# CVEs published 2016-11-30

40 CVEs were published on November 30, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-2881](https://cve.now/CVE-2016-2881.md): IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 and QRadar Incident Forensics 7.2 before 7.2.7 allow remote attackers to bypass (no CVSS)
- [CVE-2016-2884](https://cve.now/CVE-2016-2884.md): Cross-site request forgery (CSRF) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3.1, in an unspecified non-defaul (no CVSS)
- [CVE-2016-2887](https://cve.now/CVE-2016-2887.md): IBM IMS Enterprise Suite Data Provider before 3.2.0.1 for Microsoft .NET allows remote authenticated users to obtain sensitive information o (no CVSS)
- [CVE-2016-2917](https://cve.now/CVE-2016-2917.md): The notifications component in IBM TRIRIGA Applications 10.4 and 10.5 before 10.5.1 allows remote authenticated users to obtain sensitive pa (no CVSS)
- [CVE-2016-2869](https://cve.now/CVE-2016-2869.md): Multiple cross-site scripting (XSS) vulnerabilities in the UI in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allow remote a (no CVSS)
- [CVE-2016-2871](https://cve.now/CVE-2016-2871.md): IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 uses cleartext storage for unspecified passwords, which allows local users to o (no CVSS)
- [CVE-2016-2873](https://cve.now/CVE-2016-2873.md): SQL injection vulnerability in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allows remote authenticated users to execute arb (no CVSS)
- [CVE-2016-2874](https://cve.now/CVE-2016-2874.md): IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 mishandles authorization, which allows remote authenticated users to obtain sen (no CVSS)
- [CVE-2016-2876](https://cve.now/CVE-2016-2876.md): IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 executes unspecified processes at an incorrect privilege level, which makes it (no CVSS)
- [CVE-2016-2877](https://cve.now/CVE-2016-2877.md): IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 uses weak permissions for unspecified directories under the web root, which all (no CVSS)
- [CVE-2016-2878](https://cve.now/CVE-2016-2878.md): Multiple cross-site request forgery (CSRF) vulnerabilities in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allow remote atta (no CVSS)
- [CVE-2016-8222](https://cve.now/CVE-2016-8222.md): A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad systems that can allow an attacker with Windows (no CVSS, Lenovo Group ThinkPad systems)
- [CVE-2016-2931](https://cve.now/CVE-2016-2931.md): IBM BigFix Remote Control before 9.1.3 allows remote attackers to obtain sensitive cleartext information by sniffing the network. (no CVSS)
- [CVE-2016-2932](https://cve.now/CVE-2016-2932.md): IBM BigFix Remote Control before 9.1.3 allows remote attackers to conduct XML injection attacks via unspecified vectors. (no CVSS)
- [CVE-2016-2933](https://cve.now/CVE-2016-2933.md): Directory traversal vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote authenticated administrators to read arbitrary fil (no CVSS)
- [CVE-2016-2934](https://cve.now/CVE-2016-2934.md): Cross-site scripting (XSS) vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2016-2935](https://cve.now/CVE-2016-2935.md): The broker application in IBM BigFix Remote Control before 9.1.3 allows remote attackers to cause a denial of service via an invalid HTTP re (no CVSS)
- [CVE-2016-2936](https://cve.now/CVE-2016-2936.md): IBM BigFix Remote Control before 9.1.3 uses cleartext storage for unspecified passwords, which allows local users to obtain sensitive inform (no CVSS)
- [CVE-2016-2937](https://cve.now/CVE-2016-2937.md): IBM BigFix Remote Control before 9.1.3 allows remote attackers to obtain sensitive information or spoof e-mail transmission via a crafted PO (no CVSS)
- [CVE-2016-2940](https://cve.now/CVE-2016-2940.md): Multiple unspecified vulnerabilities in IBM BigFix Remote Control before 9.1.3 allow remote attackers to obtain sensitive information via un (no CVSS)
- [CVE-2016-2943](https://cve.now/CVE-2016-2943.md): IBM BigFix Remote Control before 9.1.3 allows local users to obtain sensitive information by leveraging unspecified privileges to read a log (no CVSS)
- [CVE-2016-2944](https://cve.now/CVE-2016-2944.md): IBM BigFix Remote Control before 9.1.3 does not properly restrict failed login attempts, which makes it easier for remote attackers to obtai (no CVSS)
- [CVE-2016-2948](https://cve.now/CVE-2016-2948.md): IBM BigFix Remote Control before 9.1.3 allows local users to discover hardcoded credentials via unspecified vectors. (no CVSS)
- [CVE-2016-2949](https://cve.now/CVE-2016-2949.md): IBM BigFix Remote Control before 9.1.3 allows local users to obtain sensitive information by reading cached web pages from a different user' (no CVSS)
- [CVE-2016-2950](https://cve.now/CVE-2016-2950.md): SQL injection vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote authenticated users to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2016-2951](https://cve.now/CVE-2016-2951.md): IBM BigFix Remote Control before 9.1.3 does not properly set the default encryption strength, which makes it easier for remote attackers to (no CVSS)
- [CVE-2016-2952](https://cve.now/CVE-2016-2952.md): IBM BigFix Remote Control before 9.1.3 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain s (no CVSS)
- [CVE-2016-2953](https://cve.now/CVE-2016-2953.md): IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 does not require SSL, which allows remote attackers to obtain sensitive (no CVSS)
- [CVE-2016-2957](https://cve.now/CVE-2016-2957.md): IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to obtain sensitive information by re (no CVSS)
- [CVE-2016-2958](https://cve.now/CVE-2016-2958.md): IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to obtain sensitive information by re (no CVSS)
- [CVE-2016-2963](https://cve.now/CVE-2016-2963.md): Cross-site request forgery (CSRF) vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote attackers to hijack the authenticati (no CVSS)
- [CVE-2016-3002](https://cve.now/CVE-2016-3002.md): IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows physically proximate attackers to obtain sensitive information b (no CVSS)
- [CVE-2016-3004](https://cve.now/CVE-2016-3004.md): Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authen (no CVSS)
- [CVE-2016-3009](https://cve.now/CVE-2016-3009.md): Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authen (no CVSS)
- [CVE-2016-3014](https://cve.now/CVE-2016-3014.md): Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 4.0 before 4.0.7 iFix11 and 5.0 before 5.0.2 iFi (no CVSS)
- [CVE-2016-3057](https://cve.now/CVE-2016-3057.md): Cross-site scripting (XSS) vulnerability in IBM Sterling B2B Integrator 5.2 before 5020500\_14 and 5.2 06 before 5020602\_1 allows remote atta (no CVSS)
- [CVE-2016-5890](https://cve.now/CVE-2016-5890.md): IBM Sterling B2B Integrator 5.2 before 5020500\_14 and 5.2 06 before 5020602\_1 allows remote authenticated users to change arbitrary password (no CVSS)
- [CVE-2016-5905](https://cve.now/CVE-2016-5905.md): Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5 before 7.5.0.10 IF3 and 7.6 before 7.6.0.5 IF2 allows remote aut (no CVSS)
- [CVE-2016-5987](https://cve.now/CVE-2016-5987.md): IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5 before 7.5.0.10 IF4, and 7.6 before 7.6.0.5 IF3 allows remote attackers to obtain sens (no CVSS)
- [CVE-2016-9564](https://cve.now/CVE-2016-9564.md): Buffer overflow in send\_redirect() in Boa Webserver 0.92r allows remote attackers to DoS via an HTTP GET request requesting a long URI with (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-11-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.