CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-28500
https://notcve.org/view.php?id=CVE-2023-28500
A Java insecure deserialization vulnerability in Adobe LiveCycle ES4 version 11.0 and earlier allows unauthenticated remote attackers to gain operating system code execution by submitting specially crafted Java serialized objects to a specific URL. Adobe LiveCycle ES4 version 11.0.1 and later may be vulnerable if the application is installed with Java environment 7u21 and earlier. Exploitation of the vulnerability depends on two factors: insecure deserialization methods used in the Adobe LiveCycle application, and the use of Java environments 7u21 and earlier. The code execution is performed in the context of the account that is running the Adobe LiveCycle application. If the account is privileged, exploitation provides privileged access to the operating system. • https://coastalsecurity.gitbook.io/critical-vulnerability-adobe-livecycle-es4v11.0 • CWE-502: Deserialization of Untrusted Data •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2016-6933
https://notcve.org/view.php?id=CVE-2016-6933
Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the AACComponent that could be used in cross-site scripting attacks. Adobe Experience Manager Forms en versión 6.2 y versiones anteriores, LiveCycle 11.0.1, LiveCycle 10.0.4 tienen un problema de validación de entrada en el AACComponent que puede ser utilizado en ataques de XSS. • http://www.securityfocus.com/bid/94867 http://www.securitytracker.com/id/1037465 https://helpx.adobe.com/security/products/aem-forms/apsb16-40.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2016-6934
https://notcve.org/view.php?id=CVE-2016-6934
Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the PMAdmin module that could be used in cross-site scripting attacks. Adobe Experience Manager Forms en versión 6.2 y versiones anteriores, LiveCycle 11.0.1, LiveCycle 10.0.4 tienen un problema de validación de entrada en el módulo PMAdmin que puede ser utilizado en ataques de XSS. • http://www.securityfocus.com/bid/94867 http://www.securitytracker.com/id/1037465 https://helpx.adobe.com/security/products/aem-forms/apsb16-40.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 8EXPL: 0CVE-2015-5255 – Apache Flex BlazeDS 4.7.1 SSRF
https://notcve.org/view.php?id=CVE-2015-5255
Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue. Adobe BlazeDS, como se utiliza en ColdFusion 10 en versiones anteriores a Update 18 y 11 en versiones anteriores a Update 7 y LiveCycle Data Services 3.0.x en versiones anteriores a 3.0.0.354175, 3.1.x en versiones anteriores a 3.1.0.354180, 4.5.x en versiones anteriores a 4.5.1.354177, 4.6.2.x en versiones anteriores a 4.6.2.354178 y 4.7.x en versiones anteriores a 4.7.0.354178, permite a atacantes remotos enviar tráfico HTTP a los servidores de la intranet a través de un documento XML manipulado, relacionado con un problema Server-Side Request Forgery (SSRF). Apache Flex BlazeDS versions 4.7.0 and 4.7.1 suffer from a server-side request forgery vulnerability. • http://marc.info/?l=bugtraq&m=145996963420108&w=2 http://packetstormsecurity.com/files/134506/Apache-Flex-BlazeDS-4.7.1-SSRF.html http://www.securityfocus.com/archive/1/536958/100/0/threaded http://www.securityfocus.com/bid/77626 http://www.securitytracker.com/id/1034210 http://www.vmware.com/security/advisories/VMSA-2015-0008.html https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05073670 https://helpx.adobe.com/security/products/coldfusion/apsb15 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2015-3269 – Cisco Nexus Dashboard Fabric Controller XML External Entity Processing Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2015-3269
Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services (LCDS) 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and 4.7 before 4.7.0.354169 and other products, allows remote attackers to read arbitrary files via an AMF message containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Vulnerabilidad en Apache Flex BlazeDS, tal como se usa en flex-messaging-core.jar en Adobe LiveCycle Data Services (LCDS) 3.0.x en versiones anteriores a 3.0.0.354170, 4.5 en versiones anteriores a 4.5.1.354169, 4.6.2 en versiones anteriores a 4.6.2.354169 y 4.7 en versiones anteriores a 4.7.0.354169 y otros productos, permite a atacantes remotos leer archivos arbitrarios a través de mensajes AMF que contienen una declaración de entidad externa XML en conjunción con una referencia a entidad, relacionada con un problema de entidad externa XML (XXE). This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Nexus Dashboard Fabric Controller. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the AMF protocol. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. • http://marc.info/?l=bugtraq&m=145706712500978&w=2 http://www.securityfocus.com/archive/1/536266/100/0/threaded http://www.securityfocus.com/bid/76394 http://www.securitytracker.com/id/1033337 http://www.vmware.com/security/advisories/VMSA-2015-0008.html https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05026202 https://helpx.adobe.com/content/help/en/security/products/coldfusion/apsb15-21.html https://helpx.adobe.com/security/products/livecycleds/ • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •