# CVEs published 2016-11-25

78 CVEs were published on November 25, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-0316](https://cve.now/CVE-2016-0316.md): Cross-site scripting (XSS) vulnerability in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 an (no CVSS)
- [CVE-2016-0317](https://cve.now/CVE-2016-0317.md): Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote attackers to conduct clickjackin (no CVSS)
- [CVE-2016-0318](https://cve.now/CVE-2016-0318.md): Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 does not destroy a Session ID upon a logout ac (no CVSS)
- [CVE-2016-0319](https://cve.now/CVE-2016-0319.md): The XML parser in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote authenticated (no CVSS)
- [CVE-2016-2926](https://cve.now/CVE-2016-2926.md): Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19 (no CVSS)
- [CVE-2016-2927](https://cve.now/CVE-2016-2927.md): IBM BigFix Remote Control before 9.1.3 does not properly restrict the set of available encryption algorithms, which makes it easier for remo (no CVSS)
- [CVE-2016-2928](https://cve.now/CVE-2016-2928.md): IBM BigFix Remote Control before 9.1.3 allows remote authenticated users to obtain sensitive information by reading error logs. (no CVSS)
- [CVE-2016-2929](https://cve.now/CVE-2016-2929.md): IBM BigFix Remote Control before 9.1.3 does not properly restrict password choices, which makes it easier for remote attackers to obtain acc (no CVSS)
- [CVE-2016-9449](https://cve.now/CVE-2016-9449.md): The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information ab (no CVSS, drupal/core · drupal/drupal)
- [CVE-2016-9450](https://cve.now/CVE-2016-9450.md): The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to (no CVSS, drupal/core · drupal/drupal)
- [CVE-2016-9451](https://cve.now/CVE-2016-9451.md): Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified (no CVSS, drupal/core)
- [CVE-2016-9452](https://cve.now/CVE-2016-9452.md): The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL. (no CVSS, drupal/core · drupal/drupal)
- [CVE-2016-3904](https://cve.now/CVE-2016-3904.md): An elevation of privilege vulnerability in the Qualcomm bus driver in Android before 2016-11-05 could enable a local malicious application t (no CVSS, Google Android)
- [CVE-2016-3906](https://cve.now/CVE-2016-3906.md): An information disclosure vulnerability in Qualcomm components including the GPU driver, power driver, SMSM Point-to-Point driver, and sound (no CVSS, Android Kernel-3.10)
- [CVE-2016-3907](https://cve.now/CVE-2016-3907.md): An information disclosure vulnerability in Qualcomm components including the GPU driver, power driver, SMSM Point-to-Point driver, and sound (no CVSS, Google Android)
- [CVE-2016-6698](https://cve.now/CVE-2016-6698.md): An information disclosure vulnerability in Qualcomm components including the GPU driver, power driver, SMSM Point-to-Point driver, and sound (no CVSS, Google Android)
- [CVE-2016-6700](https://cve.now/CVE-2016-6700.md): An elevation of privilege vulnerability in libzipfile in Android 4.x before 4.4.4, 5.0.x before 5.0.2, and 5.1.x before 5.1.1 could enable a (no CVSS, Google Android)
- [CVE-2016-6701](https://cve.now/CVE-2016-6701.md): A remote code execution vulnerability in libskia in Android 7.0 before 2016-11-01 could enable an attacker using a specially crafted file to (no CVSS, Google Android)
- [CVE-2016-6702](https://cve.now/CVE-2016-6702.md): A remote code execution vulnerability in libjpeg in Android 4.x before 4.4.4, 5.0.x before 5.0.2, and 5.1.x before 5.1.1 could enable an att (no CVSS, Google Android)
- [CVE-2016-6703](https://cve.now/CVE-2016-6703.md): A remote code execution vulnerability in an Android runtime library in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and (no CVSS, Google Android)
- [CVE-2016-6704](https://cve.now/CVE-2016-6704.md): An elevation of privilege vulnerability in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016- (no CVSS, Google Android)
