# CVEs published 2016-10-14

38 CVEs were published on October 14, 2016: 0 critical, 2 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2005-4900](https://cve.now/CVE-2005-4900.md): SHA-1 is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by atta (CVSS 5.9)
- [CVE-2016-0070](https://cve.now/CVE-2016-0070.md): The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, (no CVSS)
- [CVE-2016-0073](https://cve.now/CVE-2016-0073.md): The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows local users (no CVSS)
- [CVE-2016-0075](https://cve.now/CVE-2016-0075.md): The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows local users (no CVSS)
- [CVE-2016-0079](https://cve.now/CVE-2016-0079.md): The kernel in Microsoft Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application that makes an API ca (no CVSS)
- [CVE-2016-0142](https://cve.now/CVE-2016-0142.md): Video Control in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote (no CVSS)
- [CVE-2016-3056](https://cve.now/CVE-2016-3056.md): Cross-site scripting (XSS) vulnerability in Business Space in IBM Business Process Manager 7.5 through 7.5.1.2, 8.0 through 8.0.1.3, and 8.5 (no CVSS)
- [CVE-2016-3209](https://cve.now/CVE-2016-3209.md): Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; (no CVSS)
- [CVE-2016-3262](https://cve.now/CVE-2016-3262.md): Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; (no CVSS)
- [CVE-2016-3263](https://cve.now/CVE-2016-3263.md): Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; (no CVSS)
- [CVE-2016-3266](https://cve.now/CVE-2016-3266.md): The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 (no CVSS)
- [CVE-2016-3267](https://cve.now/CVE-2016-3267.md): Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to determine the existence of unspecified files via a cra (no CVSS)
- [CVE-2016-3270](https://cve.now/CVE-2016-3270.md): The Graphics component in the kernel in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows (no CVSS)
- [CVE-2016-3298](https://cve.now/CVE-2016-3298.md): Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Window (CVSS 6.5, KEV)
- [CVE-2016-3331](https://cve.now/CVE-2016-3331.md): Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr (no CVSS)
- [CVE-2016-3341](https://cve.now/CVE-2016-3341.md): The kernel-mode drivers in Transaction Manager in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gol (no CVSS)
- [CVE-2016-3376](https://cve.now/CVE-2016-3376.md): The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 (no CVSS)
- [CVE-2016-3382](https://cve.now/CVE-2016-3382.md): The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cau (no CVSS, Microsoft.ChakraCore)
- [CVE-2016-3383](https://cve.now/CVE-2016-3383.md): Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS)
- [CVE-2016-3384](https://cve.now/CVE-2016-3384.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2016-3385](https://cve.now/CVE-2016-3385.md): The scripting engine in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of serv (no CVSS)
- [CVE-2016-3386](https://cve.now/CVE-2016-3386.md): The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup (no CVSS, Microsoft.ChakraCore)
- [CVE-2016-3387](https://cve.now/CVE-2016-3387.md): Microsoft Internet Explorer 10 and 11 and Microsoft Edge do not properly restrict access to private namespaces, which allows remote attacker (no CVSS)
- [CVE-2016-3388](https://cve.now/CVE-2016-3388.md): Microsoft Internet Explorer 10 and 11 and Microsoft Edge do not properly restrict access to private namespaces, which allows remote attacker (no CVSS)
- [CVE-2016-3389](https://cve.now/CVE-2016-3389.md): The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup (no CVSS, Microsoft.ChakraCore)
- [CVE-2016-3390](https://cve.now/CVE-2016-3390.md): The scripting engines in Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denia (no CVSS, Microsoft.ChakraCore)
- [CVE-2016-3391](https://cve.now/CVE-2016-3391.md): Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow context-dependent attackers to discover credentials by leveraging access to a (no CVSS)
- [CVE-2016-3392](https://cve.now/CVE-2016-3392.md): The Edge Content Security Policy feature in Microsoft Edge does not properly validate documents, which allows remote attackers to bypass int (no CVSS)
- [CVE-2016-3393](https://cve.now/CVE-2016-3393.md): Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; (CVSS 7.8, KEV)
- [CVE-2016-3396](https://cve.now/CVE-2016-3396.md): Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; (no CVSS)
- [CVE-2016-7182](https://cve.now/CVE-2016-7182.md): The Graphics component in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 G (no CVSS)
- [CVE-2016-7185](https://cve.now/CVE-2016-7185.md): The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 (no CVSS)
- [CVE-2016-7188](https://cve.now/CVE-2016-7188.md): The Standard Collector Service in Windows Diagnostics Hub in Microsoft Windows 10 Gold, 1511, and 1607 mishandles library loading, which all (no CVSS)
- [CVE-2016-7189](https://cve.now/CVE-2016-7189.md): The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via a crafted web site, aka "Scripting Engi (no CVSS, Microsoft.ChakraCore)
- [CVE-2016-7190](https://cve.now/CVE-2016-7190.md): The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup (no CVSS, Microsoft.ChakraCore)
- [CVE-2016-7193](https://cve.now/CVE-2016-7193.md): Microsoft Word 2007 SP2, Office 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibi (CVSS 7.8, KEV)
- [CVE-2016-7194](https://cve.now/CVE-2016-7194.md): The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup (no CVSS, Microsoft.ChakraCore)
- [CVE-2016-7211](https://cve.now/CVE-2016-7211.md): The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-10-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.