# CVEs published 2016-09-14 76 CVEs were published on September 14, 2016: 0 critical, 0 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2016-4271](https://cve.now/CVE-2016-4271.md): Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows att (no CVSS) - [CVE-2016-4272](https://cve.now/CVE-2016-4272.md): Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before (no CVSS) - [CVE-2016-4274](https://cve.now/CVE-2016-4274.md): Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows att (no CVSS) - [CVE-2016-4275](https://cve.now/CVE-2016-4275.md): Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows att (no CVSS) - [CVE-2016-4276](https://cve.now/CVE-2016-4276.md): Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows att (no CVSS) - [CVE-2016-4277](https://cve.now/CVE-2016-4277.md): Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows att (no CVSS) - [CVE-2016-4278](https://cve.now/CVE-2016-4278.md): Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows att (no CVSS) - [CVE-2016-4279](https://cve.now/CVE-2016-4279.md): Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before (no CVSS) - [CVE-2016-4280](https://cve.now/CVE-2016-4280.md): Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows att (no CVSS) - [CVE-2016-4281](https://cve.now/CVE-2016-4281.md): Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows att (no CVSS) - [CVE-2016-4282](https://cve.now/CVE-2016-4282.md): Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows att (no CVSS) - [CVE-2016-4283](https://cve.now/CVE-2016-4283.md): Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows att (no CVSS) - [CVE-2016-4284](https://cve.now/CVE-2016-4284.md): Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows att (no CVSS) - [CVE-2016-4285](https://cve.now/CVE-2016-4285.md): Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows att (no CVSS) - [CVE-2016-4287](https://cve.now/CVE-2016-4287.md): Integer overflow in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 (no CVSS) - [CVE-2016-6921](https://cve.now/CVE-2016-6921.md): Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before (no CVSS) - [CVE-2016-6922](https://cve.now/CVE-2016-6922.md): Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows att (no CVSS) - [CVE-2016-6923](https://cve.now/CVE-2016-6923.md): Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before (no CVSS) - [CVE-2016-6924](https://cve.now/CVE-2016-6924.md): Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows att (no CVSS) - [CVE-2016-6925](https://cve.now/CVE-2016-6925.md): Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before (no CVSS) - [CVE-2016-6926](https://cve.now/CVE-2016-6926.md): Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before (no CVSS) - [CVE-2016-6927](https://cve.now/CVE-2016-6927.md): Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before (no CVSS) - [CVE-2016-6929](https://cve.now/CVE-2016-6929.md): Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before (no CVSS) - [CVE-2016-6930](https://cve.now/CVE-2016-6930.md): Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before (no CVSS) - [CVE-2016-6931](https://cve.now/CVE-2016-6931.md): Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before (no CVSS) - [CVE-2016-6932](https://cve.now/CVE-2016-6932.md): Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before (no CVSS) - [CVE-2016-0137](https://cve.now/CVE-2016-0137.md): The Click-to-Run (C2R) implementation in Microsoft Office 2013 SP1 and 2016 allows local users to bypass the ASLR protection mechanism via a (no CVSS) - [CVE-2016-0138](https://cve.now/CVE-2016-0138.md): Microsoft Exchange Server 2007 SP3, 2010 SP3, 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and (no CVSS) - [CVE-2016-0141](https://cve.now/CVE-2016-0141.md): The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document- (no CVSS) - [CVE-2016-3247](https://cve.now/CVE-2016-3247.md): Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr (no CVSS) - [CVE-2016-3291](https://cve.now/CVE-2016-3291.md): Microsoft Internet Explorer 11 and Microsoft Edge mishandle cross-origin requests, which allows remote attackers to obtain sensitive informa (no CVSS) - [CVE-2016-3292](https://cve.now/CVE-2016-3292.md): Microsoft Internet Explorer 10 and 11 mishandles integrity settings and zone settings, which allows remote attackers to bypass a sandbox pro (no CVSS) - [CVE-2016-3294](https://cve.now/CVE-2016-3294.md): Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak (no CVSS) - [CVE-2016-3295](https://cve.now/CVE-2016-3295.md): Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2016-3297](https://cve.now/CVE-2016-3297.md): Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS) - [CVE-2016-3302](https://cve.now/CVE-2016-3302.md): Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607, when the lock screen is enabled, do not (no CVSS) - [CVE-2016-3305](https://cve.now/CVE-2016-3305.md): The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, (no CVSS) - [CVE-2016-3306](https://cve.now/CVE-2016-3306.md): The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, (no CVSS) - [CVE-2016-3324](https://cve.now/CVE-2016-3324.