# CVEs published 2016-12-20

44 CVEs were published on December 20, 2016: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2016-4552](https://cve.now/CVE-2016-4552.md): Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2016-5303](https://cve.now/CVE-2016-5303.md): Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 a (no CVSS)
- [CVE-2016-9757](https://cve.now/CVE-2016-9757.md): In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has the capability to create tags ca (no CVSS, Rapid7 Nexpose)
- [CVE-2016-7181](https://cve.now/CVE-2016-7181.md): Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak (no CVSS)
- [CVE-2016-7206](https://cve.now/CVE-2016-7206.md): Cross-site scripting (XSS) vulnerability in Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified ve (no CVSS)
- [CVE-2016-7219](https://cve.now/CVE-2016-7219.md): The Crypto driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold a (no CVSS)
- [CVE-2016-7257](https://cve.now/CVE-2016-7257.md): The GDI component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office for Mac 2011, and Office 2016 fo (no CVSS)
- [CVE-2016-7258](https://cve.now/CVE-2016-7258.md): The kernel in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 mishandles page-fault system calls, which allows local users (no CVSS)
- [CVE-2016-7259](https://cve.now/CVE-2016-7259.md): The Graphics Component in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows (no CVSS)
- [CVE-2016-7260](https://cve.now/CVE-2016-7260.md): The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 (no CVSS)
- [CVE-2016-7262](https://cve.now/CVE-2016-7262.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer all (CVSS 7.8, KEV)
- [CVE-2016-7263](https://cve.now/CVE-2016-7263.md): Microsoft Excel for Mac 2011 and Excel 2016 for Mac allow remote attackers to execute arbitrary code or cause a denial of service (memory co (no CVSS)
- [CVE-2016-7264](https://cve.now/CVE-2016-7264.md): Microsoft Excel 2007 SP3, Office Compatibility Pack SP3, Excel Viewer, Excel for Mac 2011, and Excel 2016 for Mac allow remote attackers to (no CVSS)
- [CVE-2016-7265](https://cve.now/CVE-2016-7265.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, Excel (no CVSS)
- [CVE-2016-7266](https://cve.now/CVE-2016-7266.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, and Ex (no CVSS)
- [CVE-2016-7267](https://cve.now/CVE-2016-7267.md): Microsoft Excel 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 misparses file formats, which makes it easier for remote attackers to execute arbi (no CVSS)
- [CVE-2016-7268](https://cve.now/CVE-2016-7268.md): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word for Mac 2011, Word Automation Serv (no CVSS)
- [CVE-2016-7270](https://cve.now/CVE-2016-7270.md): The Data Provider for SQL Server in Microsoft .NET Framework 4.6.2 mishandles a developer-supplied key, which allows remote attackers to byp (no CVSS)
- [CVE-2016-7271](https://cve.now/CVE-2016-7271.md): The Secure Kernel Mode implementation in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 allows local users to bypass the (no CVSS)
- [CVE-2016-7272](https://cve.now/CVE-2016-7272.md): The Graphics component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 G (no CVSS)
- [CVE-2016-7273](https://cve.now/CVE-2016-7273.md): The Graphics component in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 allows remote attackers to execute arbitrary cod (no CVSS)
- [CVE-2016-7274](https://cve.now/CVE-2016-7274.md): Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, W (no CVSS)
- [CVE-2016-7275](https://cve.now/CVE-2016-7275.md): Microsoft Office 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 mishandles library loading, which allows local users to gain privileges via a cra (no CVSS)
- [CVE-2016-7276](https://cve.now/CVE-2016-7276.md): Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office for Mac 2011, and Office 2016 for Mac allow remote attackers to obtain s (no CVSS)
- [CVE-2016-7277](https://cve.now/CVE-2016-7277.md): Microsoft Office 2016 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted docum (no CVSS)
- [CVE-2016-7278](https://cve.now/CVE-2016-7278.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, (no CVSS)
- [CVE-2016-7279](https://cve.now/CVE-2016-7279.md): Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS)
- [CVE-2016-7280](https://cve.now/CVE-2016-7280.md): Cross-site scripting (XSS) vulnerability in Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified ve (no CVSS)
- [CVE-2016-7281](https://cve.now/CVE-2016-7281.md): The Web Workers implementation in Microsoft Internet Explorer 10 and 11 and Microsoft Edge allows remote attackers to bypass the Same Origin (no CVSS)
- [CVE-2016-7282](https://cve.now/CVE-2016-7282.md): Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to inject ar (no CVSS)
- [CVE-2016-7283](https://cve.now/CVE-2016-7283.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2016-7284](https://cve.now/CVE-2016-7284.md): Microsoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, ak (no CVSS)
- [CVE-2016-7286](https://cve.now/CVE-2016-7286.md): The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi (no CVSS)
- [CVE-2016-7287](https://cve.now/CVE-2016-7287.md): The scripting engines in Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denia (no CVSS)
- [CVE-2016-7288](https://cve.now/CVE-2016-7288.md): The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi (no CVSS)
- [CVE-2016-7289](https://cve.now/CVE-2016-7289.md): Microsoft Publisher 2010 SP2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafte (no CVSS)
- [CVE-2016-7290](https://cve.now/CVE-2016-7290.md): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word for Mac 2011, Word Automation Services on Share (no CVSS)
- [CVE-2016-7291](https://cve.now/CVE-2016-7291.md): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word for Mac 2011, Word Automation Services on Share (no CVSS)
- [CVE-2016-7292](https://cve.now/CVE-2016-7292.md): The Installer in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R (no CVSS)
- [CVE-2016-7295](https://cve.now/CVE-2016-7295.md): The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win (no CVSS)
- [CVE-2016-7296](https://cve.now/CVE-2016-7296.md): The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi (no CVSS)
- [CVE-2016-7297](https://cve.now/CVE-2016-7297.md): The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi (no CVSS)
- [CVE-2016-7298](https://cve.now/CVE-2016-7298.md): Microsoft Office 2007 SP3, Office 2010 SP2, Word Viewer, Office for Mac 2011, and Office 2016 for Mac allow remote attackers to execute arbi (no CVSS)
- [CVE-2016-7300](https://cve.now/CVE-2016-7300.md): Untrusted search path vulnerability in Microsoft Auto Updater for Mac allows local users to gain privileges via a Trojan horse executable fi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-12-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.