CVE-2019-8237 | ByteOS Network

Vulnerability Details :

CVE-2019-8237

Assigner-adobe

Assigner Org ID-078d4453-3bcd-4900-85e6-15281da43538

Published At-23 Oct, 2019 | 20:46

Updated At-04 Aug, 2024 | 21:17

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an insufficiently robust encryption vulnerability. Successful exploitation could lead to security feature bypass.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:adobe

Assigner Org ID:078d4453-3bcd-4900-85e6-15281da43538

Published At:23 Oct, 2019 | 20:46

Updated At:04 Aug, 2024 | 21:17

▼CVE Numbering Authority (CNA)

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an insufficiently robust encryption vulnerability. Successful exploitation could lead to security feature bypass.

Affected Products

Vendor

Product

Adobe Acrobat and Reader

Versions

Affected

2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier versions

Problem Types

Type	CWE ID	Description
text	N/A	Insufficiently Robust Encryption

Type: text

CWE ID: N/A

Description: Insufficiently Robust Encryption

References

Hyperlink	Resource
https://helpx.adobe.com/security/products/acrobat/apsb19-41.html	x_refsource_CONFIRM

Hyperlink: https://helpx.adobe.com/security/products/acrobat/apsb19-41.html

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://helpx.adobe.com/security/products/acrobat/apsb19-41.html	x_refsource_CONFIRM x_transferred

Hyperlink: https://helpx.adobe.com/security/products/acrobat/apsb19-41.html

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

Source:psirt@adobe.com

Published At:23 Oct, 2019 | 21:15

Updated At:22 Nov, 2021 | 15:57

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an insufficiently robust encryption vulnerability. Successful exploitation could lead to security feature bypass.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C

Type: Primary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 10.0

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

>>acrobat_dc>>Versions from 15.006.30060(inclusive) to 15.006.30499(exclusive)

cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*

>>acrobat_dc>>Versions from 15.008.20082(inclusive) to 19.012.20036(exclusive)

cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*

>>acrobat_dc>>Versions from 17.011.30059(inclusive) to 17.011.30144(exclusive)

cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*

>>acrobat_reader_dc>>Versions from 15.006.30060(inclusive) to 15.006.30499(exclusive)

cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*

>>acrobat_reader_dc>>Versions from 15.008.20082(inclusive) to 19.012.20036(exclusive)

cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*

>>acrobat_reader_dc>>Versions from 17.011.30059(inclusive) to 17.011.30144(exclusive)

cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*

>>macos>>-

cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

Microsoft Corporation

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-327	Primary	nvd@nist.gov

CWE ID: CWE-327

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://helpx.adobe.com/security/products/acrobat/apsb19-41.html	psirt@adobe.com	Patch Vendor Advisory

Hyperlink: https://helpx.adobe.com/security/products/acrobat/apsb19-41.html

Source: psirt@adobe.com

Resource:

Patch

Vendor Advisory

Similar CVEs

2457Records found

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-15.29% / 94.36%

||

7 Day CHG~0.00%

Published-20 May, 2010 | 17:00

Updated-11 Apr, 2025 | 00:51

Mozilla Firefox 3.6.3 on Windows XP SP3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via JavaScript code that performs certain string concatenation and substring operations, a different vulnerability than CVE-2009-1571.

Vendor-n/a Mozilla Corporation Microsoft Corporation

Product-windows_xp firefox n/a

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-10.68% / 93.02%

||

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows iphone_os mac_os_x android n/a

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-10.68% / 93.02%

||

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows iphone_os mac_os_x android n/a

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-28.36% / 96.34%

||

7 Day CHG~0.00%

Published-14 Oct, 2022 | 19:42

Updated-23 Apr, 2025 | 16:49

Adobe ColdFusion ODBC Server Stack-based Buffer Overflow Remote Code Execution Vulnerability

Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent to the server.

Vendor-Adobe Inc.

