# CVEs published 2016-04-22 29 CVEs were published on April 22, 2016: 0 critical, 0 high. Days are UTC. - [CVE-2015-8823](https://cve.now/CVE-2015-8823.md): Use-after-free vulnerability in the TextField object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0. (no CVSS) - [CVE-2016-1036](https://cve.now/CVE-2016-1036.md): Cross-site scripting (XSS) vulnerability in Adobe Analytics AppMeasurement for Flash Library before 4.0.1, when debugTracking is enabled, al (no CVSS) - [CVE-2016-1916](https://cve.now/CVE-2016-1916.md): Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote auth (no CVSS) - [CVE-2016-1917](https://cve.now/CVE-2016-1917.md): Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote atta (no CVSS) - [CVE-2016-1918](https://cve.now/CVE-2016-1918.md): Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote atta (no CVSS) - [CVE-2016-2203](https://cve.now/CVE-2016-2203.md): The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to discover an encrypted AD pa (no CVSS) - [CVE-2016-2204](https://cve.now/CVE-2016-2204.md): The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to obtain root-shell access vi (no CVSS) - [CVE-2016-3126](https://cve.now/CVE-2016-3126.md): Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote atta (no CVSS) - [CVE-2016-4059](https://cve.now/CVE-2016-4059.md): Use-after-free vulnerability in Foxit Reader and PhantomPDF before 7.3.4 on Windows allows remote attackers to execute arbitrary code via a (no CVSS) - [CVE-2016-4060](https://cve.now/CVE-2016-4060.md): Use-after-free vulnerability in Foxit Reader and PhantomPDF before 7.3.4 on Windows allows remote attackers to cause a denial of service (ap (no CVSS) - [CVE-2016-4061](https://cve.now/CVE-2016-4061.md): Foxit Reader and PhantomPDF before 7.3.4 on Windows allow remote attackers to cause a denial of service (application crash) via a crafted co (no CVSS) - [CVE-2016-4062](https://cve.now/CVE-2016-4062.md): Foxit Reader and PhantomPDF before 7.3.4 on Windows improperly report format errors recursively, which allows remote attackers to cause a de (no CVSS) - [CVE-2016-4063](https://cve.now/CVE-2016-4063.md): Use-after-free vulnerability in Foxit Reader and PhantomPDF before 7.3.4 on Windows allows remote attackers to execute arbitrary code via an (no CVSS) - [CVE-2016-4064](https://cve.now/CVE-2016-4064.md): Use-after-free vulnerability in the XFA forms handling functionality in Foxit Reader and PhantomPDF before 7.3.4 on Windows allows remote at (no CVSS) - [CVE-2016-4065](https://cve.now/CVE-2016-4065.md): The ConvertToPDF plugin in Foxit Reader and PhantomPDF before 7.3.4 on Windows, when the gflags app is enabled, allows remote attackers to c (no CVSS) - [CVE-2016-1593](https://cve.now/CVE-2016-1593.md): Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated admi (no CVSS) - [CVE-2016-1594](https://cve.now/CVE-2016-1594.md): Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to read arbitrary attachments via a request to a LiveTime.woa U (no CVSS) - [CVE-2016-1595](https://cve.now/CVE-2016-1595.md): LiveTime/WebObjects/LiveTime.woa/wa/DownloadAction/downloadFile in Micro Focus Novell Service Desk before 7.2 allows remote authenticated us (no CVSS) - [CVE-2016-1596](https://cve.now/CVE-2016-1596.md): Multiple cross-site scripting (XSS) vulnerabilities in Micro Focus Novell Service Desk before 7.2 allow remote authenticated users to inject (no CVSS) - [CVE-2016-2299](https://cve.now/CVE-2016-2299.md): SQL injection vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to execute arbitrary SQL commands via unspecif (no CVSS) - [CVE-2016-2300](https://cve.now/CVE-2016-2300.md): Ecava IntegraXor before 5.0 build 4522 allows remote attackers to bypass authentication and access unspecified web pages via unknown vectors (no CVSS) - [CVE-2016-2301](https://cve.now/CVE-2016-2301.md): SQL injection vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote authenticated users to execute arbitrary SQL commands vi (no CVSS) - [CVE-2016-2302](https://cve.now/CVE-2016-2302.md): Ecava IntegraXor before 5.0 build 4522 allows remote attackers to obtain sensitive information by reading detailed error messages. (no CVSS) - [CVE-2016-2303](https://cve.now/CVE-2016-2303.md): CRLF injection vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to inject arbitrary HTTP headers and conduct (no CVSS) - [CVE-2016-2304](https://cve.now/CVE-2016-2304.md): Ecava IntegraXor before 5.0 build 4522 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easi (no CVSS) - [CVE-2016-2305](https://cve.now/CVE-2016-2305.md): Cross-site scripting (XSS) vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to inject arbitrary web script or (no CVSS) - [CVE-2016-2306](https://cve.now/CVE-2016-2306.md): The HMI web server in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to obtain sensitive cleartext information by sniffing t (no CVSS) - [CVE-2016-2354](https://cve.now/CVE-2016-2354.md): The Bluetooth functionality in Lemur Vehicle Monitors BlueDriver before 2016-04-07 supports unrestricted pairing without a PIN, which allows (no CVSS) - [CVE-2016-3145](https://cve.now/CVE-2016-3145.md): Lexmark printers with firmware ATL before ATL.021.063, CB before CB.021.063, PP before PP.021.063, and YK before YK.021.063 mishandle Erase (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-04-22 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.