# CVEs published 2016-12-30

9 CVEs were published on December 30, 2016: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2016-10033](https://cve.now/CVE-2016-10033.md): The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail c (CVSS 9.8, KEV, phpmailer/phpmailer)
- [CVE-2016-10034](https://cve.now/CVE-2016-10034.md): The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framew (no CVSS, zendframework/zend-mail)
- [CVE-2016-10045](https://cve.now/CVE-2016-10045.md): The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently e (no CVSS, phpmailer/phpmailer)
- [CVE-2016-10074](https://cve.now/CVE-2016-10074.md): The mail transport (aka Swift\_Transport\_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to (no CVSS, swiftmailer/swiftmailer)
- [CVE-2016-10088](https://cve.now/CVE-2016-10088.md): The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL\_DS option i (no CVSS)
- [CVE-2016-10082](https://cve.now/CVE-2016-10082.md): include/functions\_installer.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during (no CVSS)
- [CVE-2016-10083](https://cve.now/CVE-2016-10083.md): Cross-site scripting (XSS) vulnerability in admin/plugin.php in Piwigo through 2.8.3 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2016-10084](https://cve.now/CVE-2016-10084.md): admin/batch\_manager.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the $page\[' (no CVSS)
- [CVE-2016-10085](https://cve.now/CVE-2016-10085.md): admin/languages.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the tab paramet (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-12-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.