# CVEs published 2017-02-16

28 CVEs were published on February 16, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2016-5919](https://cve.now/CVE-2016-5919.md): IBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker (no CVSS, IBM Access Manager)
- [CVE-2016-6062](https://cve.now/CVE-2016-6062.md): IBM Resilient v26.0, v26.1, and v26.2 is vulnerable to cross-site scripting. (no CVSS, IBM Resilient)
- [CVE-2016-10134](https://cve.now/CVE-2016-10134.md): SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the t (no CVSS)
- [CVE-2016-1249](https://cve.now/CVE-2016-1249.md): The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of servic (no CVSS)
- [CVE-2016-4311](https://cve.now/CVE-2016-4311.md): Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote attackers to hijack th (no CVSS)
- [CVE-2016-4312](https://cve.now/CVE-2016-4312.md): XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows r (no CVSS)
- [CVE-2016-4314](https://cve.now/CVE-2016-4314.md): Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arb (no CVSS, org.wso2.carbon.commons:org.wso2.carbon.logging.view.ui)
- [CVE-2016-4315](https://cve.now/CVE-2016-4315.md): Cross-site request forgery (CSRF) vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to hijack the authentication of privileged user (no CVSS)
- [CVE-2016-4316](https://cve.now/CVE-2016-4316.md): Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via t (no CVSS, org.wso2.carbon.commons:org.wso2.carbon.ndatasource.ui ·… +1)
- [CVE-2016-4327](https://cve.now/CVE-2016-4327.md): Cross-site scripting (XSS) vulnerability in WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20090827-1616 and earlier allows remote at (no CVSS)
- [CVE-2016-4861](https://cve.now/CVE-2016-4861.md): The (1) order and (2) group methods in Zend\_Db\_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injec (no CVSS, zendframework/zendframework)
- [CVE-2016-5417](https://cve.now/CVE-2016-5417.md): Memory leak in the \_\_res\_vinit function in the IPv6 name server management code in libresolv in GNU C Library (aka glibc or libc6) before 2. (no CVSS)
- [CVE-2016-6233](https://cve.now/CVE-2016-6233.md): The (1) order and (2) group methods in Zend\_Db\_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injec (no CVSS, zendframework/zendframework · zendframework/zendframework1)
- [CVE-2016-8652](https://cve.now/CVE-2016-8652.md): The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service (crash) (no CVSS)
- [CVE-2016-9139](https://cve.now/CVE-2016-9139.md): Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0 (no CVSS)
- [CVE-2016-9637](https://cve.now/CVE-2016-9637.md): The (1) ioport\_read and (2) ioport\_write functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest O (no CVSS)
- [CVE-2016-9773](https://cve.now/CVE-2016-9773.md): Heap-based buffer overflow in the IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3.8 allows remote attackers to caus (no CVSS)
- [CVE-2016-9814](https://cve.now/CVE-2016-9814.md): The validateSignature method in the SAML2\\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x b (no CVSS, simplesamlphp/saml2)
- [CVE-2016-9827](https://cve.now/CVE-2016-9827.md): The \_iprintf function in outputtxt.c in the listswf tool in libming 0.4.7 allows remote attackers to cause a denial of service (buffer over- (no CVSS)
- [CVE-2016-9828](https://cve.now/CVE-2016-9828.md): The dumpBuffer function in read.c in the listswf tool in libming 0.4.7 allows remote attackers to cause a denial of service (NULL pointer de (no CVSS)
- [CVE-2016-9829](https://cve.now/CVE-2016-9829.md): Heap-based buffer overflow in the parseSWF\_DEFINEFONT function in parser.c in the listswf tool in libming 0.4.7 allows remote attackers to h (no CVSS)
- [CVE-2016-9831](https://cve.now/CVE-2016-9831.md): Heap-based buffer overflow in the parseSWF\_RGBA function in parser.c in the listswf tool in libming 0.4.7 allows remote attackers to have un (no CVSS)
- [CVE-2016-9955](https://cve.now/CVE-2016-9955.md): The SimpleSAML\_XML\_Validator class constructor in SimpleSAMLphp before 1.14.11 might allow remote attackers to spoof signatures on SAML 1 re (no CVSS, simplesamlphp/simplesamlphp)
- [CVE-2017-5357](https://cve.now/CVE-2017-5357.md): regex.c in GNU ed before 1.14.1 allows attackers to cause a denial of service (crash) via a malformed command, which triggers an invalid fre (no CVSS)
- [CVE-2017-6004](https://cve.now/CVE-2017-6004.md): The compile\_bracket\_matchingpath function in pcre\_jit\_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled versio (no CVSS)
- [CVE-2017-6009](https://cve.now/CVE-2017-6009.md): An issue was discovered in icoutils 0.31.1. (no CVSS)
- [CVE-2017-6010](https://cve.now/CVE-2017-6010.md): An issue was discovered in icoutils 0.31.1. (no CVSS)
- [CVE-2017-6011](https://cve.now/CVE-2017-6011.md): An issue was discovered in icoutils 0.31.1. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-02-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.