# CVEs published 2016-11-29

9 CVEs were published on November 29, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-9480](https://cve.now/CVE-2016-9480.md): libdwarf 2016-10-21 allows context-dependent attackers to obtain sensitive information or cause a denial of service by using the "malformed (no CVSS)
- [CVE-2016-9481](https://cve.now/CVE-2016-9481.md): In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, content\_id input is passed into showComments. (no CVSS)
- [CVE-2016-1251](https://cve.now/CVE-2016-1251.md): There is a vulnerability of type use-after-free affecting DBD::mysql (aka DBD-mysql or the Database Interface (DBI) MySQL driver for Perl) 3 (no CVSS, DBD::mysql before)
- [CVE-2016-8223](https://cve.now/CVE-2016-8223.md): During an internal security review, Lenovo identified a local privilege escalation vulnerability in Lenovo System Interface Foundation softw (no CVSS, Lenovo Group All ThinkPad, ThinkCentre, ThinkStation and Le…)
- [CVE-2016-8224](https://cve.now/CVE-2016-8224.md): A vulnerability has been identified in some Lenovo Notebook and ThinkServer systems where an attacker with administrative privileges on a sy (no CVSS, Lenovo Group Lenovo Notebook models 110-14IBR/110-15IBR, B7…)
- [CVE-2016-1247](https://cve.now/CVE-2016-1247.md): The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubu (no CVSS)
- [CVE-2016-5685](https://cve.now/CVE-2016-5685.md): Dell iDRAC7 and iDRAC8 devices with firmware before 2.40.40.40 allow authenticated users to gain Bash shell access through a string injectio (no CVSS, Dell EMC iDRAC7 and iDRAC8)
- [CVE-2016-5765](https://cve.now/CVE-2016-5765.md): Administrative Server in Micro Focus Host Access Management and Security Server (MSS) and Reflection for the Web (RWeb) and Reflection Secur (no CVSS, Micro Focus MSS, RWeb, ZFE, RSG 1.x, 2.x, 12.x)
- [CVE-2016-5393](https://cve.now/CVE-2016-5393.md): In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbit (no CVSS, Apache Hadoop · org.apache.hadoop:hadoop-common)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-11-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.