# CVEs published 2016-11-04

21 CVEs were published on November 4, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-8576](https://cve.now/CVE-2016-8576.md): The xhci\_ring\_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of ser (no CVSS)
- [CVE-2016-8577](https://cve.now/CVE-2016-8577.md): Memory leak in the v9fs\_read function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of (no CVSS)
- [CVE-2016-8578](https://cve.now/CVE-2016-8578.md): The v9fs\_iov\_vunmarshal function in fsdev/9p-iov-marshal.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a deni (no CVSS)
- [CVE-2016-8667](https://cve.now/CVE-2016-8667.md): The rc4030\_write function in hw/dma/rc4030.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (no CVSS)
- [CVE-2016-8668](https://cve.now/CVE-2016-8668.md): The rocker\_io\_writel function in hw/net/rocker/rocker.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial (no CVSS)
- [CVE-2016-8669](https://cve.now/CVE-2016-8669.md): The serial\_update\_parameters function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denia (no CVSS)
- [CVE-2016-8869](https://cve.now/CVE-2016-8869.md): The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote (no CVSS)
- [CVE-2016-8870](https://cve.now/CVE-2016-8870.md): The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registr (no CVSS)
- [CVE-2016-8909](https://cve.now/CVE-2016-8909.md): The intel\_hda\_xfer function in hw/audio/intel-hda.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of s (no CVSS)
- [CVE-2016-8910](https://cve.now/CVE-2016-8910.md): The rtl8139\_cplus\_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial (no CVSS)
- [CVE-2016-9177](https://cve.now/CVE-2016-9177.md): Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. (no CVSS, com.sparkjava:spark-core)
- [CVE-2016-9182](https://cve.now/CVE-2016-9182.md): Exponent CMS 2.4 uses PHP reflection to call a method of a controller class, and then uses the method name to check user permission. (no CVSS)
- [CVE-2016-9183](https://cve.now/CVE-2016-9183.md): In /framework/modules/ecommerce/controllers/orderController.php of Exponent CMS 2.4.0, untrusted input is passed into selectObjectsBySql. (no CVSS)
- [CVE-2016-9184](https://cve.now/CVE-2016-9184.md): In /framework/modules/core/controllers/expHTMLEditorController.php of Exponent CMS 2.4.0, untrusted input is used to construct a table name, (no CVSS)
- [CVE-2016-9185](https://cve.now/CVE-2016-9185.md): In OpenStack Heat, by launching a new Heat stack with a local URL an authenticated user may conduct network discovery revealing internal net (no CVSS)
- [CVE-2016-9186](https://cve.now/CVE-2016-9186.md): Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated u (no CVSS)
- [CVE-2016-9187](https://cve.now/CVE-2016-9187.md): Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated use (no CVSS, moodle/moodle)
- [CVE-2016-9188](https://cve.now/CVE-2016-9188.md): Cross-site scripting (XSS) vulnerabilities in Moodle CMS on or before 3.1.2 allow remote attackers to inject arbitrary web script or HTML vi (no CVSS, moodle/moodle)
- [CVE-2016-9189](https://cve.now/CVE-2016-9189.md): Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related t (no CVSS, pillow)
- [CVE-2016-9190](https://cve.now/CVE-2016-9190.md): Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an " (no CVSS, pillow)
- [CVE-2016-9176](https://cve.now/CVE-2016-9176.md): Stack buffer overflow in the send.exe and receive.exe components of Micro Focus Rumba 9.4 and earlier could be used by local attackers or at (no CVSS, Micro Focus Rumba)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-11-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.