# CVEs published 2016-02-10 71 CVEs were published on February 10, 2016: 0 critical, 2 high. 2 are now in CISA KEV. Days are UTC. - [CVE-2016-0948](https://cve.now/CVE-2016-0948.md): Cross-site request forgery (CSRF) vulnerability in Adobe Connect before 9.5.2 allows remote attackers to hijack the authentication of unspec (no CVSS) - [CVE-2016-0949](https://cve.now/CVE-2016-0949.md): Adobe Connect before 9.5.2 allows remote attackers to have an unspecified impact via a crafted parameter in a URL. (no CVSS) - [CVE-2016-0950](https://cve.now/CVE-2016-0950.md): Adobe Connect before 9.5.2 allows remote attackers to spoof the user interface via unspecified vectors. (no CVSS) - [CVE-2016-0951](https://cve.now/CVE-2016-0951.md): Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code o (no CVSS) - [CVE-2016-0952](https://cve.now/CVE-2016-0952.md): Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code o (no CVSS) - [CVE-2016-0953](https://cve.now/CVE-2016-0953.md): Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code o (no CVSS) - [CVE-2016-0955](https://cve.now/CVE-2016-0955.md): Cross-site scripting (XSS) vulnerability in Adobe Experience Manager (AEM) 6.1.0 allows remote authenticated users to inject arbitrary web s (no CVSS) - [CVE-2016-0956](https://cve.now/CVE-2016-0956.md): The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to o (no CVSS, org.apache.sling:org.apache.sling.servlets.post) - [CVE-2016-0957](https://cve.now/CVE-2016-0957.md): Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, which allows remote at (no CVSS) - [CVE-2016-0958](https://cve.now/CVE-2016-0958.md): Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 might allow remote attackers to have an unspecified impact via a crafted serialized Java ob (no CVSS) - [CVE-2016-0964](https://cve.now/CVE-2016-0964.md): Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef (no CVSS) - [CVE-2016-0965](https://cve.now/CVE-2016-0965.md): Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef (no CVSS) - [CVE-2016-0966](https://cve.now/CVE-2016-0966.md): Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef (no CVSS) - [CVE-2016-0967](https://cve.now/CVE-2016-0967.md): Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef (no CVSS) - [CVE-2016-0968](https://cve.now/CVE-2016-0968.md): Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef (no CVSS) - [CVE-2016-0969](https://cve.now/CVE-2016-0969.md): Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef (no CVSS) - [CVE-2016-0970](https://cve.now/CVE-2016-0970.md): Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef (no CVSS) - [CVE-2016-0971](https://cve.now/CVE-2016-0971.md): Heap-based buffer overflow in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.2 (no CVSS) - [CVE-2016-0972](https://cve.now/CVE-2016-0972.md): Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef (no CVSS) - [CVE-2016-0973](https://cve.now/CVE-2016-0973.md): Use-after-free vulnerability in the URLRequest object implementation in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0 (no CVSS) - [CVE-2016-0974](https://cve.now/CVE-2016-0974.md): Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2 (no CVSS) - [CVE-2016-0975](https://cve.now/CVE-2016-0975.md): Use-after-free vulnerability in the instanceof function in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windo (no CVSS) - [CVE-2016-0976](https://cve.now/CVE-2016-0976.md): Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef (no CVSS) - [CVE-2016-0977](https://cve.now/CVE-2016-0977.md): Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef (no CVSS) - [CVE-2016-0978](https://cve.now/CVE-2016-0978.md): Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef (no CVSS) - [CVE-2016-0979](https://cve.now/CVE-2016-0979.md): Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef (no CVSS) - [CVE-2016-0980](https://cve.now/CVE-2016-0980.md): Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef (no CVSS) - [CVE-2016-0981](https://cve.now/CVE-2016-0981.md): Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef (no CVSS) - [CVE-2016-0982](https://cve.now/CVE-2016-0982.md): Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2 (no CVSS) - [CVE-2016-0983](https://cve.now/CVE-2016-0983.md): Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2 (no CVSS) - [CVE-2016-0984](https://cve.now/CVE-2016-0984.md): Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2 (CVSS 8.8, KEV) - [CVE-2016-0985](https://cve.now/CVE-2016-0985.md): Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR bef (no CVSS) - [CVE-2015-7675](https://cve.now/CVE-2015-7675.md): The "Send as attachment" feature in Ipswitch MOVEit DMZ before 8.2 and MOVEit Mobile before 1.2.2 allow remote authenticated users to bypass (no CVSS) - [CVE-2015-7677](https://cve.now/CVE-2015-7677.md): The MOVEitISAPI service in Ipswitch MOVEit DMZ before 8.2 provides different error messages depending on whether a FileID exists, which allo (no CVSS) - [CVE-2015-7678](https://cve.now/CVE-2015-7678.