# CVEs published 2016-12-01

11 CVEs were published on December 1, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-2946](https://cve.now/CVE-2016-2946.md): Stack-based buffer overflow in the ax Shared Libraries in the Agent in IBM Tivoli Monitoring (ITM) 6.2.2 before FP9, 6.2.3 before FP5, and 6 (no CVSS)
- [CVE-2016-2955](https://cve.now/CVE-2016-2955.md): Cross-site scripting (XSS) vulnerability in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject ar (no CVSS)
- [CVE-2016-2991](https://cve.now/CVE-2016-2991.md): Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Protector for Mail Security 2.8.0.0 through 2.8.1.0 before 2.8.1.0-22115 al (no CVSS)
- [CVE-2016-2994](https://cve.now/CVE-2016-2994.md): Cross-site scripting (XSS) vulnerability in IBM UrbanCode Deploy 6.2.x before 6.2.1.2 allows remote authenticated users to inject arbitrary (no CVSS)
- [CVE-2016-3012](https://cve.now/CVE-2016-3012.md): IBM API Connect (aka APIConnect) before 5.0.3.0 with NPM before 2.2.8 includes certain internal server credentials in the software package, (no CVSS)
- [CVE-2016-3033](https://cve.now/CVE-2016-3033.md): IBM AppScan Source 8.7 through 9.0.3.3 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consum (no CVSS)
- [CVE-2016-3044](https://cve.now/CVE-2016-3044.md): The Linux kernel component in IBM PowerKVM 2.1 before 2.1.1.3-65.10 and 3.1 before 3.1.0.2 allows guest OS users to cause a denial of servic (no CVSS)
- [CVE-2016-3047](https://cve.now/CVE-2016-3047.md): Open redirect vulnerability in IBM FileNet Workplace 4.0.2 through 4.0.2.14 IF001 allows remote authenticated users to redirect users to arb (no CVSS)
- [CVE-2016-3055](https://cve.now/CVE-2016-3055.md): IBM FileNet Workplace 4.0.2 before 4.0.2.14 LA012 allows remote authenticated users to read arbitrary files or cause a denial of service (me (no CVSS)
- [CVE-2016-9751](https://cve.now/CVE-2016-9751.md): Cross-site scripting (XSS) vulnerability in the search results front end in Piwigo 2.8.3 allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2016-9752](https://cve.now/CVE-2016-9752.md): In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redir (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-12-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.