CVE-2016-9176

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Stack buffer overflow in the send.exe and receive.exe components of Micro Focus Rumba 9.4 and earlier could be used by local attackers or attackers able to inject arguments to these binaries to execute code.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
Micro Focus	Micro Focus Rumba 9.4	Micro Focus Rumba 9.4

References

Timeline

Published: Nov 4, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-91777.5Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.CVE-2016-91785.5The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel before 4.7.5 does not initialize a certain integer variabl CVE-2016-91797.5lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could ins CVE-2016-91809.1perl-XML-Twig: The option to `expand_external_ents`, documented as controlling external entity expansion in XML::Twig does not work. Externa CVE-2016-91817.1perl-Image-Info: When parsing an SVG file, external entity expansion (XXE) was not disabled. An attacker could craft an SVG file which, when CVE-2016-91827.5Exponent CMS 2.4 uses PHP reflection to call a method of a controller class, and then uses the method name to check user permission. But, th CVE-2016-91837.5In /framework/modules/ecommerce/controllers/orderController.php of Exponent CMS 2.4.0, untrusted input is passed into selectObjectsBySql. Th CVE-2016-91847.5In /framework/modules/core/controllers/expHTMLEditorController.php of Exponent CMS 2.4.0, untrusted input is used to construct a table name,CVE-2016-91854.3In OpenStack Heat, by launching a new Heat stack with a local URL an authenticated user may conduct network discovery revealing internal net CVE-2016-91868.8Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated u CVE-2016-91878.8Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated use CVE-2016-91886.1Cross-site scripting (XSS) vulnerabilities in Moodle CMS on or before 3.1.2 allow remote attackers to inject arbitrary web script or HTML vi