CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Adobe : Security Vulnerabilities (CVSS score between 7 and 7.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2013-2550 Bypass 2013-03-11 2013-05-16
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Adobe Reader 11.0.02 allows attackers to bypass the sandbox protection mechanism via unknown vectors, as demonstrated by George Hotz during a Pwn2Own competition at CanSecWest 2013.
2 CVE-2013-2549 94 Exec Code 2013-03-11 2013-05-16
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Adobe Reader 11.0.02 allows remote attackers to execute arbitrary code via vectors related to a "break into the sandbox," as demonstrated by George Hotz during a Pwn2Own competition at CanSecWest 2013.
3 CVE-2013-1388 2013-04-09 2013-04-10
7.5
 User Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to obtain administrator-console access via unknown vectors.
4 CVE-2013-1387 2013-04-09 2013-04-10
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to impersonate users via unknown vectors.
5 CVE-2013-0627 +Priv 2013-01-10 2013-02-07
7.2
 None Local Low Not required Complete Complete Complete
Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows local users to gain privileges via unknown vectors.
6 CVE-2012-5679 119 Exec Code Overflow 2012-12-13 2012-12-13
7.5
 None Remote Low Not required Partial Partial Partial
Buffer underflow in Adobe Photoshop Camera Raw before 7.3 allows attackers to execute arbitrary code via unspecified vectors.
7 CVE-2012-5674 DoS 2012-11-20 2013-05-02
7.1
 None Remote Medium Not required None None Complete
Unspecified vulnerability in Adobe ColdFusion 10 before Update 5, when Internet Information Services (IIS) is used, allows attackers to cause a denial of service via unknown vectors.
8 CVE-2012-4162 119 DoS Exec Code Overflow Mem. Corr. 2012-08-15 2012-08-15
7.5
 None Remote Low Not required Partial Partial Partial
Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-4161.
9 CVE-2012-4161 119 DoS Exec Code Overflow Mem. Corr. 2012-08-15 2012-08-15
7.5
 None Remote Low Not required Partial Partial Partial
Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-4162.
10 CVE-2012-2040 +Priv 2012-06-08 2012-06-20
7.2
 None Local Low Not required Complete Complete Complete
Untrusted search path vulnerability in the installer in Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows local users to gain privileges via a Trojan horse executable file in an unspecified directory.
11 CVE-2012-0777 119 DoS Exec Code Overflow Mem. Corr. 2012-04-10 2013-02-14
7.5
 None Remote Low Not required Partial Partial Partial
The JavaScript API in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 on Mac OS X and Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
12 CVE-2011-4374 189 Exec Code Overflow 2012-01-19 2012-08-13
7.5
 None Remote Low Not required Partial Partial Partial
Integer overflow in Adobe Reader 9.x before 9.4.6 on Linux allows attackers to execute arbitrary code via unspecified vectors.
13 CVE-2011-4373 DoS Exec Code Mem. Corr. 2012-01-10 2012-02-01
7.5
 None Remote Low Not required Partial Partial Partial
Adobe Reader and Acrobat before 9.5, and 10.x before 10.1.2, on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-4370 and CVE-2011-4372.
14 CVE-2011-4372 DoS Exec Code Mem. Corr. 2012-01-10 2012-11-27
7.5
 None Remote Low Not required Partial Partial Partial
Adobe Reader and Acrobat before 9.5, and 10.x before 10.1.2, on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-4370 and CVE-2011-4373.
15 CVE-2011-4371 DoS Exec Code Mem. Corr. 2012-01-10 2012-02-01
7.5
 None Remote Low Not required Partial Partial Partial
Adobe Reader and Acrobat before 9.5, and 10.x before 10.1.2, on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
16 CVE-2011-4370 DoS Exec Code Mem. Corr. 2012-01-10 2012-02-01
7.5
 None Remote Low Not required Partial Partial Partial
Adobe Reader and Acrobat before 9.5, and 10.x before 10.1.2, on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-4372 and CVE-2011-4373.
17 CVE-2010-2861 22 Dir. Trav. 2010-08-11 2011-09-21
7.5
 User Remote Low Not required Partial Partial Partial
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.
18 CVE-2009-3951 200 +Info 2009-12-10 2010-08-21
7.1
 None Remote Medium Not required Complete None None
Unspecified vulnerability in the Flash Player ActiveX control in Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 on Windows allows remote attackers to obtain the names of local files via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4820.
19 CVE-2009-2564 264 1 +Priv 2009-07-21 2010-12-01
7.2
 Admin Local Low Not required Complete Complete Complete
NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot.
20 CVE-2009-1365 2009-05-01 2009-05-19
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Adobe Flash Media Server (FMS) before 3.0.4 and 3.5.x before 3.5.2, as used in Flash Media Interactive Server and Flash Media Streaming Server, allows remote attackers to execute arbitrary remote procedures within an ActionScript file on the server via RPC requests.
21 CVE-2008-5331 310 2008-12-04 2008-12-05
7.5
 User Remote Low Not required Partial Partial Partial
Adobe Acrobat 9 uses more efficient encryption than previous versions, which makes it easier for attackers to guess a document's password via a brute-force attack.
22 CVE-2008-4831 264 +Priv Bypass +Info 2008-11-10 2009-01-06
7.2
 Admin Local Low Not required Complete Complete Complete
Unspecified vulnerability in Adobe ColdFusion 8 and 8.0.1 and ColdFusion MX 7.0.2 allows local users to bypass sandbox restrictions, and obtain sensitive information or possibly gain privileges, via unknown vectors.
23 CVE-2008-4820 200 +Info 2008-11-10 2012-10-30
7.1
 None Remote Medium Not required Complete None None
Unspecified vulnerability in the Flash Player ActiveX control in Adobe Flash Player 9.0.124.0 and earlier on Windows allows attackers to obtain sensitive information via unknown vectors.
24 CVE-2008-4815 264 +Priv 2008-11-05 2012-11-05
7.5
 User Remote Low Not required Partial Partial Partial
Untrusted search path vulnerability in Adobe Reader and Acrobat 8.1.2 and earlier on Unix and Linux allows attackers to gain privileges via a Trojan Horse program in an unspecified directory that is associated with an insecure RPATH.
25 CVE-2008-1656 264 2008-04-09 2012-10-29
7.5
 User Remote Low Not required Partial Partial Partial
Adobe ColdFusion 8 and 8.0.1 does not properly implement the public access level for CFC methods, which allows remote attackers to invoke these methods via Flex 2 remoting, a different vulnerability than CVE-2006-4725.
26 CVE-2008-1203 2008-03-11 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for remote attackers to conduct brute force attacks without detection.
27 CVE-2007-2682 Bypass 2007-05-18 2008-11-15
7.5
 User Remote Low Not required Partial Partial Partial
The installer for Adobe Version Cue CS3 Server on Apple Mac OS X, as used in Adobe Creative Suite 3 (CS3), does not re-enable the personal firewall after completing the product installation, which allows remote attackers to bypass intended firewall rules.
28 CVE-2007-1874 Exec Code +Info 2007-04-11 2008-11-13
7.2
 Admin Local Low Not required Complete Complete Complete
Adobe ColdFusion MX 7 for Linux and Solaris uses insecure permissions for certain scripts and directories, which allows local users to execute arbitrary code or obtain sensitive information via the (1) CFMX7DreamWeaverExtensions.mxp, (2) CFReportBuilderInstaller.exe, (3) .com.zerog.registry.xml, (4) uninstall.lax, (5) license.txt, (6) Readme.htm, (7) .com.zerog.registry.xml, (8) k2adminstop, or (9) k2adminstart files; or (10) certain files in lib/wsconfig/.
29 CVE-2007-1279 +Priv 2007-04-11 2011-03-28
7.2
 Admin Local Low Not required Complete Complete Complete
Unspecified vulnerability in the installer for Adobe Bridge 1.0.3 update for Apple OS X, when patching with desktop management tools, allows local users to gain privileges via unspecified vectors during installation of the update by a different user who has administrative privileges.
30 CVE-2007-0046 Exec Code 2007-01-03 2010-08-21
7.5
 User Remote Low Not required Partial Partial Partial
Double free vulnerability in the Adobe Acrobat Reader Plugin before 8.0.0, as used in Mozilla Firefox 1.5.0.7, allows remote attackers to execute arbitrary code by causing an error via a javascript: URI call to document.write in the (1) FDF, (2) XML, or (3) XFDF AJAX request parameters.
31 CVE-2006-5549 Exec Code File Inclusion 2006-10-26 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
** DISPUTED ** PHP remote file inclusion vulnerability in libraries/amfphp/amf-core/custom/CachedGateway.php in Adobe PHP SDK allows remote attackers to execute arbitrary PHP code via the AMFPHP_BASE parameter. NOTE: this issue has been disputed by a third-party researcher who states that AMFPHP_BASE is a constant.
32 CVE-2006-2042 Sql 2006-05-09 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Adobe Dreamweaver 8 before 8.0.2 and MX 2004 can generate code that allows SQL injection attacks in the (1) ColdFusion, (2) PHP mySQL, (3) ASP, (4) ASP.NET, and (5) JSP server models.
33 CVE-2006-1627 2006-04-13 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Adobe Document Server for Reader Extensions 6.0 does not provide proper access control, which allows remote authenticated users to perform privileged actions by modifying the (1) actionID and (2) pageID parameters. NOTE: due to an error during reservation, this identifier was inadvertently associated with multiple issues. Other CVE identifiers have been assigned to handle other problems that are covered by the same disclosure.
34 CVE-2005-4708 Exec Code 2005-12-31 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
Adobe Macromedia MX 2004 products, Captivate, Contribute 2, Contribute 3, and eLicensing client install the Macromedia Licensing Service with the Users group permitted to configure the service, including the path to executable, which allows local users to execute arbitrary code as Local System.
35 CVE-2005-2470 DoS Exec Code Overflow 2005-08-16 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Buffer overflow in a "core application plug-in" for Adobe Reader 5.1 through 7.0.2 and Acrobat 5.0 through 7.0.2 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.
36 CVE-2005-1307 Exec Code 2005-05-17 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
The (1) stopserver.sh and (2) startserver.sh scripts in Adobe Version Cue on Mac OS X uses the current working directory to find and execute the productname.sh script, which allows local users to execute arbitrary code by copying and calling the scripts from a user-controlled directory.
37 CVE-2005-0151 +Priv 2005-06-13 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Unknown vulnerability in the installation of Adobe License Management Service, as used in Adobe Photoshop CS, Adobe Creative Suite 1.0, and Adobe Premiere Pro 1.5, allows attackers to gain administrator privileges.
38 CVE-2004-0632 Exec Code Overflow 2004-07-27 2008-09-10
7.5
 User Remote Low Not required Partial Partial Partial
Adobe Reader 6.0 does not properly handle null characters when splitting a filename path into components, which allows remote attackers to execute arbitrary code via a file with a long extension that is not normally handled by Reader, triggering a buffer overflow.
39 CVE-2004-0629 Exec Code Overflow 2004-09-28 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Buffer overflow in the ActiveX component (pdf.ocx) for Adobe Acrobat 5.0.5 and Acrobat Reader, and possibly other versions, allows remote attackers to execute arbitrary code via a URI for a PDF file with a null terminator (%00) followed by a long string.
40 CVE-2004-0194 Exec Code Overflow 2004-03-29 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the OutputDebugString function for Adobe Acrobat Reader 5.1 allows remote attackers to execute arbitrary code via a PDF document with XML Forms Data Format (XFDF) data.
41 CVE-2003-0508 Exec Code Overflow 2003-08-07 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Buffer overflow in the WWWLaunchNetscape function of Adobe Acrobat Reader (acroread) 5.0.7 and earlier allows remote attackers to execute arbitrary code via a .pdf file with a long mailto link.
42 CVE-2003-0434 Exec Code 2003-07-24 2008-09-10
7.5
 User Remote Low Not required Partial Partial Partial
Various PDF viewers including (1) Adobe Acrobat 5.06 and (2) Xpdf 1.01 allow remote attackers to execute arbitrary commands via shell metacharacters in an embedded hyperlink.
43 CVE-2003-0284 2003-06-16 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Adobe Acrobat 5 does not properly validate JavaScript in PDF files, which allows remote attackers to write arbitrary files into the Plug-ins folder that spread to other PDF documents, as demonstrated by the W32.Yourde virus.
44 CVE-2001-1069 2001-08-31 2008-09-10
7.2
 Admin Local Low Not required Complete Complete Complete
libCoolType library as used in Adobe Acrobat (acroread) on Linux creates the AdobeFnt.lst file with world-writable permissions, which allows local users to modify the file and possibly modify acroread's behavior.
45 CVE-2000-0713 Exec Code Overflow 2000-10-20 2008-09-05
7.6
 Admin Remote High Not required Complete Complete Complete
Buffer overflow in Adobe Acrobat 4.05, Reader, Business Tools, and Fill In products that handle PDF files allows attackers to execute arbitrary commands via a long /Registry or /Ordering specifier.
46 CVE-1999-1576 Exec Code Overflow 1999-09-27 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Adobe Acrobat ActiveX control (pdf.ocx, PDF.PdfCtrl.1) 1.3.188 for Acrobat Reader 4.0 allows remote attackers to execute arbitrary code via the pdf.setview method.
Total number of vulnerabilities : 46   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.