# CVEs published 2016-04-12

75 CVEs were published on April 12, 2016: 0 critical, 3 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2016-0088](https://cve.now/CVE-2016-0088.md): Hyper-V in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to execute arbitrary code on the… (no CVSS)
- [CVE-2016-0089](https://cve.now/CVE-2016-0089.md): Hyper-V in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to obtain sensitive information… (no CVSS)
- [CVE-2016-0090](https://cve.now/CVE-2016-0090.md): Hyper-V in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows 10 allows guest OS users to obtain sensitive information from host… (no CVSS)
- [CVE-2016-0122](https://cve.now/CVE-2016-0122.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Word 2016 for Mac, Office Compatibility Pack SP3… (no CVSS)
- [CVE-2016-0127](https://cve.now/CVE-2016-0127.md): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office Compatibility Pack SP3, Word Viewer, Word… (no CVSS)
- [CVE-2016-0128](https://cve.now/CVE-2016-0128.md): The SAM and LSAD protocol implementations in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1… (no CVSS)
- [CVE-2016-0135](https://cve.now/CVE-2016-0135.md): The Secondary Logon Service in Microsoft Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka… (no CVSS)
- [CVE-2016-0136](https://cve.now/CVE-2016-0136.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, Excel Services on SharePoint Server 2007 SP3, and Excel Services… (no CVSS)
- [CVE-2016-0139](https://cve.now/CVE-2016-0139.md): Microsoft Excel 2010 SP2, Word for Mac 2011, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office… (no CVSS)
- [CVE-2016-0143](https://cve.now/CVE-2016-0143.md): The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012… (no CVSS)
- [CVE-2016-0145](https://cve.now/CVE-2016-0145.md): The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold… (no CVSS)
- [CVE-2016-0147](https://cve.now/CVE-2016-0147.md): Microsoft XML Core Services 3.0 allows remote attackers to execute arbitrary code via a crafted web site, aka "MSXML 3.0 Remote Code… (no CVSS)
- [CVE-2016-0148](https://cve.now/CVE-2016-0148.md): Microsoft .NET Framework 4.6 and 4.6.1 mishandles library loading, which allows local users to gain privileges via a crafted application… (no CVSS)
- [CVE-2016-0150](https://cve.now/CVE-2016-0150.md): HTTP.sys in Microsoft Windows 10 Gold and 1511 allows remote attackers to cause a denial of service (system hang) via crafted HTTP 2.0… (no CVSS)
- [CVE-2016-0151](https://cve.now/CVE-2016-0151.md): The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold (CVSS 7.8, KEV)
- [CVE-2016-0153](https://cve.now/CVE-2016-0153.md): OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and… (no CVSS)
- [CVE-2016-0154](https://cve.now/CVE-2016-0154.md): Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service… (no CVSS)
- [CVE-2016-0155](https://cve.now/CVE-2016-0155.md): Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site… (no CVSS)
- [CVE-2016-0156](https://cve.now/CVE-2016-0156.md): Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site… (no CVSS)
- [CVE-2016-0157](https://cve.now/CVE-2016-0157.md): Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site… (no CVSS)
- [CVE-2016-0158](https://cve.now/CVE-2016-0158.md): Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Edge Elevation of… (no CVSS)
- [CVE-2016-0159](https://cve.now/CVE-2016-0159.md): Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a… (no CVSS)
- [CVE-2016-0160](https://cve.now/CVE-2016-0160.md): Microsoft Internet Explorer 11 mishandles DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL… (no CVSS)
- [CVE-2016-0161](https://cve.now/CVE-2016-0161.md): Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Edge Elevation of… (no CVSS)
- [CVE-2016-0162](https://cve.now/CVE-2016-0162.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka "Inter (CVSS 4.3, KEV)
- [CVE-2016-0164](https://cve.now/CVE-2016-0164.md): Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)… (no CVSS)
