ByteOS

Product:Commerce and Magento Open Source

Added At:15 Feb, 2022

Due At:01 Mar, 2022

Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.

Used in Ransomware

Unknown

CWE

CWE-20

Required Action:

Apply updates per vendor instructions.

Additional Notes:

https://nvd.nist.gov/vuln/detail/CVE-2022-24086

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:adobe

Assigner Org ID:078d4453-3bcd-4900-85e6-15281da43538

Published At:16 Feb, 2022 | 16:38

Updated At:30 Jul, 2025 | 01:37

▼CVE Numbering Authority (CNA)

Adobe Commerce checkout improper input validation leads to remote code execution

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

Affected Products

Vendor

Product

Magento Commerce

Versions

Affected

From unspecified through 2.4.3-p1 (custom)
From unspecified through 2.3.7-p2 (custom)
From unspecified through None (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-20	Improper Input Validation (CWE-20)

Type: CWE

CWE ID: CWE-20

Description: Improper Input Validation (CWE-20)

Metrics

Version	Base score	Base severity	Vector
3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Hyperlink	Resource
https://helpx.adobe.com/security/products/magento/apsb22-12.html	x_refsource_MISC

Hyperlink: https://helpx.adobe.com/security/products/magento/apsb22-12.html

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://helpx.adobe.com/security/products/magento/apsb22-12.html	x_refsource_MISC x_transferred

Hyperlink: https://helpx.adobe.com/security/products/magento/apsb22-12.html

Resource:

x_refsource_MISC

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

kev

dateAdded:

2022-02-15

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24086

Timeline

Event	Date
CVE-2022-24086 added to CISA KEV	2022-02-15 00:00:00

Event: CVE-2022-24086 added to CISA KEV

Date: 2022-02-15 00:00:00

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:psirt@adobe.com

Published At:16 Feb, 2022 | 17:15

Updated At:13 Feb, 2025 | 17:30

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2022-02-15	2022-03-01	Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability	Apply updates per vendor instructions.

Date Added: 2022-02-15

Due Date: 2022-03-01

Vulnerability Name: Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

Required Action: Apply updates per vendor instructions.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C

Type: Secondary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 10.0

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*

>>commerce>>Versions before 2.3.0(exclusive)

cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*

>>commerce>>Versions between 2.3.3(exclusive) and 2.3.6(inclusive)

cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*

>>commerce>>Versions from 2.4.0(inclusive) to 2.4.2(inclusive)

cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*

>>commerce>>2.3.7

cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*

>>commerce>>2.3.7

cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*

>>commerce>>2.4.3

cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:*

>>commerce>>2.4.3

magento>>magento>>Versions before 2.3.0(exclusive)

cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*

magento>>magento>>Versions between 2.3.3(exclusive) and 2.3.6(inclusive)

cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*

magento>>magento>>Versions from 2.4.0(inclusive) to 2.4.2(inclusive)

cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*

magento>>magento>>2.3.7

cpe:2.3:a:magento:magento:2.3.7:p1:*:*:commerce:*:*:*

magento>>magento>>2.3.7

cpe:2.3:a:magento:magento:2.3.7:p2:*:*:commerce:*:*:*

magento>>magento>>2.4.3

cpe:2.3:a:magento:magento:2.4.3:-:*:*:commerce:*:*:*

magento>>magento>>2.4.3

cpe:2.3:a:magento:magento:2.4.3:p1:*:*:commerce:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-20	Primary	psirt@adobe.com

CWE ID: CWE-20

Type: Primary

Source: psirt@adobe.com

References

Hyperlink	Source	Resource
https://helpx.adobe.com/security/products/magento/apsb22-12.html	psirt@adobe.com	Patch Release Notes Vendor Advisory
https://helpx.adobe.com/security/products/magento/apsb22-12.html	af854a3a-2127-422b-91ae-364da2661108	Patch Release Notes Vendor Advisory

Hyperlink: https://helpx.adobe.com/security/products/magento/apsb22-12.html

Source: psirt@adobe.com

Resource:

Patch

Release Notes

Vendor Advisory

Hyperlink: https://helpx.adobe.com/security/products/magento/apsb22-12.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Patch

Release Notes

Vendor Advisory

Similar CVEs

2243Records found

CVE-2012-4176

Matching Score-10

Matching Score-10

CVSS Score-10||HIGH

EPSS-5.08% / 89.39%

7 Day CHG~0.00%

Published-23 Oct, 2012 | 23:00

Updated-11 Apr, 2025 | 00:51

Array index error in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-shockwave_player n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2016-4165

Matching Score-10

Matching Score-10

CVSS Score-9.8||CRITICAL

EPSS-6.15% / 90.44%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

The extension manager in Adobe Brackets before 1.7 allows attackers to have an unspecified impact via invalid input.

Vendor-n/a Adobe Inc.

Product-brackets n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2019-7959

Matching Score-10

Matching Score-10

CVSS Score-9.8||CRITICAL

EPSS-17.72% / 94.85%

7 Day CHG~0.00%

Published-16 Aug, 2019 | 16:40

Updated-04 Aug, 2024 | 21:02

Creative Cloud Desktop Application versions 4.6.1 and earlier have a using components with known vulnerabilities vulnerability. Successful exploitation could lead to arbitrary code execution.

Product-windows creative_cloud mac_os_x Creative Cloud Desktop Application

CWE ID-CWE-20

Improper Input Validation

CVE-2015-5568

Matching Score-10

Matching Score-10

CVSS Score-10||HIGH

EPSS-31.84% / 96.66%

7 Day CHG~0.00%

Published-22 Sep, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to cause a denial of service (vector-length corruption) or possibly have unspecified other impact via unknown vectors.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x android n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2017-3098

Matching Score-10

Matching Score-10

CVSS Score-9.8||CRITICAL

EPSS-15.17% / 94.33%

7 Day CHG~0.00%

Published-20 Jun, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Adobe Captivate versions 9 and earlier have a remote code execution vulnerability in the quiz reporting feature that could be abused to read and write arbitrary files to the server.

Vendor-n/a Adobe Inc.

Product-captivate Adobe Captivate 9 and earlier.

CWE ID-CWE-20

Improper Input Validation

CVE-2015-0301

Matching Score-10

Matching Score-10

CVSS Score-10||HIGH

EPSS-7.40% / 91.35%

7 Day CHG~0.00%

Published-13 Jan, 2015 | 23:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 do not properly validate files, which has unspecified impact and attack vectors.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-flash_player adobe_air linux_kernel adobe_air_sdk_and_compiler adobe_air_sdk windows mac_os_x n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2011-2092

Matching Score-10

Matching Score-10

CVSS Score-10||HIGH

EPSS-2.27% / 83.97%

7 Day CHG~0.00%

Published-16 Jun, 2011 | 23:00

Updated-11 Apr, 2025 | 00:51

Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creation of classes during deserialization of (1) AMF and (2) AMFX data, which allows attackers to have an unspecified impact via unknown vectors, related to a "deserialization vulnerability."

Vendor-n/a Adobe Inc.

Product-blazeds livecycle livecycle_data_services n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2013-3342

Matching Score-10

Matching Score-10

CVSS Score-10||HIGH

EPSS-2.69% / 85.28%

7 Day CHG~0.00%

Published-16 May, 2013 | 10:00

Updated-11 Apr, 2025 | 00:51

Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 do not properly handle operating-system domain blacklists, which has unspecified impact and attack vectors.

Vendor-n/a Adobe Inc.

CWE ID-CWE-20

Improper Input Validation

CVE-2010-2861

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-94.29% / 99.93%

7 Day CHG~0.00%

Published-11 Aug, 2010 | 18:00

Updated-30 Jul, 2025 | 01:47

Known KEV||Action Due Date - 2022-04-15||Apply updates per vendor instructions.

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.

Vendor-n/a Adobe Inc.

Product-coldfusion n/a ColdFusion

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2010-2863

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-9.54% / 92.53%

7 Day CHG~0.00%

Published-26 Aug, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Adobe Shockwave Player before 11.5.8.612 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-shockwave_player n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2011-4369

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-13.04% / 93.82%

7 Day CHG~0.00%

Published-16 Dec, 2011 | 19:00

Updated-11 Apr, 2025 | 00:51

Unspecified vulnerability in the PRC component in Adobe Reader and Acrobat 9.x before 9.4.7 on Windows, Adobe Reader and Acrobat 9.x through 9.4.6 on Mac OS X, Adobe Reader and Acrobat 10.x through 10.1.1 on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011.

Vendor-unix n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows acrobat_reader acrobat unix mac_os_x n/a

CVE-2015-5101

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-3.60% / 87.30%

7 Day CHG~0.00%

Published-15 Jul, 2015 | 14:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4448, CVE-2015-5095, CVE-2015-5099, CVE-2015-5111, CVE-2015-5113, and CVE-2015-5114.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_reader macos acrobat_dc windows acrobat n/a

CWE ID-CWE-416

Use After Free

CVE-2015-5131

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-71.45% / 98.66%

7 Day CHG~0.00%

Published-14 Aug, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5132 and CVE-2015-5133.

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel evergreen air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2013-1386

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-15.16% / 94.33%

7 Day CHG~0.00%

Published-10 Apr, 2013 | 01:00

Updated-11 Apr, 2025 | 00:51

Adobe Shockwave Player before 12.0.2.122 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-1384.

Vendor-n/a Adobe Inc.

Product-shockwave_player n/a

CVE-2013-1377

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-11.43% / 93.31%

7 Day CHG~0.00%

Published-31 Jul, 2013 | 01:00

Updated-11 Apr, 2025 | 00:51

Adobe Digital Editions 2.x before 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-digital_editions n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2013-1385

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-1.83% / 82.16%

7 Day CHG~0.00%

Published-10 Apr, 2013 | 01:00

Updated-11 Apr, 2025 | 00:51

Adobe Shockwave Player before 12.0.2.122 does not prevent access to address information, which makes it easier for attackers to bypass the ASLR protection mechanism via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-shockwave_player n/a

CVE-2013-1368

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-4.19% / 88.26%

7 Day CHG~0.00%

Published-12 Feb, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0642, CVE-2013-0645, CVE-2013-1365, CVE-2013-1366, CVE-2013-1367, CVE-2013-1369, CVE-2013-1370, CVE-2013-1372, and CVE-2013-1373.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk windows mac_os_x android n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2013-1366

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-4.19% / 88.26%

7 Day CHG~0.00%

Published-12 Feb, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0642, CVE-2013-0645, CVE-2013-1365, CVE-2013-1367, CVE-2013-1368, CVE-2013-1369, CVE-2013-1370, CVE-2013-1372, and CVE-2013-1373.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk windows mac_os_x android n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2013-1369

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-4.19% / 88.26%

7 Day CHG~0.00%

Published-12 Feb, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0642, CVE-2013-0645, CVE-2013-1365, CVE-2013-1366, CVE-2013-1367, CVE-2013-1368, CVE-2013-1370, CVE-2013-1372, and CVE-2013-1373.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk windows mac_os_x android n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2013-1378

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-7.03% / 91.10%

7 Day CHG~0.00%

Published-10 Apr, 2013 | 01:00

Updated-11 Apr, 2025 | 00:51

Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-1380.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player adobe_air linux_kernel adobe_air_sdk windows mac_os_x android n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2013-1384

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-15.16% / 94.33%

7 Day CHG~0.00%

Published-10 Apr, 2013 | 01:00

Updated-11 Apr, 2025 | 00:51

Vendor-n/a Adobe Inc.

Product-shockwave_player n/a

CVE-2013-1389

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-21.56% / 95.50%

7 Day CHG~0.00%

Published-16 May, 2013 | 10:00

Updated-11 Apr, 2025 | 00:51

Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 10 before Update 10 allows remote attackers to execute arbitrary code via unknown vectors.

Vendor-n/a Adobe Inc.

Product-coldfusion n/a

CVE-2013-1365

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-4.19% / 88.26%

7 Day CHG~0.00%

Published-12 Feb, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0642, CVE-2013-0645, CVE-2013-1366, CVE-2013-1367, CVE-2013-1368, CVE-2013-1369, CVE-2013-1370, CVE-2013-1372, and CVE-2013-1373.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk windows mac_os_x android n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2013-1376

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-23.02% / 95.70%

7 Day CHG~0.00%

Published-30 Jan, 2014 | 15:00

Updated-11 Apr, 2025 | 00:51

Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0606, CVE-2013-0612, CVE-2013-0615, CVE-2013-0617, and CVE-2013-0621.

Vendor-n/a Adobe Inc.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2013-1371

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-3.72% / 87.52%

7 Day CHG~0.00%

Published-13 Mar, 2013 | 10:00

Updated-11 Apr, 2025 | 00:51

Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X, before 10.3.183.68 and 11.x before 11.2.202.275 on Linux, before 11.1.111.44 on Android 2.x and 3.x, and before 11.1.115.48 on Android 4.x; Adobe AIR before 3.6.0.6090; Adobe AIR SDK before 3.6.0.6090; and Adobe AIR SDK & Compiler before 3.6.0.6090 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player adobe_air linux_kernel mac_os_x adobe_air_sdk_and_compiler adobe_air_sdk windows flash_player_for_android android n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2013-1383

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-14.12% / 94.10%

7 Day CHG~0.00%

Published-10 Apr, 2013 | 01:00

Updated-11 Apr, 2025 | 00:51

Buffer overflow in Adobe Shockwave Player before 12.0.2.122 allows attackers to execute arbitrary code via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-shockwave_player n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2013-1373

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-4.19% / 88.26%

7 Day CHG~0.00%

Published-12 Feb, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0642, CVE-2013-0645, CVE-2013-1365, CVE-2013-1366, CVE-2013-1367, CVE-2013-1368, CVE-2013-1369, CVE-2013-1370, and CVE-2013-1372.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk windows mac_os_x android n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2013-1372

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-4.19% / 88.26%

7 Day CHG~0.00%

Published-12 Feb, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0642, CVE-2013-0645, CVE-2013-1365, CVE-2013-1366, CVE-2013-1367, CVE-2013-1368, CVE-2013-1369, CVE-2013-1370, and CVE-2013-1373.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk windows mac_os_x android n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2013-0611

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-5.85% / 90.20%

7 Day CHG~0.00%

Published-10 Jan, 2013 | 11:00

Updated-11 Apr, 2025 | 00:51

Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors, related to a "logic error," a different vulnerability than CVE-2013-0607, CVE-2013-0608, CVE-2013-0614, and CVE-2013-0618.

Vendor-n/a Adobe Inc.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2013-0606

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-18.04% / 94.91%

7 Day CHG~0.00%

Published-10 Jan, 2013 | 11:00

Updated-11 Apr, 2025 | 00:51

Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0612, CVE-2013-0615, CVE-2013-0617, and CVE-2013-0621.

Vendor-n/a Adobe Inc.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2013-0608

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-8.48% / 91.99%

7 Day CHG~0.00%

Published-10 Jan, 2013 | 11:00

Updated-11 Apr, 2025 | 00:51

Vendor-n/a Adobe Inc.

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2013-0602

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-6.99% / 91.07%

7 Day CHG~0.00%

Published-10 Jan, 2013 | 11:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors.

Vendor-n/a Adobe Inc.

CVE-2013-0616

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-9.79% / 92.66%

7 Day CHG~0.00%

Published-10 Jan, 2013 | 11:00

Updated-11 Apr, 2025 | 00:51

Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-1530, CVE-2013-0601, CVE-2013-0605, CVE-2013-0619, CVE-2013-0620, and CVE-2013-0623.

Vendor-n/a Adobe Inc.

CVE-2013-0614

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-7.64% / 91.50%

7 Day CHG~0.00%

Published-10 Jan, 2013 | 11:00

Updated-11 Apr, 2025 | 00:51

Vendor-n/a Adobe Inc.

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2013-0625

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-86.56% / 99.37%

7 Day CHG~0.00%

Published-09 Jan, 2013 | 01:00

Updated-30 Jul, 2025 | 01:46

Known KEV||Action Due Date - 2022-09-07||Apply updates per vendor instructions.

Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.

Vendor-opengroup n/a Microsoft Corporation Adobe Inc.Apple Inc.

Product-mac_os_x windows coldfusion unix n/a ColdFusion

CWE ID-CWE-287

Improper Authentication

CVE-2019-16454

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-2.57% / 84.97%

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:50

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-16450

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-2.57% / 84.97%

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:43

Updated-05 Aug, 2024 | 01:17

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2013-0601

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-10.11% / 92.80%

7 Day CHG~0.00%

Published-10 Jan, 2013 | 11:00

Updated-11 Apr, 2025 | 00:51

Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-1530, CVE-2013-0605, CVE-2013-0616, CVE-2013-0619, CVE-2013-0620, and CVE-2013-0623.

Vendor-n/a Adobe Inc.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-16462

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-3.62% / 87.34%

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:58

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have a buffer error vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CVE-2019-16452

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-5.69% / 90.04%

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:46

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-16459

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-4.82% / 89.08%

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:56

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-16464

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-4.82% / 89.08%

7 Day CHG~0.00%

Published-19 Dec, 2019 | 15:01

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2010-2217

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-5.97% / 90.31%

7 Day CHG~0.00%

Published-11 Aug, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Adobe Flash Media Server (FMS) before 3.0.6, and 3.5.x before 3.5.4, allows attackers to execute arbitrary code via unspecified vectors, related to a "JS method vulnerability."

Vendor-n/a Adobe Inc.Microsoft Corporation Linux Kernel Organization, Inc

Product-linux_kernel flash_media_server flash_media_server_2 windows n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2013-0615

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-18.04% / 94.91%

7 Day CHG~0.00%

Published-10 Jan, 2013 | 11:00

Updated-11 Apr, 2025 | 00:51

Vendor-n/a Adobe Inc.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2013-0610

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-18.04% / 94.91%

7 Day CHG~0.00%

Published-10 Jan, 2013 | 11:00

Updated-11 Apr, 2025 | 00:51

Stack-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0626.

Vendor-n/a Adobe Inc.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2013-0638

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-4.78% / 89.04%

7 Day CHG~0.00%

Published-12 Feb, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-0647.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk windows mac_os_x android n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-3117

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-7.33% / 91.31%

7 Day CHG~0.00%

Published-09 Jul, 2015 | 16:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, and CVE-2015-4431.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-3120

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-7.67% / 91.52%

7 Day CHG~0.00%

Published-09 Jul, 2015 | 16:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3119, CVE-2015-3121, CVE-2015-3122, and CVE-2015-4433.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CWE ID-CWE-704

Incorrect Type Conversion or Cast

CVE-2013-0604

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-18.04% / 94.91%

7 Day CHG~0.00%

Published-10 Jan, 2013 | 11:00

Updated-11 Apr, 2025 | 00:51

Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0603.

Vendor-n/a Adobe Inc.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-16448

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-4.82% / 89.08%

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:37

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .