CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Adobe : Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2021-39825 787 Exec Code 2021-09-27 2021-10-04
6.8
None Remote Medium Not required Partial Partial Partial
Photoshop Elements versions 2021 build 19.0 (20210304.m.156367) (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious TTF file.
2 CVE-2021-39819 788 Exec Code Mem. Corr. 2021-09-27 2021-10-01
6.8
None Remote Medium Not required Partial Partial Partial
Adobe InCopy version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious XML file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
3 CVE-2021-39818 788 Exec Code Mem. Corr. 2021-09-27 2021-10-01
6.8
None Remote Medium Not required Partial Partial Partial
Adobe InCopy version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious TIFF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
4 CVE-2021-36052 788 Exec Code Mem. Corr. 2021-09-01 2021-10-27
6.8
None Remote Medium Not required Partial Partial Partial
XMP Toolkit version 2020.1 (and earlier) is affected by a memory corruption vulnerability, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
5 CVE-2021-36051 120 Exec Code Overflow 2021-10-04 2021-10-27
6.8
None Remote Medium Not required Partial Partial Partial
XMP Toolkit SDK version 2020.1 (and earlier) is affected by a buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a specially-crafted .cpp file.
6 CVE-2021-36043 918 Exec Code 2021-09-01 2021-09-08
6.0
None Remote Medium ??? Partial Partial Partial
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmailer extension. An attacker with admin privileges could abuse this to achieve remote code execution should Redis be enabled.
7 CVE-2021-36042 20 Exec Code 2021-09-01 2021-09-08
6.5
None Remote Low ??? Partial Partial Partial
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code execution.
8 CVE-2021-36041 20 Exec Code 2021-09-01 2021-09-08
6.5
None Remote Low ??? Partial Partial Partial
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges could upload a specially crafted file in the 'pub/media` directory could lead to remote code execution.
9 CVE-2021-36040 20 Exec Code Bypass 2021-09-01 2021-09-08
6.5
None Remote Low ??? Partial Partial Partial
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to bypass file extension restrictions and could lead to remote code execution.
10 CVE-2021-36035 20 Exec Code 2021-09-01 2021-09-08
6.5
None Remote Low ??? Partial Partial Partial
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges could make a crafted request to the Adobe Stock API to achieve remote code execution.
11 CVE-2021-36034 20 Exec Code 2021-09-01 2021-09-08
6.5
None Remote Low ??? Partial Partial Partial
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution.
12 CVE-2021-36033 91 Exec Code 2021-09-01 2021-09-08
6.5
None Remote Low ??? Partial Partial Partial
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
13 CVE-2021-36032 20 2021-09-01 2021-09-08
6.5
None Remote Low ??? Partial Partial Partial
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the `V1/customers/me` endpoint to achieve information exposure and privilege escalation.
14 CVE-2021-36031 22 Exec Code Dir. Trav. 2021-09-01 2021-09-08
6.5
None Remote Low ??? Partial Partial Partial
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a Path Traversal vulnerability via the `theme[preview_image]` parameter. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.
15 CVE-2021-36029 285 Exec Code 2021-09-01 2021-09-08
6.5
None Remote Low ??? Partial Partial Partial
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.
16 CVE-2021-36028 91 Exec Code 2021-09-01 2021-09-08
6.5
None Remote Low ??? Partial Partial Partial
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a configurable product. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
17 CVE-2021-36025 20 Exec Code 2021-09-01 2021-09-08
6.5
None Remote Low ??? Partial Partial Partial
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability while saving a customer's details with a specially crafted file. An authenticated attacker with admin privileges can leverage this vulnerability to achieve remote code execution.
18 CVE-2021-36024 78 Exec Code 2021-09-01 2021-09-08
6.5
None Remote Low ??? Partial Partial Partial
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements Used In A Command via the Data collection endpoint. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution.
19 CVE-2021-36022 74 Exec Code 2021-09-01 2021-09-08
6.5
None Remote Low ??? Partial Partial Partial
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
20 CVE-2021-36013 125 Exec Code 2021-08-23 2021-08-30
6.8
None Remote Medium Not required Partial Partial Partial
Adobe Media Encoder version 15.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
21 CVE-2021-35993 787 Exec Code 2021-09-02 2021-09-14
6.8
None Remote Medium Not required Partial Partial Partial
Adobe After Effects version 18.2.1 (and earlier) is affected by an out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
22 CVE-2021-35983 416 Exec Code 2021-08-20 2021-09-01
6.8
None Remote Medium Not required Partial Partial Partial
Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
23 CVE-2021-35981 416 Exec Code 2021-08-20 2021-09-01
6.8
None Remote Medium Not required Partial Partial Partial
Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
24 CVE-2021-28642 787 Exec Code 2021-08-20 2021-08-26
6.8
None Remote Medium Not required Partial Partial Partial
Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Out-of-bounds write vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
25 CVE-2021-28641 416 Exec Code 2021-08-20 2021-08-27
6.8
None Remote Medium Not required Partial Partial Partial
Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
26 CVE-2021-28640 416 Exec Code 2021-08-20 2021-08-26
6.0
None Remote Medium ??? Partial Partial Partial
Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulnerability. An authenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
27 CVE-2021-28638 122 Exec Code Overflow 2021-08-20 2021-08-31
6.8
None Remote Medium Not required Partial Partial Partial
Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Heap-based Buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
28 CVE-2021-28627 918 2021-08-24 2021-08-31
6.5
None Remote Low ??? Partial Partial Partial
Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by a Server-side Request Forgery. An authenticated attacker could leverage this vulnerability to contact systems blocked by the dispatcher. Exploitation of this issue does not require user interaction.
29 CVE-2021-21085 20 Exec Code 2021-03-12 2021-06-28
6.8
None Remote Medium Not required Partial Partial Partial
Adobe Connect version 11.0.7 (and earlier) is affected by an Input Validation vulnerability in the export feature. An attacker could exploit this vulnerability by injecting a payload into an online event form and achieve code execution if the victim exports and opens the data on their local machine.
30 CVE-2021-21082 788 Exec Code Mem. Corr. 2021-03-12 2021-06-28
6.8
None Remote Medium Not required Partial Partial Partial
Adobe Photoshop versions 21.2.5 (and earlier) and 22.2 (and earlier) are affected by a Memory Corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
31 CVE-2020-24422 427 Exec Code 2020-10-21 2020-11-02
6.8
None Remote Medium Not required Partial Partial Partial
Adobe Creative Cloud Desktop Application version 5.2 (and earlier) and 2.1 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
32 CVE-2020-9732 79 XSS 2020-09-10 2020-09-11
6.0
None Remote Medium ??? Partial Partial Partial
The AEM Forms add-on for versions 6.5.5.0 (and below) and 6.4.8.2 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Sites component. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.
33 CVE-2020-9650 787 Exec Code 2020-07-17 2020-07-22
6.8
None Remote Medium Not required Partial Partial Partial
Adobe Media Encoder versions 14.2 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.
34 CVE-2020-9646 787 Exec Code 2020-07-17 2020-07-22
6.8
None Remote Medium Not required Partial Partial Partial
Adobe Media Encoder versions 14.2 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.
35 CVE-2020-9636 119 Exec Code Overflow Mem. Corr. 2020-06-12 2021-07-21
6.8
None Remote Medium Not required Partial Partial Partial
Adobe Framemaker versions 2019.0.5 and below have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
36 CVE-2020-9635 787 Exec Code 2020-06-12 2020-06-16
6.8
None Remote Medium Not required Partial Partial Partial
Adobe Framemaker versions 2019.0.5 and below have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.
37 CVE-2020-9634 787 Exec Code 2020-06-12 2020-06-16
6.8
None Remote Medium Not required Partial Partial Partial
Adobe Framemaker versions 2019.0.5 and below have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.
38 CVE-2020-3738 787 Exec Code 2020-02-13 2020-02-14
6.8
None Remote Medium Not required Partial Partial Partial
Adobe Framemaker versions 2019.0.4 and below have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.
39 CVE-2020-3737 787 Exec Code 2020-02-13 2020-02-14
6.8
None Remote Medium Not required Partial Partial Partial
Adobe Framemaker versions 2019.0.4 and below have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.
40 CVE-2019-8076 426 Exec Code 2019-09-12 2021-07-21
6.8
None Remote Medium Not required Partial Partial Partial
Adobe application manager installer version 10.0 have an Insecure Library Loading (DLL hijacking) vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.
41 CVE-2019-8062 426 Exec Code 2019-08-14 2021-07-21
6.8
None Remote Medium Not required Partial Partial Partial
Adobe After Effects versions 16 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to arbitrary code execution.
42 CVE-2019-7961 426 Exec Code 2019-08-14 2021-07-21
6.8
None Remote Medium Not required Partial Partial Partial
Adobe Prelude CC versions 8.1 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to arbitrary code execution.
43 CVE-2019-7931 426 Exec Code 2019-08-14 2021-07-21
6.8
None Remote Medium Not required Partial Partial Partial
Adobe Premiere Pro CC versions 13.1.2 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to arbitrary code execution.
44 CVE-2019-7870 426 Exec Code 2019-08-14 2021-07-21
6.8
None Remote Medium Not required Partial Partial Partial
Adobe Character Animator versions 2.1 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to arbitrary code execution.
45 CVE-2018-15976 427 2018-10-17 2018-12-17
6.8
None Remote Medium Not required Partial Partial Partial
Adobe Technical Communications Suite versions 1.0.5.1 and below have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege escalation.
46 CVE-2018-15974 426 2018-10-17 2018-12-17
6.8
None Remote Medium Not required Partial Partial Partial
Adobe Framemaker versions 1.0.5.1 and below have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege escalation.
47 CVE-2018-15960 20 2018-09-25 2020-09-04
6.4
None Remote Low Not required None Partial Partial
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with a known vulnerability vulnerability. Successful exploitation could lead to arbitrary file overwrite.
48 CVE-2018-4943 20 Exec Code 2018-05-19 2018-06-28
6.8
None Remote Medium Not required Partial Partial Partial
Adobe PhoneGap Push Plugin versions 1.8.0 and earlier have an exploitable Same-Origin Method Execution vulnerability. Successful exploitation could lead to JavaScript code execution in the context of the PhoneGap app.
49 CVE-2018-4923 78 2018-05-19 2018-06-22
6.4
None Remote Low Not required None Partial Partial
Adobe Connect versions 9.7 and earlier have an exploitable OS Command Injection. Successful exploitation could lead to arbitrary file deletion.
50 CVE-2018-4916 787 Exec Code 2018-02-27 2018-03-16
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. The vulnerability is caused by the computation that writes data past the end of the intended buffer; the computation is part of the image conversion module that handless TIFF data. An attacker can potentially leverage the vulnerability to corrupt sensitive data or execute arbitrary code.
Total number of vulnerabilities : 94   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.