# CVEs published 2016-11-10 75 CVEs were published on November 10, 2016: 0 critical, 5 high. 5 are now in CISA KEV. Days are UTC. - [CVE-2016-5195](https://cve.now/CVE-2016-5195.md): Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect ha (CVSS 7.0, KEV) - [CVE-2016-9268](https://cve.now/CVE-2016-9268.md): Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows (no CVSS) - [CVE-2016-7146](https://cve.now/CVE-2016-7146.md): MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation or crafted URL" approach, relat (no CVSS, moin) - [CVE-2016-7148](https://cve.now/CVE-2016-7148.md): MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation" approach, related to a "Cross (no CVSS, moin) - [CVE-2016-4095](https://cve.now/CVE-2016-4095.md): Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Contin (no CVSS, Adobe Reader and Acrobat before) - [CVE-2016-7488](https://cve.now/CVE-2016-7488.md): Teradata Virtual Machine Community Edition v15.10 has insecure file permissions on /etc/luminex/pkgmgr. (no CVSS, Teradata Virtual Machine Community Edition) - [CVE-2016-7489](https://cve.now/CVE-2016-7489.md): Teradata Virtual Machine Community Edition v15.10's perl script /opt/teradata/gsctools/bin/t2a.pl creates files in /tmp in an insecure manne (no CVSS, Teradata Virtual Machine Community Edition) - [CVE-2016-7490](https://cve.now/CVE-2016-7490.md): The installation script studioexpressinstall for Teradata Studio Express 15.12.00.00 creates files in /tmp insecurely. (no CVSS, Teradata Studio Express) - [CVE-2016-0026](https://cve.now/CVE-2016-0026.md): The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win (no CVSS) - [CVE-2016-3332](https://cve.now/CVE-2016-3332.md): The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win (no CVSS) - [CVE-2016-3333](https://cve.now/CVE-2016-3333.md): The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win (no CVSS) - [CVE-2016-3334](https://cve.now/CVE-2016-3334.md): The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win (no CVSS) - [CVE-2016-3335](https://cve.now/CVE-2016-3335.md): The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win (no CVSS) - [CVE-2016-3338](https://cve.now/CVE-2016-3338.md): The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win (no CVSS) - [CVE-2016-3340](https://cve.now/CVE-2016-3340.md): The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win (no CVSS) - [CVE-2016-3342](https://cve.now/CVE-2016-3342.md): The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win (no CVSS) - [CVE-2016-3343](https://cve.now/CVE-2016-3343.md): The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win (no CVSS) - [CVE-2016-7184](https://cve.now/CVE-2016-7184.md): The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win (no CVSS) - [CVE-2016-7195](https://cve.now/CVE-2016-7195.md): Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS) - [CVE-2016-7196](https://cve.now/CVE-2016-7196.md): Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2016-7198](https://cve.now/CVE-2016-7198.md): Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS) - [CVE-2016-7199](https://cve.now/CVE-2016-7199.md): Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to bypass the Same Origin Policy and obtain sensitive win (no CVSS) - [CVE-2016-7200](https://cve.now/CVE-2016-7200.md): The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (mem (CVSS 8.8, KEV, Microsoft.ChakraCore) - [CVE-2016-7201](https://cve.now/CVE-2016-7201.md): The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (mem (CVSS 8.8, KEV, Microsoft.ChakraCore) - [CVE-2016-7202](https://cve.now/CVE-2016-7202.md): The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cau (no CVSS, Microsoft.ChakraCore) - [CVE-2016-7203](https://cve.now/CVE-2016-7203.md): The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (mem (no CVSS, Microsoft.ChakraCore) - [CVE-2016-7204](https://cve.now/CVE-2016-7204.md): Microsoft Edge allows remote attackers to access arbitrary "My Documents" files via a crafted web site, aka "Microsoft Edge Information Disc (no CVSS) - [CVE-2016-7205](https://cve.now/CVE-2016-7205.md): Animation Manager in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wind (no CVSS) - [CVE-2016-7208](https://cve.now/CVE-2016-7208.md): The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (mem (no CVSS, Microsoft.ChakraCore) - [CVE-2016-7209](https://cve.now/CVE-2016-7209.md): Microsoft Edge allows remote attackers to spoof web content via a crafted web site, aka "Microsoft Edge Spoofing Vulnerability." (no CVSS) - [CVE-2016-7210](https://cve.now/CVE-2016-7210.md): atmfd.dll in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, W (no CVSS) - [CVE-2016-7212](https://cve.now/CVE-2016-7212.md): Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1 (no CVSS) - [CVE-2016-7213](https://cve.now/CVE-2016-7213.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, and Office (no CVSS) - [CVE-2016-7214](https://cve.now/CVE-2016-7214.md): The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 (no CVSS) - [CVE-2016-7215](https://cve.now/CVE-2016-7215.md): The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 (no CVSS) - [CVE-2016-7216](https://cve.now/CVE-2016-7216.md): The kernel API in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandles permissions, which allows lo (no CVSS) - [CVE-2016-7217](https://cve.now/CVE-2016-7217.md): Media Foundation in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Ser (no CVSS) - [CVE-2016-7218](https://cve.now/CVE-2016-7218.md): Bowser.