Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: November 2016

55 records · 8 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2016-7855
    73This week

    Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote atta

    HighCVSS 8.8KEVWeaponizedEPSS 25%

    adobe · flash playerNov 1, 2016

  • CVE-2016-8864
    42Plan

    named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of ser

    HighCVSS 7.5No exploitEPSS 38%

    isc · bindNov 2, 2016

  • CVE-2016-8869
    68This week

    The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote

    CriticalCVSS 9.8WeaponizedEPSS 97%

    joomla · joomla\!Nov 4, 2016

  • CVE-2016-8870
    60This week

    The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registr

    HighCVSS 8.1WeaponizedEPSS 81%

    joomla · joomla\!Nov 4, 2016

  • CVE-2016-3340
    35Monitor

    The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win

    HighCVSS 7.8No exploitEPSS 12%

    microsoft · windows 10Nov 10, 2016

  • CVE-2016-3342
    35Monitor

    The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win

    HighCVSS 7.8No exploitEPSS 12%

    microsoft · windows 10Nov 10, 2016

  • CVE-2016-3343
    35Monitor

    The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win

    HighCVSS 7.8No exploitEPSS 12%

    microsoft · windows 10Nov 10, 2016

  • CVE-2016-7195
    35Monitor

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m

    HighCVSS 7.5No exploitEPSS 16%

    microsoft · edgeNov 10, 2016

  • CVE-2016-7196
    34Monitor

    Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memo

    HighCVSS 7.5No exploitEPSS 14%

    microsoft · edgeNov 10, 2016

  • CVE-2016-7198
    34Monitor

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m

    HighCVSS 7.5No exploitEPSS 14%

    microsoft · edgeNov 10, 2016

  • CVE-2016-7199
    16Monitor

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to bypass the Same Origin Policy and obtain sensitive win

    LowCVSS 3.1No exploitEPSS 13%

    microsoft · edgeNov 10, 2016

  • CVE-2016-7200
    90Now

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (mem

    HighCVSS 8.8KEVWeaponizedEPSS 82%

    microsoft · edgeNov 10, 2016

  • CVE-2016-7201
    89Now

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (mem

    HighCVSS 8.8KEVWeaponizedEPSS 80%

    microsoft · edgeNov 10, 2016

  • CVE-2016-7202
    52Plan

    The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cau

    HighCVSS 7.5Proof of conceptEPSS 73%

    microsoft · edgeNov 10, 2016

  • CVE-2016-7203
    49Plan

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (mem

    HighCVSS 7.5Proof of conceptEPSS 64%

    microsoft · edgeNov 10, 2016

  • CVE-2016-7204
    15Monitor

    Microsoft Edge allows remote attackers to access arbitrary "My Documents" files via a crafted web site, aka "Microsoft Edge Information Disc

    LowCVSS 3.1No exploitEPSS 11%

    microsoft · edgeNov 10, 2016

  • CVE-2016-7205
    41Plan

    Animation Manager in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wind

    HighCVSS 8.8No exploitEPSS 21%

    microsoft · windows 10Nov 10, 2016

  • CVE-2016-7208
    35Monitor

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (mem

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · edgeNov 10, 2016

  • CVE-2016-7210
    32Monitor

    atmfd.dll in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, W

    MediumCVSS 6.5No exploitEPSS 21%

    microsoft · windows 10Nov 10, 2016

  • CVE-2016-7212
    52Plan

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1

    HighCVSS 7.8No exploitEPSS 69%

    microsoft · windows 10Nov 10, 2016

  • CVE-2016-7213
    37Monitor

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, and Office

    HighCVSS 7.8No exploitEPSS 19%

    microsoft · excelNov 10, 2016

  • CVE-2016-7217
    41Plan

    Media Foundation in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Ser

    HighCVSS 8.8No exploitEPSS 21%

    microsoft · windows 10Nov 10, 2016

  • CVE-2016-7227
    15Monitor

    The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to determine the existence of lo

    LowCVSS 3.1No exploitEPSS 11%

    microsoft · edgeNov 10, 2016

  • CVE-2016-7228
    39Monitor

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, and Office

    HighCVSS 7.8No exploitEPSS 28%

    microsoft · excelNov 10, 2016

  • CVE-2016-7229
    37Monitor

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Comp

    HighCVSS 7.8No exploitEPSS 19%

    microsoft · excelNov 10, 2016

  • CVE-2016-7230
    37Monitor

    Microsoft PowerPoint 2010 SP2, PowerPoint Viewer, and Office Web Apps 2010 SP2 allow remote attackers to execute arbitrary code via a crafte

    HighCVSS 7.8No exploitEPSS 18%

    microsoft · office web appsNov 10, 2016

  • CVE-2016-7231
    37Monitor

    Microsoft Excel 2007 SP3, Excel for Mac 2011, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary co

    HighCVSS 7.8No exploitEPSS 18%

    microsoft · excelNov 10, 2016

  • CVE-2016-7232
    38Monitor

    Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, and Office Compatibility Pack SP3 allow remote attackers to execute

    HighCVSS 7.8No exploitEPSS 24%

    microsoft · officeNov 10, 2016

  • CVE-2016-7233
    33Monitor

    Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Excel for Mac 2011, Word Viewer, Office Compatibility Pack SP3, Word

    MediumCVSS 6.5No exploitEPSS 22%

    microsoft · excel for macNov 10, 2016

  • CVE-2016-7234
    38Monitor

    Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Excel for Mac 2011, Word 2016 for M

    HighCVSS 7.8No exploitEPSS 22%

    microsoft · excel for macNov 10, 2016

  • CVE-2016-7235
    37Monitor

    Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Excel for Mac 2011, and Office Compatibility Pack SP3 allow remote a

    HighCVSS 7.8No exploitEPSS 19%

    microsoft · excel for macNov 10, 2016

  • CVE-2016-7236
    37Monitor

    Microsoft Excel 2010 SP2, Excel for Mac 2011, Excel 2016 for Mac, and Excel Services on SharePoint Server 2010 SP2 allow remote attackers to

    HighCVSS 7.8No exploitEPSS 20%

    microsoft · excelNov 10, 2016

  • CVE-2016-7237
    46Plan

    Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Window

    MediumCVSS 6.5Proof of conceptEPSS 67%

    microsoft · windows 10Nov 10, 2016

  • CVE-2016-7239
    15Monitor

    The RegEx class in the XSS filter in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to conduct cross-si

    LowCVSS 3.1No exploitEPSS 11%

    microsoft · edgeNov 10, 2016

  • CVE-2016-7240
    50Plan

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (mem

    HighCVSS 7.5Proof of conceptEPSS 66%

    microsoft · edgeNov 10, 2016

  • CVE-2016-7241
    51Plan

    Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr

    HighCVSS 7.5Proof of conceptEPSS 71%

    microsoft · edgeNov 10, 2016

  • CVE-2016-7242
    35Monitor

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (mem

    HighCVSS 7.5No exploitEPSS 16%

    microsoft · edgeNov 10, 2016

  • CVE-2016-7243
    35Monitor

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (mem

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · edgeNov 10, 2016

  • CVE-2016-7245
    37Monitor

    Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, and Office 2016 allow remote attackers to execute arbitrary

    HighCVSS 7.8No exploitEPSS 19%

    microsoft · officeNov 10, 2016

  • CVE-2016-7248
    38Monitor

    Microsoft Video Control in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allo

    HighCVSS 7.8No exploitEPSS 21%

    microsoft · windows 10Nov 10, 2016

  • CVE-2016-7249
    39Monitor

    Microsoft SQL Server 2016 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privil

    HighCVSS 8.8No exploitEPSS 11%

    microsoft · sql serverNov 10, 2016

  • CVE-2016-7250
    39Monitor

    Microsoft SQL Server 2014 SP1, 2014 SP2, and 2016 does not properly perform a cast of an unspecified pointer, which allows remote authentica

    HighCVSS 8.8No exploitEPSS 11%

    microsoft · sql serverNov 10, 2016

  • CVE-2016-7252
    31Monitor

    Microsoft SQL Server 2016 mishandles the FILESTREAM path, which allows remote authenticated users to gain privileges via unspecified vectors

    MediumCVSS 6.5No exploitEPSS 17%

    microsoft · sql serverNov 10, 2016

  • CVE-2016-7253
    39Monitor

    The agent in Microsoft SQL Server 2012 SP2, 2012 SP3, 2014 SP1, 2014 SP2, and 2016 does not properly check the atxcore.dll ACL, which allows

    HighCVSS 8.8No exploitEPSS 11%

    microsoft · sql serverNov 10, 2016

  • CVE-2016-7254
    39Monitor

    Microsoft SQL Server 2012 SP2 and 2012 SP3 does not properly perform a cast of an unspecified pointer, which allows remote authenticated use

    HighCVSS 8.8No exploitEPSS 11%

    microsoft · sql serverNov 10, 2016

  • CVE-2016-7255
    85Now

    The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012

    HighCVSS 7.8KEVWeaponizedEPSS 80%

    microsoft · windows 10 1507Nov 10, 2016

  • CVE-2016-7256
    84Now

    atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Window

    HighCVSS 8.8KEVWeaponizedEPSS 64%

    microsoft · windows 10 1507Nov 10, 2016

  • CVE-2016-7244
    27Monitor

    Microsoft Office 2007 SP3 allows remote attackers to cause a denial of service (application hang) via a crafted Office document, aka "Micros

    MediumCVSS 5.5No exploitEPSS 16%

    microsoft · officeNov 10, 2016

  • CVE-2016-5195
    83Now

    Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect ha

    HighCVSS 7.0KEVWeaponizedEPSS 83%

    linux · linux kernelNov 10, 2016

  • CVE-2016-8562
    61This week

    A vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions < V2.0.28).

    HighCVSS 7.5KEVWeaponizedEPSS 3%

    siemens · simatic cp 1543-1 firmwareNov 18, 2016

  • CVE-2016-9150
    49Plan

    Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x

    CriticalCVSS 9.8Proof of conceptEPSS 34%

    paloaltonetworks · pan-osNov 19, 2016

  • CVE-2016-9563
    63This week

    BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~t

    MediumCVSS 6.5KEVWeaponizedEPSS 24%

    sap · netweaver application server javaNov 22, 2016

  • CVE-2016-1248
    39Monitor

    vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execu

    HighCVSS 7.8No exploitEPSS 25%

    vim · vimNov 23, 2016

  • CVE-2015-1328
    42Plan

    The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check per

    HighCVSS 7.8WeaponizedEPSS 37%

    linux · linux kernelNov 27, 2016

  • CVE-2016-9555
    42Plan

    The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length checking for the first chunk, which

    CriticalCVSS 9.8No exploitEPSS 10%

    linux · linux kernelNov 27, 2016