CVE-2020-3762 | ByteOS Network

Vulnerability Details :

CVE-2020-3762

Assigner-adobe

Assigner Org ID-078d4453-3bcd-4900-85e6-15281da43538

Published At-13 Feb, 2020 | 15:44

Updated At-04 Aug, 2024 | 07:44

Adobe Acrobat and Reader versions 2019.021.20061 and earlier, 2017.011.30156 and earlier, 2017.011.30156 and earlier, and 2015.006.30508 and earlier have a privilege escalation vulnerability. Successful exploitation could lead to arbitrary file system write.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:adobe

Assigner Org ID:078d4453-3bcd-4900-85e6-15281da43538

Published At:13 Feb, 2020 | 15:44

Updated At:04 Aug, 2024 | 07:44

▼CVE Numbering Authority (CNA)

Adobe Acrobat and Reader versions 2019.021.20061 and earlier, 2017.011.30156 and earlier, 2017.011.30156 and earlier, and 2015.006.30508 and earlier have a privilege escalation vulnerability. Successful exploitation could lead to arbitrary file system write.

Affected Products

Vendor

Product

Adobe Acrobat and Reader

Versions

Affected

, 2019.021.20061 and earlier, 2017.011.30156 and earlier, 2017.011.30156 and earlier, and 2015.006.30508 and earlier versions

Problem Types

Type	CWE ID	Description
text	N/A	Privilege Escalation

Type: text

CWE ID: N/A

Description: Privilege Escalation

References

Hyperlink	Resource
https://helpx.adobe.com/security/products/acrobat/apsb20-05.html	x_refsource_CONFIRM

Hyperlink: https://helpx.adobe.com/security/products/acrobat/apsb20-05.html

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://helpx.adobe.com/security/products/acrobat/apsb20-05.html	x_refsource_CONFIRM x_transferred

Hyperlink: https://helpx.adobe.com/security/products/acrobat/apsb20-05.html

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

Source:psirt@adobe.com

Published At:13 Feb, 2020 | 16:15

Updated At:08 Sep, 2021 | 17:22

Adobe Acrobat and Reader versions 2019.021.20061 and earlier, 2017.011.30156 and earlier, 2017.011.30156 and earlier, and 2015.006.30508 and earlier have a privilege escalation vulnerability. Successful exploitation could lead to arbitrary file system write.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C

Type: Primary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 10.0

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

>>acrobat_dc>>Versions from 15.006.30060(inclusive) to 15.006.30508(inclusive)

cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*

>>acrobat_dc>>Versions from 15.008.20082(inclusive) to 19.021.20061(inclusive)

cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*

>>acrobat_reader_dc>>Versions from 15.006.30060(inclusive) to 15.006.30508(inclusive)

cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*

>>acrobat_reader_dc>>Versions from 15.008.20082(inclusive) to 19.021.20061(inclusive)

cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*

>>macos>>-

cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

Microsoft Corporation

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

>>acrobat_reader_dc>>Versions from 17.011.30059(inclusive) to 17.011.30156(inclusive)

cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*

>>macos>>-

cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

>>acrobat_dc>>Versions from 17.011.30059(inclusive) to 17.011.30156(inclusive)

cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*

Microsoft Corporation

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://helpx.adobe.com/security/products/acrobat/apsb20-05.html	psirt@adobe.com	Patch Vendor Advisory

Hyperlink: https://helpx.adobe.com/security/products/acrobat/apsb20-05.html

Source: psirt@adobe.com

Resource:

Patch

Vendor Advisory

Similar CVEs

2392Records found

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-51.16% / 97.79%

||

7 Day CHG~0.00%

Published-14 Aug, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-8.05% / 91.76%

||

7 Day CHG~0.00%

Published-11 Nov, 2014 | 23:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0577, CVE-2014-0584, CVE-2014-0586, and CVE-2014-0590.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-3.22% / 86.54%

||

7 Day CHG~0.00%

Published-15 Jul, 2015 | 14:00

Updated-12 Apr, 2025 | 10:46

Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3095, CVE-2015-5087, CVE-2015-5094, CVE-2015-5100, CVE-2015-5102, CVE-2015-5104, and CVE-2015-5115.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_reader macos acrobat_dc windows acrobat n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-4.27% / 88.37%

||

7 Day CHG~0.00%

Published-14 Aug, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Heap-based buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5541.