- [CVE-2016-0165](https://cve.now/CVE-2016-0165.md): The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 G (CVSS 7.8, KEV)
- [CVE-2016-0166](https://cve.now/CVE-2016-0166.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a… (no CVSS)
- [CVE-2016-0167](https://cve.now/CVE-2016-0167.md): The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 G (CVSS 7.8, KEV)
- [CVE-2016-0887](https://cve.now/CVE-2016-0887.md): EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x and 4.1.x before 4.1.5, RSA BSAFE Crypto-C Micro Edition (CCME) 4.0.x and 4.1.x before… (no CVSS)
- [CVE-2016-1034](https://cve.now/CVE-2016-1034.md): The Sync Process in the JavaScript API for Creative Cloud Libraries in Adobe Creative Cloud Desktop Application before 3.6.0.244 allows… (no CVSS)
- [CVE-2016-1035](https://cve.now/CVE-2016-1035.md): Adobe RoboHelp Server 9 before 9.0.1 mishandles SQL queries, which allows attackers to obtain sensitive information via unspecified vectors. (no CVSS)
- [CVE-2016-1376](https://cve.now/CVE-2016-1376.md): Cisco IOS XR 4.2.3, 4.3.0, 4.3.4, and 5.3.1 on ASR 9000 devices allows remote attackers to cause a denial of service (CRC and symbol… (no CVSS)
- [CVE-2016-1377](https://cve.now/CVE-2016-1377.md): Cross-site scripting (XSS) vulnerability in Cisco Unity Connection through 11.0 allows remote attackers to inject arbitrary web script or… (no CVSS)
- [CVE-2016-2001](https://cve.now/CVE-2016-2001.md): HPE Universal CMDB Foundation 10.0, 10.01, 10.10, 10.11, and 10.20 allows remote attackers to obtain sensitive information or conduct URL… (no CVSS)
- [CVE-2016-2118](https://cve.now/CVE-2016-2118.md): The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle… (no CVSS)
- [CVE-2015-5347](https://cve.now/CVE-2015-5347.md): Cross-site scripting (XSS) vulnerability in the getWindowOpenJavaScript function in… (no CVSS)
- [CVE-2015-7520](https://cve.now/CVE-2015-7520.md): Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apache Wicket 1.5.x… (no CVSS)
- [CVE-2016-2405](https://cve.now/CVE-2016-2405.md): Huawei Policy Center with software before V100R003C10SPC020 allows remote authenticated users to gain privileges and cause a denial of… (no CVSS)
- [CVE-2016-3654](https://cve.now/CVE-2016-3654.md): The device management command line interface (CLI) in Palo Alto Networks PAN-OS before 5.0.18, 5.1.x before 5.1.11, 6.0.x before 6.0.13… (no CVSS)
- [CVE-2016-3655](https://cve.now/CVE-2016-3655.md): The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5… (no CVSS)
- [CVE-2016-3656](https://cve.now/CVE-2016-3656.md): The GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2… (no CVSS)
- [CVE-2016-3657](https://cve.now/CVE-2016-3657.md): Buffer overflow in the GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and… (no CVSS)
- [CVE-2016-4004](https://cve.now/CVE-2016-4004.md): Directory traversal vulnerability in Dell OpenManage Server Administrator (OMSA) 8.2 allows remote authenticated administrators to read… (no CVSS)
- [CVE-2016-0785](https://cve.now/CVE-2016-0785.md): Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced… (no CVSS, org.apache.struts:struts2-core)
- [CVE-2016-2162](https://cve.now/CVE-2016-2162.md): Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote… (no CVSS, org.apache.struts:struts2-core)
- [CVE-2016-3157](https://cve.now/CVE-2016-3157.md): The \_\_switch\_to function in arch/x86/kernel/process\_64.c in the Linux kernel does not properly context-switch IOPL on 64-bit PV Xen… (no CVSS)
- [CVE-2016-3172](https://cve.now/CVE-2016-3172.md): SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands… (no CVSS)
- [CVE-2016-4003](https://cve.now/CVE-2016-4003.md): Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when… (no CVSS, org.apache.struts:struts2-core)
- [CVE-2016-3162](https://cve.now/CVE-2016-3162.md): The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read… (no CVSS, drupal/core · drupal/drupal)
- [CVE-2016-3163](https://cve.now/CVE-2016-3163.md): The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks… (no CVSS, drupal/core · drupal/drupal)