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS) - [CVE-2016-3325](https://cve.now/CVE-2016-3325.md): Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Micros (no CVSS) - [CVE-2016-3330](https://cve.now/CVE-2016-3330.md): Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak (no CVSS) - [CVE-2016-3344](https://cve.now/CVE-2016-3344.md): The Secure Kernel Mode feature in Microsoft Windows 10 Gold and 1511 allows local users to obtain sensitive information via a crafted applic (no CVSS) - [CVE-2016-3345](https://cve.now/CVE-2016-3345.md): The SMBv1 server in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold an (no CVSS) - [CVE-2016-3346](https://cve.now/CVE-2016-3346.md): Microsoft Windows 10 Gold, 1511, and 1607 does not properly enforce permissions, which allows local users to obtain Administrator access via (no CVSS) - [CVE-2016-3348](https://cve.now/CVE-2016-3348.md): The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 (no CVSS) - [CVE-2016-3349](https://cve.now/CVE-2016-3349.md): The kernel-mode drivers in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local (no CVSS) - [CVE-2016-3350](https://cve.now/CVE-2016-3350.md): The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup (no CVSS, Microsoft.ChakraCore) - [CVE-2016-3351](https://cve.now/CVE-2016-3351.md): Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, a (CVSS 6.5, KEV) - [CVE-2016-3352](https://cve.now/CVE-2016-3352.md): Microsoft Windows 8.1, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 do not properly check NTLM SSO requests for MSA logins, which mak (no CVSS) - [CVE-2016-3353](https://cve.now/CVE-2016-3353.md): Microsoft Internet Explorer 9 through 11 mishandles .url files from the Internet zone, which allows remote attackers to bypass intended acce (no CVSS) - [CVE-2016-3354](https://cve.now/CVE-2016-3354.md): The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows (no CVSS) - [CVE-2016-3355](https://cve.now/CVE-2016-3355.md): The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows (no CVSS) - [CVE-2016-3356](https://cve.now/CVE-2016-3356.md): The Graphics Device Interface (GDI) in Microsoft Windows 10 1607 allows remote attackers to execute arbitrary code via a crafted document, a (no CVSS) - [CVE-2016-3357](https://cve.now/CVE-2016-3357.md): Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word for Mac 2011, Word 2016 for Mac, Word Vie (no CVSS) - [CVE-2016-3358](https://cve.now/CVE-2016-3358.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Compatibility Pack SP3, (no CVSS) - [CVE-2016-3359](https://cve.now/CVE-2016-3359.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code v (no CVSS) - [CVE-2016-3360](https://cve.now/CVE-2016-3360.md): Microsoft PowerPoint 2007 SP3, PowerPoint 2010 SP2, PowerPoint 2013 SP1, PowerPoint 2013 RT SP1, PowerPoint 2016 for Mac, Office Compatibili (no CVSS) - [CVE-2016-3361](https://cve.now/CVE-2016-3361.md): Microsoft Excel 2010 SP2 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption V (no CVSS) - [CVE-2016-3362](https://cve.now/CVE-2016-3362.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, Excel (no CVSS) - [CVE-2016-3363](https://cve.now/CVE-2016-3363.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer all (no CVSS) - [CVE-2016-3364](https://cve.now/CVE-2016-3364.md): Microsoft Visio 2016 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulne (no CVSS) - [CVE-2016-3365](https://cve.now/CVE-2016-3365.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, Excel (no CVSS) - [CVE-2016-3366](https://cve.now/CVE-2016-3366.md): Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, Outlook 2016, and Outlook 2016 for Mac do not properly (no CVSS) - [CVE-2016-3367](https://cve.now/CVE-2016-3367.md): StringBuilder in Microsoft Silverlight 5 before 5.1.50709.0 does not properly allocate memory for string-insert and string-append operations (no CVSS) - [CVE-2016-3368](https://cve.now/CVE-2016-3368.md): Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1 (no CVSS) - [CVE-2016-3369](https://cve.now/CVE-2016-3369.md): Microsoft Windows 10 Gold and 1511 allows attackers to cause a denial of service via unspecified vectors, aka "Windows Denial of Service Vul (no CVSS) - [CVE-2016-3370](https://cve.now/CVE-2016-3370.md): The PDF library in Microsoft Edge, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows (no CVSS) - [CVE-2016-3371](https://cve.now/CVE-2016-3371.md): The kernel API in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and (no CVSS) - [CVE-2016-3372](https://cve.now/CVE-2016-3372.md): The kernel API in Microsoft Windows Vista SP2 and Windows Server 2008 SP2 does not properly enforce permissions, which allows local users to (no CVSS) - [CVE-2016-3373](https://cve.now/CVE-2016-3373.md): The kernel API in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and (no CVSS) - [CVE-2016-3374](https://cve.now/CVE-2016-3374.md): The PDF library in Microsoft Edge, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows (no CVSS) - [CVE-2016-3375](https://cve.now/CVE-2016-3375.md): The OLE Automation mechanism and VBScript scripting engine in Microsoft Internet Explorer 9 through 11, Windows Vista SP2, Windows Server 20 (no CVSS) - [CVE-2016-3377](https://cve.now/CVE-2016-3377.md): The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup (no CVSS, Microsoft.ChakraCore) - [CVE-2016-3378](https://cve.now/CVE-2016-3378.md): Open redirect vulnerability in Microsoft Exchange Server 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Upd (no CVSS) - [CVE-2016-3379](https://cve.now/CVE-2016-3379.md): Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 1 and 2 allows remote attackers to inject arbit (no CVSS) - [CVE-2016-3381](https://cve.now/CVE-2016-3381.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer all (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-09-14 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.