- [CVE-2016-6705](https://cve.now/CVE-2016-6705.md): An elevation of privilege vulnerability in Mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 bef (no CVSS, Google Android)
- [CVE-2016-6707](https://cve.now/CVE-2016-6707.md): An elevation of privilege vulnerability in System Server in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable a local mal (no CVSS, Google Android)
- [CVE-2016-6708](https://cve.now/CVE-2016-6708.md): An elevation of privilege in the System UI in Android 7.0 before 2016-11-01 could enable a local malicious user to bypass the security promp (no CVSS, Google Android)
- [CVE-2016-6709](https://cve.now/CVE-2016-6709.md): An information disclosure vulnerability in Conscrypt and BoringSSL in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable a (no CVSS, Google Android)
- [CVE-2016-6710](https://cve.now/CVE-2016-6710.md): An information disclosure vulnerability in the download manager in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, an (no CVSS, Google Android)
- [CVE-2016-6713](https://cve.now/CVE-2016-6713.md): A remote denial of service vulnerability in Mediaserver in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable an attacker (no CVSS, Google Android)
- [CVE-2016-6714](https://cve.now/CVE-2016-6714.md): A remote denial of service vulnerability in Mediaserver in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable an attacker (no CVSS, Google Android)
- [CVE-2016-6715](https://cve.now/CVE-2016-6715.md): An elevation of privilege vulnerability in the Framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x befor (no CVSS, Google Android)
- [CVE-2016-6716](https://cve.now/CVE-2016-6716.md): An elevation of privilege vulnerability in the AOSP Launcher in Android 7.0 before 2016-11-01 could allow a local malicious application to c (no CVSS, Google Android)
- [CVE-2016-6717](https://cve.now/CVE-2016-6717.md): An elevation of privilege vulnerability in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016- (no CVSS, Google Android)
- [CVE-2016-6718](https://cve.now/CVE-2016-6718.md): An elevation of privilege vulnerability in the Account Manager Service in Android 7.0 before 2016-11-01 could enable a local malicious appli (no CVSS, Google Android)
- [CVE-2016-6719](https://cve.now/CVE-2016-6719.md): An elevation of privilege vulnerability in the Bluetooth component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x (no CVSS, Google Android)
- [CVE-2016-6721](https://cve.now/CVE-2016-6721.md): An information disclosure vulnerability in Mediaserver in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable a local malic (no CVSS, Google Android)
- [CVE-2016-6723](https://cve.now/CVE-2016-6723.md): A denial of service vulnerability in Proxy Auto Config in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016- (no CVSS, Google Android)
- [CVE-2016-6724](https://cve.now/CVE-2016-6724.md): A denial of service vulnerability in the Input Manager Service in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x befo (no CVSS, Google Android)
- [CVE-2016-6725](https://cve.now/CVE-2016-6725.md): A remote code execution vulnerability in the Qualcomm crypto driver in Android before 2016-11-05 could enable a remote attacker to execute a (no CVSS, Google Android)
- [CVE-2016-6728](https://cve.now/CVE-2016-6728.md): An elevation of privilege vulnerability in the kernel ION subsystem in Android before 2016-11-05 could enable a local malicious application (no CVSS, Google Android)
- [CVE-2016-6729](https://cve.now/CVE-2016-6729.md): An elevation of privilege vulnerability in the Qualcomm bootloader in Android before 2016-11-05 could enable a local malicious application t (no CVSS, Google Android)
- [CVE-2016-6730](https://cve.now/CVE-2016-6730.md): An elevation of privilege vulnerability in the NVIDIA GPU driver in Android before 2016-11-05 could enable a local malicious application to (no CVSS, Google Android)
- [CVE-2016-6731](https://cve.now/CVE-2016-6731.md): An elevation of privilege vulnerability in the NVIDIA GPU driver in Android before 2016-11-05 could enable a local malicious application to (no CVSS, Google Android)
- [CVE-2016-6732](https://cve.now/CVE-2016-6732.md): An elevation of privilege vulnerability in the NVIDIA GPU driver in Android before 2016-11-05 could enable a local malicious application to (no CVSS, Google Android)
- [CVE-2016-6733](https://cve.now/CVE-2016-6733.md): An elevation of privilege vulnerability in the NVIDIA GPU driver in Android before 2016-11-05 could enable a local malicious application to (no CVSS, Google Android)
- [CVE-2016-6734](https://cve.now/CVE-2016-6734.md): An elevation of privilege vulnerability in the NVIDIA GPU driver in Android before 2016-11-05 could enable a local malicious application to (no CVSS, Google Android)
- [CVE-2016-6735](https://cve.now/CVE-2016-6735.md): An elevation of privilege vulnerability in the NVIDIA GPU driver in Android before 2016-11-05 could enable a local malicious application to (no CVSS, Google Android)
- [CVE-2016-6736](https://cve.now/CVE-2016-6736.md): An elevation of privilege vulnerability in the NVIDIA GPU driver in Android before 2016-11-05 could enable a local malicious application to (no CVSS, Google Android)
- [CVE-2016-6737](https://cve.now/CVE-2016-6737.md): An elevation of privilege vulnerability in the kernel ION subsystem in Android before 2016-11-05 could enable a local malicious application (no CVSS, Google Android)
- [CVE-2016-6738](https://cve.now/CVE-2016-6738.md): An elevation of privilege vulnerability in the Qualcomm crypto engine driver in Android before 2016-11-05 could enable a local malicious app (no CVSS, Google Android)
- [CVE-2016-6739](https://cve.now/CVE-2016-6739.md): An elevation of privilege vulnerability in the Qualcomm camera driver in Android before 2016-11-05 could enable a local malicious applicatio (no CVSS, Google Android)
- [CVE-2016-6740](https://cve.now/CVE-2016-6740.md): An elevation of privilege vulnerability in the Qualcomm camera driver in Android before 2016-11-05 could enable a local malicious applicatio (no CVSS, Google Android)
- [CVE-2016-6741](https://cve.now/CVE-2016-6741.md): An elevation of privilege vulnerability in the Qualcomm camera driver in Android before 2016-11-05 could enable a local malicious applicatio (no CVSS, Google Android)
- [CVE-2016-6742](https://cve.now/CVE-2016-6742.md): An elevation of privilege vulnerability in the Synaptics touchscreen driver in Android before 2016-11-05 could enable a local malicious appl (no CVSS, Google Android)
- [CVE-2016-6743](https://cve.now/CVE-2016-6743.md): An elevation of privilege vulnerability in the Synaptics touchscreen driver in Android before 2016-11-05 could enable a local malicious appl (no CVSS, Android Kernel-3.10)
- [CVE-2016-6744](https://cve.now/CVE-2016-6744.md): An elevation of privilege vulnerability in the Synaptics touchscreen driver in Android before 2016-11-05 could enable a local malicious appl (no CVSS, Google Android)
- [CVE-2016-6745](https://cve.now/CVE-2016-6745.md): An elevation of privilege vulnerability in the Synaptics touchscreen driver in Android before 2016-11-05 could enable a local malicious appl (no CVSS, Google Android)
- [CVE-2016-6746](https://cve.now/CVE-2016-6746.md): An information disclosure vulnerability in the NVIDIA GPU driver in Android before 2016-11-05 could enable a local malicious application to (no CVSS, Google Android)
- [CVE-2016-6747](https://cve.now/CVE-2016-6747.md): A denial of service vulnerability in Mediaserver in Android before 2016-11-05 could enable an attacker to use a specially crafted file to ca (no CVSS, Google Android)
- [CVE-2016-6748](https://cve.now/CVE-2016-6748.md): An information disclosure vulnerability in Qualcomm components including the GPU driver, power driver, SMSM Point-to-Point driver, and sound (no CVSS, Google Android)
- [CVE-2016-6749](https://cve.now/CVE-2016-6749.md): An information disclosure vulnerability in Qualcomm components including the GPU driver, power driver, SMSM Point-to-Point driver, and sound (no CVSS, Google Android)
- [CVE-2016-6750](https://cve.now/CVE-2016-6750.md): An information disclosure vulnerability in Qualcomm components including the GPU driver, power driver, SMSM Point-to-Point driver, and sound (no CVSS, Google Android)
- [CVE-2016-6751](https://cve.now/CVE-2016-6751.md): An information disclosure vulnerability in Qualcomm components including the GPU driver, power driver, SMSM Point-to-Point driver, and sound (no CVSS, Google Android)
- [CVE-2016-6752](https://cve.now/CVE-2016-6752.md): An information disclosure vulnerability in Qualcomm components including the GPU driver, power driver, SMSM Point-to-Point driver, and sound (no CVSS, Google Android)
- [CVE-2016-6753](https://cve.now/CVE-2016-6753.md): An information disclosure vulnerability in kernel components, including the process-grouping subsystem and the networking subsystem, in Andr (no CVSS, Google Android)
- [CVE-2016-6754](https://cve.now/CVE-2016-6754.md): A remote code execution vulnerability in Webview in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-05 could enable a (no CVSS, Google Android)
- [CVE-2016-2947](https://cve.now/CVE-2016-2947.md): IBM Rational Collaborative Lifecycle Management 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quali (no CVSS)
- [CVE-2016-2984](https://cve.now/CVE-2016-2984.md): IBM Spectrum Scale 4.1.1.x before 4.1.1.8 and 4.2.x before 4.2.0.4 and General Parallel File System (GPFS) 3.5.x before 3.5.0.32 and 4.1.x b (no CVSS)
- [CVE-2016-2985](https://cve.now/CVE-2016-2985.md): IBM Spectrum Scale 4.1.1.x before 4.1.1.8 and 4.2.x before 4.2.0.4 and General Parallel File System (GPFS) 3.5.x before 3.5.0.32 and 4.1.x b (no CVSS)
- [CVE-2016-2986](https://cve.now/CVE-2016-2986.md): Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 6.x before 6.0.1 iFix6, Rational Quality Manager (no CVSS)
- [CVE-2016-2988](https://cve.now/CVE-2016-2988.md): IBM Tivoli Storage Manger for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 6.4.x before (no CVSS)
- [CVE-2016-3025](https://cve.now/CVE-2016-3025.md): IBM Security Access Manager for Mobile 8.x before 8.0.1.4 IF3 and Security Access Manager 9.x before 9.0.1.0 IF5 do not properly restrict fa (no CVSS)
- [CVE-2016-3028](https://cve.now/CVE-2016-3028.md): IBM Security Access Manager for Web 7.0 before IF2 and 8.0 before 8.0.1.4 IF3 and Security Access Manager 9.0 before 9.0.1.0 IF5 allow remot (no CVSS)
- [CVE-2016-5788](https://cve.now/CVE-2016-5788.md): General Electric (GE) Bently Nevada 3500/22M USB with firmware before 5.0 and Bently Nevada 3500/22M Serial have open ports, which makes it (no CVSS)
- [CVE-2016-5955](https://cve.now/CVE-2016-5955.md): Cross-site scripting (XSS) vulnerability in IBM Rational DOORS Next Generation 6.0.2 before iFix004 allows remote authenticated users to inj (no CVSS)
- [CVE-2016-5967](https://cve.now/CVE-2016-5967.md): The installation component in IBM Rational Asset Analyzer (RAA) 6.1.0 before FP10 allows local users to discover the WAS Admin password by r (no CVSS)
- [CVE-2016-5968](https://cve.now/CVE-2016-5968.md): The Replay Server in IBM Tealeaf Customer Experience 8.x before 8.7.1.8847 FP10, 8.8.x before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1 (no CVSS)
- [CVE-2016-5981](https://cve.now/CVE-2016-5981.md): Cross-site scripting (XSS) vulnerability in IBM FileNet Workplace XT through 1.1.5.2-WPXT-LA011 and FileNet Workplace (Application Engine) t (no CVSS)
- [CVE-2016-5991](https://cve.now/CVE-2016-5991.md): IBM Sterling Connect:Direct 4.5.00, 4.5.01, 4.6.0 before 4.6.0.6 iFix008, and 4.7.0 before 4.7.0.4 on Windows allows local users to gain pri (no CVSS)
- [CVE-2016-5992](https://cve.now/CVE-2016-5992.md): IBM Sterling Connect:Direct 4.5.00, 4.5.01, 4.6.0 before 4.6.0.6 iFix008, and 4.7.0 before 4.7.0.4 on Windows allows local users to cause a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-11-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.