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel evergreen air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-17.08% / 94.73%

||

7 Day CHG~0.00%

Published-14 May, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Stack-based buffer overflow in Adobe Illustrator CS6 before 16.0.5 and 16.2.x before 16.2.2 allows remote attackers to execute arbitrary code via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-illustrator n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-5.69% / 90.05%

||

7 Day CHG~0.00%

Published-15 Jul, 2015 | 14:00

Updated-12 Apr, 2025 | 10:46

Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-4435, CVE-2015-4441, CVE-2015-4445, CVE-2015-4447, CVE-2015-4451, CVE-2015-4452, CVE-2015-5085, and CVE-2015-5086.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_reader macos acrobat_dc windows acrobat n/a

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-0.46% / 63.04%

||

7 Day CHG~0.00%

Published-26 Sep, 2005 | 04:00

Updated-03 Apr, 2025 | 01:03

Multiple unspecified vulnerabilities in Opera 8.50 on Linux and Windows have unknown impact and attack vectors, related to (1) " handling of must-revalidate cache directive for HTTPS pages" or (2) a "display issue with cookie comment encoding."

Vendor-n/a Linux Kernel Organization, Inc Opera Microsoft Corporation

Product-opera_browser linux_kernel windows n/a

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-4.40% / 88.56%

||

7 Day CHG~0.00%

Published-15 Jul, 2015 | 14:00

Updated-12 Apr, 2025 | 10:46

Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5098 and CVE-2015-5105.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_reader macos acrobat_dc windows acrobat n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-14.84% / 94.26%

||

7 Day CHG~0.00%

Published-14 May, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Double free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-windows acrobat mac_os_x acrobat_reader n/a

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-9.01% / 92.28%

||

7 Day CHG~0.00%

Published-16 Jan, 2008 | 21:00

Updated-07 Aug, 2024 | 07:39

Heap-based buffer overflow in the libaccess_realrtsp plugin in VideoLAN VLC Media Player 0.8.6d and earlier on Windows might allow remote RTSP servers to cause a denial of service (application crash) or execute arbitrary code via a long string.

Vendor-n/a VideoLAN Microsoft Corporation

Product-windows vlc_media_player n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.10% / 28.97%

||

7 Day CHG~0.00%

Published-17 Jan, 2024 | 00:00

Updated-17 Jun, 2025 | 15:15

Studio Network Solutions ShareBrowser before 7.0 on macOS mishandles signature verification, aka PMP-2636.

Vendor-studionetworksolutions n/a Apple Inc.

Product-macos sharebrowser n/a

CWE ID-CWE-347

Improper Verification of Cryptographic Signature

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-24.48% / 95.90%

||

7 Day CHG~0.00%

Published-12 Feb, 2014 | 02:00

Updated-11 Apr, 2025 | 00:51

Adobe Shockwave Player before 12.0.9.149 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0500.

Vendor-n/a Adobe Inc.

Product-shockwave_player n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-68.03% / 98.53%

||

7 Day CHG~0.00%

Published-09 Jul, 2015 | 16:00

Updated-12 Apr, 2025 | 10:46

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3135 and CVE-2015-5118.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-2.81% / 85.57%

||

7 Day CHG~0.00%

Published-14 Jul, 2015 | 23:00

Updated-12 Apr, 2025 | 10:46

Adobe Shockwave Player before 12.1.9.159 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5120.

Vendor-n/a Adobe Inc.

Product-shockwave_player n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-6.51% / 90.72%

||

7 Day CHG~0.00%

Published-13 Feb, 2008 | 20:00

Updated-07 Aug, 2024 | 16:02

Unspecified vulnerability in Adobe Flash Media Server 2 before 2.0.5, and Connect Enterprise Server 6 before SP3, allows remote attackers to "take control of the affected system" via unspecified vectors, a different issue than CVE-2007-6148 and CVE-2007-6149.

Vendor-n/a Adobe Inc.

Product-connect_enterprise_server flash_media_server_2 n/a

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-9.8||CRITICAL

EPSS-6.54% / 90.75%

||

7 Day CHG~0.00%

Published-16 May, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

The escapeshellarg function in ext/standard/exec.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 on Windows allows remote attackers to execute arbitrary OS commands via a crafted string to an application that accepts command-line arguments for a call to the PHP system function.

Vendor-n/a The PHP Group Microsoft Corporation

Product-windows php n/a

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.50% / 65.10%

||

7 Day CHG~0.00%

Published-01 Apr, 2020 | 17:54

Updated-04 Aug, 2024 | 10:43

Multiple issues were addressed by updating to version 8.1.1850. This issue is fixed in macOS Catalina 10.15.4. Multiple issues in Vim.