- [CVE-2016-3164](https://cve.now/CVE-2016-3164.md): Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging… (no CVSS, drupal/drupal · drupal/core)
- [CVE-2016-3165](https://cve.now/CVE-2016-3165.md): The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass… (no CVSS, drupal/core · drupal/drupal)
- [CVE-2016-3166](https://cve.now/CVE-2016-3166.md): CRLF injection vulnerability in the drupal\_set\_header function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote… (no CVSS, drupal/core · drupal/drupal)
- [CVE-2016-3167](https://cve.now/CVE-2016-3167.md): Open redirect vulnerability in the drupal\_goto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote… (no CVSS, drupal/core · drupal/drupal)
- [CVE-2016-3168](https://cve.now/CVE-2016-3168.md): The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site… (no CVSS, drupal/core · drupal/drupal)
- [CVE-2016-3169](https://cve.now/CVE-2016-3169.md): The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or… (no CVSS, drupal/core · drupal/drupal)
- [CVE-2016-3170](https://cve.now/CVE-2016-3170.md): The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to… (no CVSS, drupal/core · drupal/drupal)
- [CVE-2016-3171](https://cve.now/CVE-2016-3171.md): Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to… (no CVSS, drupal/core · drupal/drupal)
- [CVE-2015-3268](https://cve.now/CVE-2015-3268.md): Cross-site scripting (XSS) vulnerability in the DisplayEntityField.getDescription method in ModelFormField.java in Apache OFBiz before… (no CVSS)
- [CVE-2015-5167](https://cve.now/CVE-2015-5167.md): The Policy Admin Tool in Apache Ranger before 0.5.1 allows remote authenticated users to bypass intended access restrictions via the REST… (no CVSS, org.apache.ranger:ranger)
- [CVE-2015-8021](https://cve.now/CVE-2015-8021.md): Incomplete blacklist vulnerability in the Configuration utility in F5 BIG-IP LTM, Analytics, APM, ASM, GTM, Link Controller, and PSM 11.x… (no CVSS)
- [CVE-2015-8346](https://cve.now/CVE-2015-8346.md): app/views/timelog/\_form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain… (no CVSS)
- [CVE-2015-8473](https://cve.now/CVE-2015-8473.md): The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive… (no CVSS)
- [CVE-2015-8474](https://cve.now/CVE-2015-8474.md): Open redirect vulnerability in the valid\_back\_url function in app/controllers/application\_controller.rb in Redmine before 2.6.7, 3.0.x… (no CVSS)
- [CVE-2015-8537](https://cve.now/CVE-2015-8537.md): app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain… (no CVSS)
- [CVE-2015-8702](https://cve.now/CVE-2015-8702.md): The DNS::GetResult function in dns.cpp in InspIRCd before 2.0.19 allows remote DNS servers to cause a denial of service (netsplit) via an… (no CVSS)
- [CVE-2016-0733](https://cve.now/CVE-2016-0733.md): The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote… (no CVSS, org.apache.ranger:ranger)
- [CVE-2016-1866](https://cve.now/CVE-2016-1866.md): Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute… (no CVSS, salt)
- [CVE-2016-2140](https://cve.now/CVE-2016-2140.md): The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and… (no CVSS, nova)
- [CVE-2016-2166](https://cve.now/CVE-2016-2166.md): The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton… (no CVSS, org.apache.qpid:proton-j)
- [CVE-2016-2170](https://cve.now/CVE-2016-2170.md): Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted… (no CVSS)
- [CVE-2016-2556](https://cve.now/CVE-2016-2556.md): The Escape interface in the Kernel Mode Driver layer in the NVIDIA GPU graphics driver R340 before 341.95 and R352 before 354.74 on… (no CVSS)
- [CVE-2016-2557](https://cve.now/CVE-2016-2557.md): The Escape interface in the Kernel Mode Driver layer in the NVIDIA GPU graphics driver R340 before 341.95 and R352 before 354.74 on… (no CVSS)
- [CVE-2016-2558](https://cve.now/CVE-2016-2558.md): The Escape interface in the Kernel Mode Driver layer in the NVIDIA GPU graphics driver R340 before 341.95 and R352 before 354.74 on… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2016-04-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.