVSS, HPE System Management Homepage before)
- [CVE-2016-8331](https://cve.now/CVE-2016-8331.md): An exploitable remote code execution vulnerability exists in the handling of TIFF images in LibTIFF version 4.0.6. (CVSS 8.1, LibTIFF)
- [CVE-2016-8333](https://cve.now/CVE-2016-8333.md): An exploitable stack-based buffer overflow vulnerability exists in the ipfSetColourStroke functionality of Iceni Argus version 6.6.04 A spec (CVSS 8.8, Iceni Argus)
- [CVE-2016-8335](https://cve.now/CVE-2016-8335.md): An exploitable stack based buffer overflow vulnerability exists in the ipNameAdd functionality of Iceni Argus Version 6.6.04 (Sep 7 2012) NK (CVSS 8.8, Iceni Argus 6.6.04 (Sep 7 2012) NK - Linux x64 and 6.6.04 (…)
- [CVE-2016-7919](https://cve.now/CVE-2016-7919.md): Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting t (CVSS 7.5)
- [CVE-2016-8579](https://cve.now/CVE-2016-8579.md): docker2aci \<= 0.12.3 has an infinite loop when handling local images with cyclic dependency chain. (no CVSS, github.com/appc/docker2aci)
- [CVE-2016-8580](https://cve.now/CVE-2016-8580.md): PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2. (no CVSS)
- [CVE-2016-8581](https://cve.now/CVE-2016-8581.md): A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an (no CVSS)
- [CVE-2016-8582](https://cve.now/CVE-2016-8582.md): A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and r (no CVSS)
- [CVE-2016-8583](https://cve.now/CVE-2016-8583.md): Multiple GET parameters in the vulnerability scan scheduler of AlienVault OSSIM and USM before 5.3.2 are vulnerable to reflected XSS. (no CVSS)
- [CVE-2016-8596](https://cve.now/CVE-2016-8596.md): Buffer overflow in the csp\_can\_process\_frame in csp\_if\_can.c in the libcsp library v1.4 and earlier allows hostile components connected to t (no CVSS)
- [CVE-2016-8597](https://cve.now/CVE-2016-8597.md): Buffer overflow in the csp\_sfp\_recv\_fp in csp\_sfp.c in the libcsp library v1.4 and earlier allows hostile components with network access to (no CVSS)
- [CVE-2016-8598](https://cve.now/CVE-2016-8598.md): Buffer overflow in the zmq interface in csp\_if\_zmqhub.c in the libcsp library v1.4 and earlier allows hostile computers connected via a zmq (no CVSS)
- [CVE-2016-8600](https://cve.now/CVE-2016-8600.md): In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check l (no CVSS)
- [CVE-2016-8867](https://cve.now/CVE-2016-8867.md): Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. (no CVSS)
- [CVE-2016-8871](https://cve.now/CVE-2016-8871.md): In Botan 1.11.29 through 1.11.32, RSA decryption with certain padding options had a detectable timing channel which could given sufficient q (no CVSS)
- [CVE-2016-8889](https://cve.now/CVE-2016-8889.md): In Bitcoin Knots v0.11.0.ljr20150711 through v0.13.0.knots20160814 (fixed in v0.13.1.knots20161027), the debug console stores sensitive info (no CVSS)
- [CVE-2016-9017](https://cve.now/CVE-2016-9017.md): Artifex Software, Inc. (no CVSS)
- [CVE-2016-9018](https://cve.now/CVE-2016-9018.md): Improper handling of a repeating VRAT chunk in qcpfformat.dll allows attackers to cause a Null pointer dereference and crash in RealNetworks (no CVSS)
- [CVE-2016-9028](https://cve.now/CVE-2016-9028.md): Unauthorized redirect vulnerability in Citrix NetScaler ADC before 10.1 135.8, 10.5 61.11, 11.0 65.31/65.35F and 11.1 47.14 allows a remote (no CVSS)
- [CVE-2016-8332](https://cve.now/CVE-2016-8332.md): A buffer overflow in OpenJPEG 2.1.1 causes arbitrary code execution when parsing a crafted image. (CVSS 7.5, OPENJPEG)
- [CVE-2016-8339](https://cve.now/CVE-2016-8339.md): A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. (CVSS 6.6, Redis)
- [CVE-2016-1423](https://cve.now/CVE-2016-1423.md): A vulnerability in the display of email messages in the Messages in Quarantine (MIQ) view in Cisco AsyncOS for Cisco Email Security Applianc (no CVSS, Cisco AsyncOS 8.0.2-069)
- [CVE-2016-1480](https://cve.now/CVE-2016-1480.md): A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Software for Cisco Email Security Appliances (E (no CVSS, Cisco AsyncOS through WSA10.0.0-000)
- [CVE-2016-1481](https://cve.now/CVE-2016-1481.md): A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthen (no CVSS, Cisco AsyncOS through 9.7.0-125)
- [CVE-2016-1486](https://cve.now/CVE-2016-1486.md): A vulnerability in the email attachment scanning functionality of the Advanced Malware Protection (AMP) feature of Cisco AsyncOS Software fo (no CVSS, Cisco AsyncOS through 9.7.1-066)
- [CVE-2016-6356](https://cve.now/CVE-2016-6356.md): A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthen (no CVSS, Cisco AsyncOS through 9.7.0-125)
- [CVE-2016-6357](https://cve.now/CVE-2016-6357.md): A vulnerability in the configured security policies, including drop email filtering, in Cisco AsyncOS for Cisco Email Security Appliance (ES (no CVSS, Cisco AsyncOS through 9.9.6-026)
- [CVE-2016-6358](https://cve.now/CVE-2016-6358.md): A vulnerability in local FTP to the Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a partial (no CVSS, Cisco Email Security Appliance (ESA) through 9.7.1-000)
- [CVE-2016-6360](https://cve.now/CVE-2016-6360.md): A vulnerability in Advanced Malware Protection (AMP) for Cisco Email Security Appliances (ESA) and Web Security Appliances (WSA) could allow (no CVSS, Cisco AsyncOS through WSA10.0.0-000)
- [CVE-2016-6372](https://cve.now/CVE-2016-6372.md): A vulnerability in the email message and content filtering for malformed Multipurpose Internet Mail Extensions (MIME) headers of Cisco Async (no CVSS, Cisco AsyncOS through WSA10.0.0-000)
- [CVE-2016-6397](https://cve.now/CVE-2016-6397.md): A vulnerability in the interdevice communications interface of the Cisco IP Interoperability and Collaboration System (IPICS) Universal Medi (no CVSS, Cisco IPICS 4.8(1) to)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-10-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.