Vendor-Apple Inc.

Product-mac_os_x macOS

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-10||HIGH

EPSS-37.66% / 97.08%

||

7 Day CHG-5.54%

Published-12 Feb, 2008 | 22:00

Updated-07 Aug, 2024 | 07:32

Heap-based buffer overflow in the WebDAV Mini-Redirector in Microsoft Windows XP SP2, Server 2003 SP1 and SP2, and Vista allows remote attackers to execute arbitrary code via a crafted WebDAV response.

Vendor-n/a Microsoft Corporation

Product-windows_vista windows_2003_server windows_xp windows_server_2003 webdav_mini-redirector n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-3.22% / 86.54%

||

7 Day CHG~0.00%

Published-15 Jul, 2015 | 14:00

Updated-12 Apr, 2025 | 10:46

Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3095, CVE-2015-5087, CVE-2015-5094, CVE-2015-5100, CVE-2015-5102, CVE-2015-5103, and CVE-2015-5104.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_reader macos acrobat_dc windows acrobat n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-32.01% / 96.66%

||

7 Day CHG~0.00%

Published-17 Nov, 2023 | 13:31

Updated-04 Sep, 2024 | 19:10

Adobe ColdFusion RCE Security Vulnerability

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

Vendor-Adobe Inc.

Product-coldfusion ColdFusion coldfusion

CWE ID-CWE-502

Deserialization of Untrusted Data

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-2.13% / 83.45%

||

7 Day CHG~0.00%

Published-09 Jun, 2020 | 16:16

Updated-04 Aug, 2024 | 10:43

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5. A remote attacker may be able to cause arbitrary code execution.

Vendor-Apple Inc.

Product-iphone_os ipados iOS

CWE ID-CWE-125

Out-of-bounds Read

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-0.40% / 59.76%

||

7 Day CHG~0.00%

Published-19 Aug, 2005 | 04:00

Updated-03 Apr, 2025 | 01:03

Unknown vulnerability in Mac OS X 10.4.2 and earlier, when using Kerberos authentication with LDAP, allows attackers to gain access to a root Terminal window.

Vendor-n/a Apple Inc.

Product-mac_os_x_server mac_os_x n/a

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-1.21% / 78.17%

||

7 Day CHG~0.00%

Published-27 Oct, 2020 | 20:42

Updated-04 Aug, 2024 | 10:43

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra. A buffer overflow may result in arbitrary code execution.

Vendor-Apple Inc.

Product-mac_os_x macOS

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-17.19% / 94.76%

||

7 Day CHG~0.00%

Published-18 Mar, 2008 | 23:00

Updated-07 Aug, 2024 | 07:32

Multiple buffer overflows in the HP-GL/2-to-PostScript filter in CUPS before 1.3.6 might allow remote attackers to execute arbitrary code via a crafted HP-GL/2 file.

Vendor-n/a Apple Inc.

Product-cups n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.45% / 62.75%

||

7 Day CHG~0.00%

Published-22 Oct, 2020 | 18:00

Updated-04 Aug, 2024 | 10:43

This issue was addressed with improved entitlements. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A sandboxed process may be able to circumvent sandbox restrictions.

Vendor-Apple Inc.

Product-iphone_os mac_os_x ipados macOS iOS

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-91.62% / 99.66%

||

7 Day CHG~0.00%

Published-17 Nov, 2023 | 13:31

Updated-04 Sep, 2024 | 19:36

ColdFusion WDDX Deserialization Gadgets

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

Vendor-Adobe Inc.

Product-coldfusion ColdFusion coldfusion

CWE ID-CWE-502

Deserialization of Untrusted Data

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-55.20% / 97.97%

||

7 Day CHG~0.00%

Published-17 Jul, 2005 | 04:00

Updated-03 Apr, 2025 | 01:03

Double free vulnerability in the krb5_recvauth function in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to execute arbitrary code via certain error conditions.

Vendor-n/a Debian GNU/Linux MIT (Massachusetts Institute of Technology)Apple Inc.

Product-mac_os_x_server mac_os_x debian_linux kerberos_5 n/a

CWE ID-CWE-415

Double Free

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-0.47% / 63.64%

||

7 Day CHG~0.00%

Published-17 Jul, 2020 | 00:00

Updated-04 Aug, 2024 | 10:34

Adobe Creative Cloud Desktop Application versions 5.1 and earlier have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation.