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Window (no CVSS) - [CVE-2016-7220](https://cve.now/CVE-2016-7220.md): Virtual Secure Mode in Microsoft Windows 10 allows local users to obtain sensitive information via a crafted application, aka "Virtual Secur (no CVSS) - [CVE-2016-7221](https://cve.now/CVE-2016-7221.md): Input Method Editor (IME) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 201 (no CVSS) - [CVE-2016-7222](https://cve.now/CVE-2016-7222.md): Task Scheduler in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 allows local users to gain privileges via a crafted UNC (no CVSS) - [CVE-2016-7223](https://cve.now/CVE-2016-7223.md): Virtual Hard Disk Driver in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Win (no CVSS) - [CVE-2016-7224](https://cve.now/CVE-2016-7224.md): Virtual Hard Disk Driver in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Win (no CVSS) - [CVE-2016-7225](https://cve.now/CVE-2016-7225.md): Virtual Hard Disk Driver in Windows 10 Gold, 1511, and 1607 and Windows Server 2016 does not properly restrict access to files, which allows (no CVSS) - [CVE-2016-7226](https://cve.now/CVE-2016-7226.md): Virtual Hard Disk Driver in Windows 10 Gold, 1511, and 1607 and Windows Server 2016 does not properly restrict access to files, which allows (no CVSS) - [CVE-2016-7227](https://cve.now/CVE-2016-7227.md): The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to determine the existence of lo (no CVSS) - [CVE-2016-7228](https://cve.now/CVE-2016-7228.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, and Office (no CVSS) - [CVE-2016-7229](https://cve.now/CVE-2016-7229.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Comp (no CVSS) - [CVE-2016-7230](https://cve.now/CVE-2016-7230.md): Microsoft PowerPoint 2010 SP2, PowerPoint Viewer, and Office Web Apps 2010 SP2 allow remote attackers to execute arbitrary code via a crafte (no CVSS) - [CVE-2016-7231](https://cve.now/CVE-2016-7231.md): Microsoft Excel 2007 SP3, Excel for Mac 2011, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary co (no CVSS) - [CVE-2016-7232](https://cve.now/CVE-2016-7232.md): Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, and Office Compatibility Pack SP3 allow remote attackers to execute (no CVSS) - [CVE-2016-7233](https://cve.now/CVE-2016-7233.md): Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Excel for Mac 2011, Word Viewer, Office Compatibility Pack SP3, Word (no CVSS) - [CVE-2016-7234](https://cve.now/CVE-2016-7234.md): Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Excel for Mac 2011, Word 2016 for M (no CVSS) - [CVE-2016-7235](https://cve.now/CVE-2016-7235.md): Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Excel for Mac 2011, and Office Compatibility Pack SP3 allow remote a (no CVSS) - [CVE-2016-7236](https://cve.now/CVE-2016-7236.md): Microsoft Excel 2010 SP2, Excel for Mac 2011, Excel 2016 for Mac, and Excel Services on SharePoint Server 2010 SP2 allow remote attackers to (no CVSS) - [CVE-2016-7237](https://cve.now/CVE-2016-7237.md): Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Window (no CVSS) - [CVE-2016-7238](https://cve.now/CVE-2016-7238.md): Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1 (no CVSS) - [CVE-2016-7239](https://cve.now/CVE-2016-7239.md): The RegEx class in the XSS filter in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to conduct cross-si (no CVSS) - [CVE-2016-7240](https://cve.now/CVE-2016-7240.md): The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (mem (no CVSS, Microsoft.ChakraCore) - [CVE-2016-7241](https://cve.now/CVE-2016-7241.md): Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr (no CVSS) - [CVE-2016-7242](https://cve.now/CVE-2016-7242.md): The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (mem (no CVSS, Microsoft.ChakraCore) - [CVE-2016-7243](https://cve.now/CVE-2016-7243.md): The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (mem (no CVSS, Microsoft.ChakraCore) - [CVE-2016-7244](https://cve.now/CVE-2016-7244.md): Microsoft Office 2007 SP3 allows remote attackers to cause a denial of service (application hang) via a crafted Office document, aka "Micros (no CVSS) - [CVE-2016-7245](https://cve.now/CVE-2016-7245.md): Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, and Office 2016 allow remote attackers to execute arbitrary (no CVSS) - [CVE-2016-7246](https://cve.now/CVE-2016-7246.md): The kernel-mode drivers in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1 (no CVSS) - [CVE-2016-7247](https://cve.now/CVE-2016-7247.md): Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow physi (no CVSS) - [CVE-2016-7248](https://cve.now/CVE-2016-7248.md): Microsoft Video Control in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allo (no CVSS) - [CVE-2016-7249](https://cve.now/CVE-2016-7249.md): Microsoft SQL Server 2016 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privil (no CVSS) - [CVE-2016-7250](https://cve.now/CVE-2016-7250.md): Microsoft SQL Server 2014 SP1, 2014 SP2, and 2016 does not properly perform a cast of an unspecified pointer, which allows remote authentica (no CVSS) - [CVE-2016-7251](https://cve.now/CVE-2016-7251.md): Cross-site scripting (XSS) vulnerability in the MDS API in Microsoft SQL Server 2016 allows remote attackers to inject arbitrary web script (no CVSS) - [CVE-2016-7252](https://cve.now/CVE-2016-7252.md): Microsoft SQL Server 2016 mishandles the FILESTREAM path, which allows remote authenticated users to gain privileges via unspecified vectors (no CVSS) - [CVE-2016-7253](https://cve.now/CVE-2016-7253.md): The agent in Microsoft SQL Server 2012 SP2, 2012 SP3, 2014 SP1, 2014 SP2, and 2016 does not properly check the atxcore.dll ACL, which allows (no CVSS) - [CVE-2016-7254](https://cve.now/CVE-2016-7254.md): Microsoft SQL Server 2012 SP2 and 2012 SP3 does not properly perform a cast of an unspecified pointer, which allows remote authenticated use (no CVSS) - [CVE-2016-7255](https://cve.now/CVE-2016-7255.md): The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 (CVSS 7.8, KEV) - [CVE-2016-7256](https://cve.now/CVE-2016-7256.md): atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Window (CVSS 8.8, KEV) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-11-10 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.