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Ipswitch MOVEit Mobile 1.2.0.962 and earlier allow remote attackers to hijack (no CVSS) - [CVE-2015-7679](https://cve.now/CVE-2015-7679.md): Cross-site scripting (XSS) vulnerability in Ipswitch MOVEit Mobile before 1.2.2 allows remote attackers to inject arbitrary web script or HT (no CVSS) - [CVE-2015-7680](https://cve.now/CVE-2015-7680.md): Ipswitch MOVEit DMZ before 8.2 provides different error messages for authentication attempts depending on whether the user account exists, w (no CVSS) - [CVE-2016-0022](https://cve.now/CVE-2016-0022.md): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, O (no CVSS) - [CVE-2016-0033](https://cve.now/CVE-2016-0033.md): Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 does not prevent recursive compilation of XSLT transforms, which allows (no CVSS) - [CVE-2016-0036](https://cve.now/CVE-2016-0036.md): The Remote Desktop Protocol (RDP) implementation in Microsoft Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 al (no CVSS) - [CVE-2016-0037](https://cve.now/CVE-2016-0037.md): The forms-based authentication implementation in Active Directory Federation Services (ADFS) 3.0 in Microsoft Windows Server 2012 R2 allows (no CVSS) - [CVE-2016-0038](https://cve.now/CVE-2016-0038.md): Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and (no CVSS) - [CVE-2016-0039](https://cve.now/CVE-2016-0039.md): Cross-site scripting (XSS) vulnerability in SharePoint Server in Microsoft SharePoint Foundation 2013 SP1 allows remote attackers to inject (no CVSS) - [CVE-2016-0040](https://cve.now/CVE-2016-0040.md): The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a (CVSS 7.8, KEV) - [CVE-2016-0041](https://cve.now/CVE-2016-0041.md): Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1 (no CVSS) - [CVE-2016-0042](https://cve.now/CVE-2016-0042.md): Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1 (no CVSS) - [CVE-2016-0044](https://cve.now/CVE-2016-0044.md): Sync Framework in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows remote attackers to cause a denial of service (Sy (no CVSS) - [CVE-2016-0046](https://cve.now/CVE-2016-0046.md): Windows Reader in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote attackers to execute arbitrary code v (no CVSS) - [CVE-2016-0047](https://cve.now/CVE-2016-0047.md): WinForms in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows remote attackers to obtain sensitive information from (no CVSS) - [CVE-2016-0048](https://cve.now/CVE-2016-0048.md): The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 (no CVSS) - [CVE-2016-0049](https://cve.now/CVE-2016-0049.md): Kerberos in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, an (no CVSS) - [CVE-2016-0050](https://cve.now/CVE-2016-0050.md): Network Policy Server (NPS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 misparses username queries, which al (no CVSS) - [CVE-2016-0051](https://cve.now/CVE-2016-0051.md): The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold a (no CVSS) - [CVE-2016-0052](https://cve.now/CVE-2016-0052.md): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, O (no CVSS) - [CVE-2016-0053](https://cve.now/CVE-2016-0053.md): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Office Compatibility Pack SP3, Word Vie (no CVSS) - [CVE-2016-0054](https://cve.now/CVE-2016-0054.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Comp (no CVSS) - [CVE-2016-0055](https://cve.now/CVE-2016-0055.md): Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corr (no CVSS) - [CVE-2016-0056](https://cve.now/CVE-2016-0056.md): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, and Office Compatibility Pack SP3 allow (no CVSS) - [CVE-2016-0058](https://cve.now/CVE-2016-0058.md): Buffer overflow in the PDF Library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote attackers to exec (no CVSS) - [CVE-2016-0059](https://cve.now/CVE-2016-0059.md): The Hyperlink Object Library in Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from proces (no CVSS) - [CVE-2016-0060](https://cve.now/CVE-2016-0060.md): Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS) - [CVE-2016-0061](https://cve.now/CVE-2016-0061.md): Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS) - [CVE-2016-0062](https://cve.now/CVE-2016-0062.md): Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr (no CVSS) - [CVE-2016-0063](https://cve.now/CVE-2016-0063.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS) - [CVE-2016-0064](https://cve.now/CVE-2016-0064.md): Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS) - [CVE-2016-0067](https://cve.now/CVE-2016-0067.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS) - [CVE-2016-0071](https://cve.now/CVE-2016-0071.md): Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft (no CVSS) - [CVE-2016-0072](https://cve.now/CVE-2016-0072.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS) - [CVE-2016-0077](https://cve.now/CVE-2016-0077.md): Microsoft Internet Explorer 9 through 11 and Microsoft Edge misparse HTTP responses, which allows remote attackers to spoof web sites via a (no CVSS) - [CVE-2016-0080](https://cve.now/CVE-2016-0080.md): Microsoft Edge mishandles exceptions during window-message dispatch operations, which allows remote attackers to bypass the ASLR protection (no CVSS) - [CVE-2016-0084](https://cve.now/CVE-2016-0084.md): Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-02-10 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.