CVSS: 4.3EPSS: 0%CPEs: 23EXPL: 0CVE-2008-4821 – jar: protocol handler
https://notcve.org/view.php?id=CVE-2008-4821
Adobe Flash Player 9.0.124.0 and earlier, when a Mozilla browser is used, does not properly interpret jar: URLs, which allows attackers to obtain sensitive information via unknown vectors. Adobe Flash Player 9.0.124.0 y anteriores, cuando se usa un navegador de Mozilla, no interpreta adecuadamente URLs jar:, lo que permite a atacantes obtener información sensible mediante vectores desconocidos. • http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html http://secunia.com/advisories/32702 http://secunia.com/advisories/33179 http://secunia.com/advisories/33390 http://secunia.com/advisories/34226 http://security.gentoo.org/glsa/glsa-200903-23.xml http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1 http://support.apple.com/kb/HT3338 http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm http://support.avaya.com/elmodocs2/securit • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.8EPSS: 2%CPEs: 20EXPL: 0CVE-2008-4822 – Flash Player policy file interpretation flaw
https://notcve.org/view.php?id=CVE-2008-4822
Adobe Flash Player 9.0.124.0 and earlier does not properly interpret policy files, which allows remote attackers to bypass a non-root domain policy. Adobe Flash Player v9.0.124.0 y anteriores no interpretan de forma adecuada los ficheros de políticas, lo que permite a atacantes remotos saltarse la política de dominio “non-root” • http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html http://secunia.com/advisories/32702 http://secunia.com/advisories/33179 http://secunia.com/advisories/33390 http://secunia.com/advisories/34226 http://security.gentoo.org/glsa/glsa-200903-23.xml http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1 http://support.apple.com/kb/HT3338 http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm http://support.avaya.com/elmodocs2/securit • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 3%CPEs: 20EXPL: 0CVE-2008-4401 – flash-plugin: upload/download user interaction
https://notcve.org/view.php?id=CVE-2008-4401
ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download operation in the FileReference download API, which allows remote attackers to create a browse dialog box, and possibly have unspecified other impact, via an SWF file. ActionScript en Adobe Flash Player 9.0.124.0 y anteriores no requiere interacción del usuario en conjunción con (1) la operación FileReference.browse en la API de subida FileReference upload o (2) la operación FileReference.download en la API de descarga FileReference, lo que permite a atacantes remotos crear un cuadro de diálogo de exploración y ,posiblemente tener otro impacto no especificado, mediante un fichero SWF. • http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html http://secunia.com/advisories/32270 http://secunia.com/advisories/32448 http://secunia.com/advisories/32702 http://secunia.com/advisories/32759 http://secunia.com/advisories/33390 http://secunia.com/advisories/34226 http://security.gentoo.org/glsa/glsa-200903-23.xml http://securitytracker.com/id?1021061 http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1 http://support.avaya.com/elmodocs2/ • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 1%CPEs: 4EXPL: 2CVE-2008-4546 – Adobe Flash Player 9/10 - SWF Version Null Pointer Dereference Denial of Service
https://notcve.org/view.php?id=CVE-2008-4546
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows remote web servers to cause a denial of service (NULL pointer dereference and browser crash) by returning a different response when an HTTP request is sent a second time, as demonstrated by two responses that provide SWF files with different SWF version numbers. Adobe Flash Player 9.0.45.0, 9.0.112.0, 9.0.124.0, y 10.0.12.10 permite a los servidores web remotos causar una denegación de servicio (referencia a puntero nulo y finalización de la aplicación) devolviendo una respuesta inapropiada cuando una solicitud HTTP se envía por segunda vez, como lo demuestran las respuestas que proporcionan dos ficheros SWF con números de versión SWF diferentes. • https://www.exploit-db.com/exploits/32452 http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751 http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html http://secunia.com/advisories/32759 http://secunia.com/advisories/40545 http:/ • CWE-399: Resource Management Errors •
CVSS: 6.8EPSS: 3%CPEs: 23EXPL: 0CVE-2008-4503 – Adobe Flash Player clickjacking
https://notcve.org/view.php?id=CVE-2008-4503
The Settings Manager in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to cause victims to unknowingly click on a link or dialog via access control dialogs disguised as normal graphical elements, as demonstrated by hijacking the camera or microphone, and related to "clickjacking." El Administrador de configuración en el Adobe Flash Player v9.0.124.0 y versiones anteriores permite a atacantes remotos que los usuarios hagan clic sin saberlo en unos controles que no se distinguen de los normales en un lugar que permite secuestrar la camara o el microfono, esta relacionado con el clickjacking. • http://blog.guya.net/2008/10/07/malicious-camera-spying-using-clickjacking http://ha.ckers.org/blog/20081007/clickjacking-details http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html http://secunia.com/advisories/32163 http://secunia.com/advisories/32448 http://secunia.com/advisories/32702 http://secunia.com/advisories/32759 http://secunia.com/advisories/33390 http://secunia.com/advisories/34226 http://security.gentoo.org/glsa/glsa-200903-23.xml http://sun •