Vendor-Microsoft Corporation Adobe Inc.

Product-creative_cloud_desktop_application windows Adobe Creative Cloud Desktop Application

CWE ID-CWE-732

Incorrect Permission Assignment for Critical Resource

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-68.03% / 98.53%

||

7 Day CHG~0.00%

Published-09 Jul, 2015 | 16:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, and CVE-2015-5117.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-3.60% / 87.30%

||

7 Day CHG~0.00%

Published-15 Jul, 2015 | 14:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4448, CVE-2015-5095, CVE-2015-5099, CVE-2015-5101, CVE-2015-5111, and CVE-2015-5113.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_reader macos acrobat_dc windows acrobat n/a

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-45.50% / 97.52%

||

7 Day CHG~0.00%

Published-13 Feb, 2008 | 20:00

Updated-07 Aug, 2024 | 16:18

Multiple stack-based buffer overflows in the Spooler service (nwspool.dll) in Novell Client 4.91 SP4 for Windows allow remote attackers to execute arbitrary code via long arguments to multiple unspecified RPC functions, aka Novell bug 287919, a different vulnerability than CVE-2007-2954.

Vendor-n/a Novell Microsoft Corporation

Product-windows client n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-61.89% / 98.28%

||

7 Day CHG~0.00%

Published-17 Nov, 2023 | 13:31

Updated-16 Sep, 2024 | 12:57

ColdFusion | Deserialization of Untrusted Data (CWE-502)

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

Vendor-Adobe Inc.

Product-coldfusion ColdFusion coldfusion

CWE ID-CWE-502

Deserialization of Untrusted Data

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-1.24% / 78.45%

||

7 Day CHG~0.00%

Published-16 Jul, 2020 | 23:59

Updated-04 Aug, 2024 | 10:34

Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a lack of exploit mitigations vulnerability. Successful exploitation could lead to privilege escalation.

Vendor-Microsoft Corporation Adobe Inc.

Product-windows creative_cloud Adobe Creative Cloud Desktop Application

CWE ID-CWE-269

Improper Privilege Management

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-10||HIGH

EPSS-87.81% / 99.44%

||

7 Day CHG~0.00%

Published-10 Aug, 2005 | 04:00

Updated-03 Apr, 2025 | 01:03

Stack-based buffer overflow in the Plug and Play (PnP) service for Microsoft Windows 2000 and Windows XP Service Pack 1 allows remote attackers to execute arbitrary code via a crafted packet, and local users to gain privileges via a malicious application, as exploited by the Zotob (aka Mytob) worm.

Vendor-n/a Microsoft Corporation

Product-windows_xp windows_2000 n/a

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-1.62% / 81.09%

||

7 Day CHG~0.00%

Published-17 Jul, 2020 | 00:01

Updated-04 Aug, 2024 | 10:34

Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a symlink vulnerability vulnerability. Successful exploitation could lead to arbitrary file system write.

Vendor-Microsoft Corporation Adobe Inc.

Product-creative_cloud_desktop_application windows Adobe Creative Cloud Desktop Application

CWE ID-CWE-59

Improper Link Resolution Before File Access ('Link Following')

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-12.56% / 93.69%

||

7 Day CHG~0.00%

Published-22 Jul, 2020 | 19:23

Updated-04 Aug, 2024 | 10:34

Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-magento Adobe Inc.

Product-magento Magento

CWE ID-CWE-502

Deserialization of Untrusted Data

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-6.22% / 90.50%

||

7 Day CHG+0.64%

Published-26 Jun, 2020 | 20:19

Updated-04 Aug, 2024 | 10:34

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-magento Adobe Inc.

Product-magento Magento

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-84.34% / 99.27%

||

7 Day CHG~0.00%

Published-09 Jun, 2020 | 16:18

Updated-04 Aug, 2024 | 10:43

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. A remote attacker may be able to cause arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os watchos ipados tvos safari icloud iTunes for Windows watchOS iCloud for Windows Safari iOS iCloud for Windows (Legacy)tvOS

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-10||HIGH

EPSS-65.56% / 98.43%

||

7 Day CHG~0.00%

Published-21 Oct, 2005 | 04:00

Updated-03 Apr, 2025 | 01:03

Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to execute arbitrary commands via a shortcut (.lnk) file with long font properties that lead to a buffer overflow in the Client/Server Runtime Server Subsystem (CSRSS), a different vulnerability than CVE-2005-2118.

Vendor-n/a Microsoft Corporation

Product-windows_xp windows_2000 windows_2003_server n/a

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-71.45% / 98.66%

||

7 Day CHG~0.00%

Published-14 Aug, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5131 and CVE-2015-5132.

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel evergreen air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-8.34% / 91.92%

||

7 Day CHG~0.00%

Published-12 Jun, 2020 | 13:17

Updated-04 Aug, 2024 | 10:34

Adobe Flash Player Desktop Runtime 32.0.0.371 and earlier, Adobe Flash Player for Google Chrome 32.0.0.371 and earlier, and Adobe Flash Player for Microsoft Edge and Internet Explorer 32.0.0.330 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-Google LLC Adobe Inc.Apple Inc.Microsoft Corporation Linux Kernel Organization, Inc

Product-linux_kernel windows_8.1 chrome_os windows flash_player_desktop_runtime macos windows_10 flash_player Adobe Flash Player

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-3.60% / 87.30%

||

7 Day CHG~0.00%

Published-15 Jul, 2015 | 14:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4448, CVE-2015-5095, CVE-2015-5099, CVE-2015-5111, CVE-2015-5113, and CVE-2015-5114.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_reader macos acrobat_dc windows acrobat n/a

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-2.17% / 83.63%

||

7 Day CHG~0.00%

Published-16 Oct, 2020 | 16:40

Updated-04 Aug, 2024 | 10:43

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os watchos ipados tvos safari icloud iTunes for Windows watchOS iCloud for Windows Safari iOS iCloud for Windows (Legacy)tvOS

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-71.45% / 98.66%

||

7 Day CHG~0.00%

Published-14 Aug, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5132 and CVE-2015-5133.

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel evergreen air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-10||HIGH

EPSS-72.50% / 98.71%

||

7 Day CHG~0.00%

Published-12 Feb, 2008 | 20:00

Updated-07 Aug, 2024 | 07:32

Unspecified vulnerability in Microsoft Internet Information Services (IIS) 5.1 through 6.0 allows remote attackers to execute arbitrary code via crafted inputs to ASP pages.

Vendor-n/a Microsoft Corporation

Product-internet_information_server n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-31.10% / 96.59%

||

7 Day CHG~0.00%

Published-13 Feb, 2008 | 20:00

Updated-07 Aug, 2024 | 15:54

Multiple integer overflows in the Edge server in Adobe Flash Media Server 2 before 2.0.5, and Connect Enterprise Server 6 before SP3, allow remote attackers to execute arbitrary code via a Real Time Message Protocol (RTMP) message with a crafted integer field that is used for allocation.

Vendor-n/a Adobe Inc.

Product-connect_enterprise_server flash_media_server_2 n/a

CWE ID-CWE-189

Not Available

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-6.94% / 91.03%

||

7 Day CHG~0.00%

Published-12 Feb, 2008 | 19:00

Updated-07 Aug, 2024 | 07:32

Unspecified vulnerability in NFS in Apple Mac OS X 10.5 through 10.5.1 allows remote attackers to cause a denial of service (system shutdown) or execute arbitrary code via unknown vectors related to mbuf chains that trigger memory corruption.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-399

Not Available

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.42% / 60.94%

||

7 Day CHG+0.06%

Published-11 Dec, 2024 | 22:57

Updated-18 Dec, 2024 | 18:32

The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1. An attacker may be able to cause unexpected system termination or arbitrary code execution in DCP firmware.

Vendor-Apple Inc.

Product-iphone_os ipados iOS and iPadOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-2.33% / 84.21%

||

7 Day CHG~0.00%

Published-16 Jul, 2020 | 23:59

Updated-04 Aug, 2024 | 10:34

Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a symlink vulnerability vulnerability. Successful exploitation could lead to privilege escalation.

Vendor-Microsoft Corporation Adobe Inc.

Product-creative_cloud_desktop_application windows Adobe Creative Cloud Desktop Application

CWE ID-CWE-59

Improper Link Resolution Before File Access ('Link Following')

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-8.29% / 91.90%

||

7 Day CHG~0.00%

Published-11 Dec, 2013 | 15:00

Updated-11 Apr, 2025 | 00:51

Adobe Shockwave Player before 12.0.7.148 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-5334.

Vendor-n/a Adobe Inc.

Product-shockwave_player n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer