# CVEs published 2016-04-30 19 CVEs were published on April 30, 2016: 0 critical, 0 high. Days are UTC. - [CVE-2016-2804](https://cve.now/CVE-2016-2804.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0 allow remote attackers to cause a denial of servic (no CVSS) - [CVE-2016-2805](https://cve.now/CVE-2016-2805.md): Unspecified vulnerability in the browser engine in Mozilla Firefox ESR 38.x before 38.8 allows remote attackers to cause a denial of service (no CVSS) - [CVE-2016-2806](https://cve.now/CVE-2016-2806.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0 and Firefox ESR 45.x before 45.1 allow remote atta (no CVSS) - [CVE-2016-2807](https://cve.now/CVE-2016-2807.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45. (no CVSS) - [CVE-2016-2808](https://cve.now/CVE-2016-2808.md): The watch implementation in the JavaScript engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before (no CVSS) - [CVE-2016-2809](https://cve.now/CVE-2016-2809.md): The Mozilla Maintenance Service updater in Mozilla Firefox before 46.0 on Windows allows user-assisted remote attackers to delete arbitrary (no CVSS) - [CVE-2016-2810](https://cve.now/CVE-2016-2810.md): Mozilla Firefox before 46.0 on Android before 5.0 allows attackers to bypass intended Signature access requirements via a crafted applicatio (no CVSS) - [CVE-2016-2811](https://cve.now/CVE-2016-2811.md): Use-after-free vulnerability in the ServiceWorkerInfo class in the Service Worker subsystem in Mozilla Firefox before 46.0 allows remote att (no CVSS) - [CVE-2016-2812](https://cve.now/CVE-2016-2812.md): Race condition in the get implementation in the ServiceWorkerManager class in the Service Worker subsystem in Mozilla Firefox before 46.0 al (no CVSS) - [CVE-2016-2813](https://cve.now/CVE-2016-2813.md): Mozilla Firefox before 46.0 on Android does not properly restrict JavaScript access to orientation and motion data, which allows remote atta (no CVSS) - [CVE-2016-2814](https://cve.now/CVE-2016-2814.md): Heap-based buffer overflow in the stagefright::SampleTable::parseSampleCencInfo function in libstagefright in Mozilla Firefox before 46.0, F (no CVSS) - [CVE-2016-2816](https://cve.now/CVE-2016-2816.md): Mozilla Firefox before 46.0 allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via the multipart/x-mix (no CVSS) - [CVE-2016-2817](https://cve.now/CVE-2016-2817.md): The WebExtension sandbox feature in browser/components/extensions/ext-tabs.js in Mozilla Firefox before 46.0 does not properly restrict prin (no CVSS) - [CVE-2016-2820](https://cve.now/CVE-2016-2820.md): The Firefox Health Reports (aka FHR or about:healthreport) feature in Mozilla Firefox before 46.0 does not properly restrict the origin of e (no CVSS) - [CVE-2016-1111](https://cve.now/CVE-2016-1111.md): Double free vulnerability in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat (no CVSS) - [CVE-2016-1199](https://cve.now/CVE-2016-1199.md): The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrict (no CVSS) - [CVE-2016-1200](https://cve.now/CVE-2016-1200.md): The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via uns (no CVSS) - [CVE-2016-1201](https://cve.now/CVE-2016-1201.md): Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to hijack the authentication o (no CVSS) - [CVE-2016-1343](https://cve.now/CVE-2016-1343.md): The XML parser in Cisco Information Server (CIS) 6.2 allows remote attackers to read arbitrary files or cause a denial of service (CPU and m (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-04-30 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.