Product-coldfusion ColdFusion

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-69.24% / 98.58%

||

7 Day CHG~0.00%

Published-11 Nov, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, and CVE-2015-8044.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows iphone_os mac_os_x android n/a

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-10||HIGH

EPSS-1.15% / 77.64%

||

7 Day CHG~0.00%

Published-18 Jun, 2010 | 16:00

Updated-11 Apr, 2025 | 00:51

Unspecified vulnerability in WebKit in Apple iTunes before 9.2 on Windows has unknown impact and attack vectors, a different vulnerability than CVE-2010-1387 and CVE-2010-1769.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 windows_xp itunes windows_vista n/a

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-10.68% / 93.02%

||

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows iphone_os mac_os_x android n/a

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-10||HIGH

EPSS-36.59% / 97.01%

||

7 Day CHG~0.00%

Published-25 Mar, 2010 | 20:31

Updated-11 Apr, 2025 | 00:51

Unspecified vulnerability in Internet Explorer 8 on Microsoft Windows 7 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to a use-after-free issue, as demonstrated by Peter Vreugdenhil during a Pwn2Own competition at CanSecWest 2010.

Vendor-n/a Microsoft Corporation

Product-windows_7 internet_explorer n/a

Matching Score-8

Assigner-PaperCut Software Pty Ltd

Matching Score-8

Assigner-PaperCut Software Pty Ltd

CVSS Score-8.6||HIGH

EPSS-15.80% / 94.47%

||

7 Day CHG~0.00%

Published-14 Mar, 2024 | 03:03

Updated-23 Jan, 2025 | 20:15

Incorrect authorization controls in PaperCut NG/MF APIs

This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls.

Vendor-Apple Inc.Microsoft Corporation PaperCut Software Pty Ltd Linux Kernel Organization, Inc

Product-papercut_mf macos windows linux_kernel papercut_ng PaperCut NG, PaperCut MF papercut_mf papercut_ng

CWE ID-CWE-250

Execution with Unnecessary Privileges

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-24.42% / 95.89%

||

7 Day CHG~0.00%

Published-25 Mar, 2010 | 20:31

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 10.4, and Safari on Apple iPhone OS allows remote attackers to execute arbitrary code or cause a denial of service (application crash), or read the SMS database or other data, via vectors related to "attribute manipulation," as demonstrated by Vincenzo Iozzo and Ralf Philipp Weinmann during a Pwn2Own competition at CanSecWest 2010.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows iphone_os safari mac_os_x mac_os_x_server n/a

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-10.68% / 93.02%

||

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows iphone_os mac_os_x android n/a

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-9.68% / 92.61%

||

7 Day CHG~0.00%

Published-18 Oct, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x android n/a

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-10||HIGH

EPSS-5.48% / 89.83%

||

7 Day CHG~0.00%

Published-18 Jun, 2010 | 16:00

Updated-11 Apr, 2025 | 00:51

WebKit in Apple iTunes before 9.2 on Windows, and Apple iOS before 4 on the iPhone and iPod touch, accesses out-of-bounds memory during the handling of tables, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document, a different vulnerability than CVE-2010-1387 and CVE-2010-1763.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 windows_xp itunes windows_vista n/a

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-11.15% / 93.21%

||

7 Day CHG~0.00%

Published-14 Oct, 2015 | 23:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7625, CVE-2015-7626, CVE-2015-7630, CVE-2015-7633, and CVE-2015-7634.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x android n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-10.68% / 93.02%

||

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows iphone_os mac_os_x android n/a

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-10.68% / 93.02%

||

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows iphone_os mac_os_x android n/a

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-4.58% / 88.81%

||

7 Day CHG~0.00%

Published-18 Nov, 2015 | 21:00

Updated-12 Apr, 2025 | 10:46

The Adobe Premiere Clip app before 1.2.1 for iOS mishandles unspecified input, which has unknown impact and attack vectors.

Vendor-n/a Adobe Inc.

Product-premiere_clip n/a

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-10.68% / 93.02%

||

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows iphone_os mac_os_x android n/a

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-1.97% / 82.79%

||

7 Day CHG~0.00%

Published-16 Sep, 2016 | 05:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-digital_editions n/a

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-10||HIGH

EPSS-0.86% / 74.08%

||

7 Day CHG~0.00%

Published-09 Sep, 2010 | 21:00

Updated-11 Apr, 2025 | 00:51

The Accessibility component in Apple iOS before 4.1 on the iPhone and iPod touch does not perform the expected VoiceOver announcement associated with the location services icon, which has unspecified impact and attack vectors.

Vendor-n/a Apple Inc.

Product-iphone_os ipod_touch n/a

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-10||HIGH

EPSS-1.63% / 81.16%

||

7 Day CHG~0.00%

Published-19 Aug, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

loader/DocumentThreadableLoader.cpp in the XMLHttpRequest implementation in WebCore in WebKit before r58409 does not properly handle credentials during a cross-origin synchronous request, which has unspecified impact and remote attack vectors, aka rdar problem 7905150.

Vendor-n/a Apple Inc.

Product-webkit n/a

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-10.68% / 93.02%

||

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows iphone_os mac_os_x android n/a

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-37.31% / 97.05%

||

7 Day CHG-0.44%

Published-07 May, 2001 | 04:00

Updated-03 Apr, 2025 | 01:03

When a Microsoft Office 2000 document is launched, the directory of that document is first used to locate DLL's such as riched20.dll and msi.dll, which could allow an attacker to execute arbitrary commands by inserting a Trojan Horse DLL into the same directory as the document.

Vendor-n/a Microsoft Corporation

Product-office n/a

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-80.97% / 99.11%

||

7 Day CHG~0.00%

Published-20 Apr, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Unspecified vulnerability in the Java Deployment Toolkit component in Oracle Java SE and Java for Business JDK and JRE 6 Update 10 through 19 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

Vendor-n/a Sun Microsystems (Oracle Corporation)Microsoft Corporation

Product-windows jdk jre n/a

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-9.68% / 92.61%

||

7 Day CHG~0.00%

Published-18 Oct, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x android n/a

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-10||HIGH

EPSS-1.85% / 82.28%

||

7 Day CHG~0.00%

Published-19 Aug, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

page/Geolocation.cpp in WebCore in WebKit before r56188 and before 1.2.5 does not properly restrict access to the lastPosition function, which has unspecified impact and remote attack vectors, aka rdar problem 7746357.

Vendor-n/a Apple Inc.

Product-webkit n/a

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-3.03% / 86.11%

||

7 Day CHG~0.00%

Published-25 Mar, 2010 | 20:31

Updated-11 Apr, 2025 | 00:51

Unspecified vulnerability in Safari 4 on Apple Mac OS X 10.6 allows remote attackers to execute arbitrary code via unknown vectors, as demonstrated by Charlie Miller during a Pwn2Own competition at CanSecWest 2010.

Vendor-n/a Apple Inc.

Product-safari mac_os_x n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-3.92% / 87.84%

||

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1097, CVE-2016-1106, CVE-2016-1107, CVE-2016-1108, CVE-2016-1109, CVE-2016-1110, CVE-2016-4108, and CVE-2016-4110.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-9.68% / 92.61%

||

7 Day CHG~0.00%

Published-18 Oct, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x android n/a

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-10||HIGH

EPSS-2.42% / 84.51%

||

7 Day CHG~0.00%

Published-30 Jan, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Buffer overflow in IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows attackers to execute arbitrary code in a privileged context via a crafted app.

Vendor-n/a Apple Inc.

Product-iphone_os mac_os_x tvos n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-17.03% / 94.73%

||

7 Day CHG~0.00%

Published-30 Jun, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG image that triggers an additional data row.

Vendor-libpng n/a Mozilla Corporation SUSE Canonical Ltd.Debian GNU/Linux Google LLC Fedora Project VMware (Broadcom Inc.)openSUSE Apple Inc.

Product-ubuntu_linux fedora firefox iphone_os thunderbird itunes safari seamonkey workstation chrome opensuse debian_linux mac_os_x_server linux_enterprise_server player libpng mac_os_x n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.23% / 45.58%

||

7 Day CHG~0.00%

Published-15 Nov, 2010 | 22:00

Updated-11 Apr, 2025 | 00:51

OpenSSL in Apple Mac OS X 10.6.x before 10.6.5 does not properly perform arithmetic, which allows remote attackers to bypass X.509 certificate authentication via an arbitrary certificate issued by a legitimate Certification Authority.

Vendor-n/a Apple Inc.

Product-mac_os_x mac_os_x_server n/a

CWE ID-CWE-295

Improper Certificate Validation

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-5.86% / 90.22%

||

7 Day CHG~0.00%

Published-16 Sep, 2016 | 05:00

Updated-12 Apr, 2025 | 10:46

Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4256, CVE-2016-4257, CVE-2016-4258, CVE-2016-4259, CVE-2016-4260, and CVE-2016-4262.

Vendor-n/a Adobe Inc.

Product-digital_editions n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-5.72% / 90.09%

||

7 Day CHG~0.00%

Published-26 Aug, 2016 | 19:00

Updated-12 Apr, 2025 | 10:46

Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4191, CVE-2016-4192, CVE-2016-4193, CVE-2016-4194, CVE-2016-4195, CVE-2016-4196, CVE-2016-4197, CVE-2016-4198, CVE-2016-4199, CVE-2016-4200, CVE-2016-4201, CVE-2016-4202, CVE-2016-4203, CVE-2016-4204, CVE-2016-4205, CVE-2016-4206, CVE-2016-4207, CVE-2016-4208, CVE-2016-4211, CVE-2016-4212, CVE-2016-4213, CVE-2016-4214, CVE-2016-4250, CVE-2016-4251, CVE-2016-4252, CVE-2016-4254, CVE-2016-4266, CVE-2016-4267, CVE-2016-4268, CVE-2016-4269, and CVE-2016-4270.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_dc reader windows acrobat mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-1.92% / 82.62%

||

7 Day CHG~0.00%

Published-16 Sep, 2016 | 05:00

Updated-12 Apr, 2025 | 10:46

Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4257, CVE-2016-4258, CVE-2016-4259, CVE-2016-4260, CVE-2016-4261, and CVE-2016-4262.

Vendor-n/a Adobe Inc.

Product-digital_editions n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-10||HIGH

EPSS-0.75% / 72.21%

||

7 Day CHG~0.00%

Published-09 Oct, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

The TLS Handshake Protocol implementation in Secure Transport in Apple OS X before 10.11 accepts a Certificate Request message within a session in which no Server Key Exchange message has been sent, which allows remote attackers to have an unspecified impact via crafted TLS data.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-10||HIGH

EPSS-0.39% / 59.31%

||

7 Day CHG~0.00%

Published-18 Sep, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Multiple unspecified vulnerabilities in Twisted in Wiki Server in Apple OS X Server before 5.0.3 allow attackers to have an unknown impact via an XML document.

Vendor-n/a Apple Inc.

Product-mac_os_x_server n/a

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-5.38% / 89.72%

||

7 Day CHG~0.00%

Published-14 Oct, 2015 | 23:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5586, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, CVE-2015-7617, and CVE-2015-7621.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_reader macos acrobat_dc windows acrobat n/a

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-5.05% / 89.35%

||

7 Day CHG~0.00%

Published-14 Oct, 2015 | 23:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, CVE-2015-7617, and CVE-2015-7621.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_reader macos acrobat_dc windows acrobat n/a

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-10||HIGH

EPSS-51.84% / 97.82%

||

7 Day CHG~0.00%

Published-10 Feb, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

The SMB implementation in the Server service in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not use a sufficient source of entropy, which allows remote attackers to obtain access to files and other SMB resources via a large number of authentication requests, related to server-generated challenges, certain "duplicate values," and spoofing of an authentication token, aka "SMB NTLM Authentication Lack of Entropy Vulnerability."

Vendor-n/a Microsoft Corporation

Product-windows_7 windows_xp windows_server_2008 windows_2000 windows_2003_server windows_vista n/a

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-10.81% / 93.08%

||

7 Day CHG~0.00%

Published-18 Jun, 2010 | 16:00

Updated-11 Apr, 2025 | 00:51

Directory traversal vulnerability in the getEntry method in the PortalModuleInstallManager component in a servlet in nps.jar in the Administration Console (aka Access Management Console) in Novell Access Manager 3.1 before 3.1.2-281 on Windows allows remote attackers to create arbitrary files with any contents, and consequently execute arbitrary code, via a .. (dot dot) in a parameter, aka ZDI-CAN-678.

Vendor-n/a Novell Microsoft Corporation

Product-windows access_manager n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Matching Score-8

Assigner-Flexera Software LLC

Matching Score-8

Assigner-Flexera Software LLC

CVSS Score-10||HIGH

EPSS-0.40% / 60.14%

||

7 Day CHG~0.00%

Published-14 Dec, 2010 | 15:00

Updated-11 Apr, 2025 | 00:51

The cook codec in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, Mac RealPlayer 11.0 through 12.0.0.1444, and Linux RealPlayer 11.0.2.1744 does not properly perform initialization, which has unspecified impact and attack vectors.

Vendor-n/a RealNetworks LLC Apple Inc.Linux Kernel Organization, Inc

Product-realplayer_sp realplayer linux_kernel mac_os_x n/a

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-10||HIGH

EPSS-49.07% / 97.69%

||

7 Day CHG~0.00%

Published-14 Apr, 2010 | 15:44

Updated-11 Apr, 2025 | 00:51

The SMB client in Microsoft Windows Server 2003 SP2, Vista Gold, SP1, and SP2, and Windows Server 2008 Gold and SP2 allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and reboot) via a crafted SMB transaction response that uses (1) SMBv1 or (2) SMBv2, aka "SMB Client Response Parsing Vulnerability."

Vendor-n/a Microsoft Corporation

Product-windows_7 windows_server_2008 windows_server_2003 windows_2003_server windows_vista n/a

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-10||HIGH

EPSS-55.48% / 97.98%

||

7 Day CHG~0.00%

Published-10 Feb, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2, when IPv6 is enabled, does not properly perform bounds checking on ICMPv6 Route Information packets, which allows remote attackers to execute arbitrary code via crafted packets, aka "ICMPv6 Route Information Vulnerability."

Vendor-n/a Microsoft Corporation

Product-windows_server_2008 windows_vista n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-10||HIGH

EPSS-0.83% / 73.67%

||

7 Day CHG~0.00%

Published-30 Jan, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

The kernel in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not enforce the read-only attribute of a shared memory segment during use of a custom cache mode, which allows attackers to bypass intended access restrictions via a crafted app.

Vendor-n/a Apple Inc.

Product-iphone_os mac_os_x tvos n/a

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-10||HIGH

EPSS-0.35% / 56.87%

||

7 Day CHG~0.00%

Published-30 Mar, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Mail in Apple Mac OS X before 10.6.3 does not disable the filter rules associated with a deleted mail account, which has unspecified impact and attack vectors.

Vendor-n/a Apple Inc.

Product-mac_os_x mac_os_x_server n/a

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-10||HIGH

EPSS-1.02% / 76.30%

||

7 Day CHG~0.00%

Published-30 Jan, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly initialize event queues, which allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.

Vendor-n/a Apple Inc.

Product-iphone_os mac_os_x tvos n/a

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-10||HIGH

EPSS-1.02% / 76.30%

||

7 Day CHG~0.00%

Published-30 Jan, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

IOAcceleratorFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly handle resource lists and IOService userclient types, which allows attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via a crafted app.

Vendor-n/a Apple Inc.

Product-iphone_os mac_os_x tvos n/a

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-10||HIGH

EPSS-0.63% / 69.32%

||

7 Day CHG~0.00%

Published-09 Oct, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors.

Vendor-n/a Apple Inc.

Product-safari n/a

CWE ID-CWE-20

Improper Input Validation

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-10||HIGH

EPSS-2.02% / 83.03%

||

7 Day CHG~0.00%

Published-18 Sep, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

The kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5868 and CVE-2015-5896.

Vendor-n/a Apple Inc.

Product-mac_os_x iphone_os watchos n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer