# CVEs published 2016-12-14

42 CVEs were published on December 14, 2016: 0 critical, 7 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2014-8241](https://cve.now/CVE-2014-8241.md): XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a mallo (no CVSS)
- [CVE-2016-3684](https://cve.now/CVE-2016-3684.md): SAP Download Manager 2.1.142 and earlier uses a hardcoded encryption key to protect stored data, which allows context-dependent attackers to (no CVSS)
- [CVE-2016-3685](https://cve.now/CVE-2016-3685.md): SAP Download Manager 2.1.142 and earlier generates an encryption key from a small key space on Windows and Mac systems, which allows context (no CVSS)
- [CVE-2016-1000156](https://cve.now/CVE-2016-1000156.md): Mailcwp remote file upload vulnerability incomplete fix v1.100 (no CVSS)
- [CVE-2016-4443](https://cve.now/CVE-2016-4443.md): Red Hat Enterprise Virtualization (RHEV) Manager 3.6 allows local users to obtain encryption keys, certificates, and other sensitive informa (no CVSS)
- [CVE-2016-8733](https://cve.now/CVE-2016-8733.md): An exploitable integer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. (CVSS 7.8, Joyent SmartOS)
- [CVE-2016-9031](https://cve.now/CVE-2016-9031.md): An exploitable integer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. (CVSS 7.8, Joyent SmartOS)
- [CVE-2016-9032](https://cve.now/CVE-2016-9032.md): An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. (CVSS 7.0, Joyent SmartOS)
- [CVE-2016-9033](https://cve.now/CVE-2016-9033.md): An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. (CVSS 7.0, Joyent SmartOS)
- [CVE-2016-9034](https://cve.now/CVE-2016-9034.md): An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. (CVSS 7.0, Joyent SmartOS)
- [CVE-2016-9035](https://cve.now/CVE-2016-9035.md): An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. (CVSS 7.0, Joyent SmartOS)
- [CVE-2016-6277](https://cve.now/CVE-2016-6277.md): NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before (CVSS 8.8, KEV)
- [CVE-2016-1411](https://cve.now/CVE-2016-1411.md): A vulnerability in the update functionality of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (no CVSS, Cisco AsyncOS)
- [CVE-2016-6449](https://cve.now/CVE-2016-6449.md): A vulnerability in the system management of certain FireAMP system processes in Cisco FireAMP Connector Endpoint software could allow an aut (no CVSS, Cisco FireAMP Connector Endpoint software)
- [CVE-2016-6464](https://cve.now/CVE-2016-6464.md): A vulnerability in the web management interface of the Cisco Unified Communications Manager IM and Presence Service could allow an unauthent (no CVSS, Cisco Unified Communications Manager)
- [CVE-2016-6465](https://cve.now/CVE-2016-6465.md): A vulnerability in the content filtering functionality of Cisco AsyncOS Software for Cisco Email Security Appliances and Cisco Web Security (no CVSS, Cisco AsyncOS)
- [CVE-2016-6467](https://cve.now/CVE-2016-6467.md): A vulnerability in IPv6 packet fragment reassembly of StarOS for Cisco Aggregation Services Router (ASR) 5000 Series Switch could allow an u (no CVSS, Cisco Aggregation Services Router (ASR) 5000 Series Switch)
- [CVE-2016-6468](https://cve.now/CVE-2016-6468.md): A vulnerability in the web-based management interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduc (no CVSS, Cisco Emergency Responder)
- [CVE-2016-6469](https://cve.now/CVE-2016-6469.md): A vulnerability in HTTP URL parsing of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker (no CVSS, Cisco Web Security Appliance)
- [CVE-2016-6470](https://cve.now/CVE-2016-6470.md): A vulnerability in the installation procedure of the Cisco Hybrid Media Service could allow an authenticated, local attacker to elevate priv (no CVSS, Cisco Hybrid Media Service)
- [CVE-2016-6471](https://cve.now/CVE-2016-6471.md): A vulnerability in the web-based management interface of Cisco Firepower Management Center running FireSIGHT System software could allow an (no CVSS, Cisco Firepower Management Center)
- [CVE-2016-6473](https://cve.now/CVE-2016-6473.md): A vulnerability in Cisco IOS on Catalyst Switches and Nexus 9300 Series Switches could allow an unauthenticated, adjacent attacker to cause (no CVSS, Cisco IOS)
- [CVE-2016-6474](https://cve.now/CVE-2016-6474.md): A vulnerability in the implementation of X.509 Version 3 for SSH authentication functionality in Cisco IOS and IOS XE Software could allow a (no CVSS, Cisco IOS)
- [CVE-2016-9192](https://cve.now/CVE-2016-9192.md): A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and execute a (no CVSS, Cisco AnyConnect Secure Mobility Client)
- [CVE-2016-9193](https://cve.now/CVE-2016-9193.md): A vulnerability in the malicious file detection and blocking features of Cisco Firepower Management Center and Cisco FireSIGHT System Softwa (no CVSS, Cisco FireSIGHT)
- [CVE-2016-9198](https://cve.now/CVE-2016-9198.md): A vulnerability in the Active Directory integration component of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote (no CVSS, Cisco Identity Services Engine)
- [CVE-2016-9199](https://cve.now/CVE-2016-9199.md): A vulnerability in the Cisco application-hosting framework (CAF) of Cisco IOx could allow an authenticated, remote attacker to read arbitrar (no CVSS, Cisco IOx)
- [CVE-2016-9200](https://cve.now/CVE-2016-9200.md): A vulnerability in the web framework code of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct (no CVSS, Cisco Prime Collaboration Assurance)
- [CVE-2016-9201](https://cve.now/CVE-2016-9201.md): A vulnerability in the Zone-Based Firewall feature of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to (no CVSS, Cisco IOS and Cisco IOS XE)
- [CVE-2016-9202](https://cve.now/CVE-2016-9202.md): A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA) Switches could allow an unauthenticated, remot (no CVSS, Cisco Email Security Appliance)
- [CVE-2016-9203](https://cve.now/CVE-2016-9203.md): A vulnerability in the Internet Key Exchange Version 2 (IKEv2) feature of Cisco ASR 5000 Series Software could allow an unauthenticated, rem (no CVSS, Cisco ASR)
- [CVE-2016-9204](https://cve.now/CVE-2016-9204.md): A vulnerability in the Cisco Intercloud Fabric (ICF) Director could allow an unauthenticated, remote attacker to connect to internal service (no CVSS, Cisco Intercloud Fabric (ICF) Director)
- [CVE-2016-9205](https://cve.now/CVE-2016-9205.md): A vulnerability in the HTTP 2.0 request handling code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the (no CVSS, Cisco IOS XR)
- [CVE-2016-9206](https://cve.now/CVE-2016-9206.md): A vulnerability in the ccmadmin page of Cisco Unified Communications Manager (CUCM) could allow an unauthenticated, remote attacker to condu (no CVSS, Cisco Unified Communications Manager)
- [CVE-2016-9207](https://cve.now/CVE-2016-9207.md): A vulnerability in the HTTP traffic server component of Cisco Expressway could allow an unauthenticated, remote attacker to initiate TCP con (no CVSS, Cisco Expressway)
- [CVE-2016-9208](https://cve.now/CVE-2016-9208.md): A vulnerability in the File Management Utility, the Download File form, and the Serviceability application of Cisco Emergency Responder coul (no CVSS, Cisco Emergency Responder)
- [CVE-2016-9209](https://cve.now/CVE-2016-9209.md): A vulnerability in TCP processing in Cisco FirePOWER system software could allow an unauthenticated, remote attacker to download files that (no CVSS, Cisco FirePOWER)
- [CVE-2016-9210](https://cve.now/CVE-2016-9210.md): A vulnerability in the Cisco Unified Reporting upload tool accessed via the Cisco Unified Communications Manager could allow an unauthentica (no CVSS, Cisco Unified Reporting)
- [CVE-2016-9211](https://cve.now/CVE-2016-9211.md): A vulnerability in TCP port management in Cisco ONS 15454 Series Multiservice Provisioning Platforms could allow an unauthenticated, remote (no CVSS, Cisco ONS 15454 Series Multiservice Provisioning)
- [CVE-2016-9212](https://cve.now/CVE-2016-9212.md): A vulnerability in the Decrypt for End-User Notification configuration parameter of Cisco AsyncOS Software for Cisco Web Security Appliances (no CVSS, Cisco Web Security Appliance)
- [CVE-2016-9214](https://cve.now/CVE-2016-9214.md): Cisco Identity Services Engine (ISE) contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site s (no CVSS, Cisco Identity Services Engine)
- [CVE-2016-9215](https://cve.now/CVE-2016-9215.md): A vulnerability in Cisco IOS XR Software could allow an authenticated, local attacker to log in to the device with the privileges of the roo (no CVSS, Cisco IOS XR)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-12-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.