# CVEs published 2016-12-05

7 CVEs were published on December 5, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-8740](https://cve.now/CVE-2016-8740.md): The mod\_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2016-7171](https://cve.now/CVE-2016-7171.md): NetApp Plug-in for Symantec NetBackup prior to version 2.0.1 makes use of a non-unique server certificate, making it vulnerable to impersona (no CVSS)
- [CVE-2016-9152](https://cve.now/CVE-2016-9152.md): Cross-site scripting (XSS) vulnerability in ecrire/exec/plonger.php in SPIP 3.1.3 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2016-9836](https://cve.now/CVE-2016-9836.md): The file scanning mechanism of JFilterInput::isFileSafe() in Joomla! CMS before 3.6.5 does not consider alternative PHP file extensions when (no CVSS)
- [CVE-2016-9156](https://cve.now/CVE-2016-9156.md): A vulnerability in Siemens SICAM PAS (all versions before V8.09) could allow a remote attacker to upload, download, or delete files in certa (no CVSS, Siemens SICAM PAS through)
- [CVE-2016-9157](https://cve.now/CVE-2016-9157.md): A vulnerability in Siemens SICAM PAS (all versions before V8.09) could allow a remote attacker to cause a Denial of Service condition and po (no CVSS, Siemens SICAM PAS through)
- [CVE-2016-9835](https://cve.now/CVE-2016-9835.md): Directory traversal vulnerability in file "jcss.php" in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacke (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-12-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.