CVSS: 9.3EPSS: 0%CPEs: 11EXPL: 0CVE-2009-2186
https://notcve.org/view.php?id=CVE-2009-2186
Unspecified vulnerability in Adobe Shockwave Player before 11.0.0.465 allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2009-1860, related to an older issue that "was previously resolved in Shockwave Player 11.0.0.465." Una vulnerabilidad no especificada en Adobe Shockwave Player anterior a la versión 11.0.0.465 permite que los atacantes remotos ejecuten código arbitrario por medio de vectores desconocidos, una vulnerabilidad diferente de CVE-2009-1860, relacionada con un problema anterior que "was previously resolved in Shockwave Player 11.0.0.465." • http://www.adobe.com/support/security/bulletins/apsb09-08.html •
CVSS: 9.3EPSS: 7%CPEs: 12EXPL: 0CVE-2009-1860 – Adobe Shockwave Player Director File Parsing Pointer Overwrite Vulnerability
https://notcve.org/view.php?id=CVE-2009-1860
Unspecified vulnerability in Adobe Shockwave Player before 11.5.0.600 allows remote attackers to execute arbitrary code via crafted Shockwave Player 10 content. Vulnerabilidad sin especificar en Adobe Shockwave Player anterior a v11.5.0.600 permite a atacantes remotos ejecutar código de su elección a través de contenido Shockwave Player 10 manipulado. This vulnerability allows remote attackers to execute code on vulnerable installations of Adobe's Shockwave Player. User interaction is required in that a user must visit a malicious web site. The specific flaw exists when the Shockwave player attempts to load a specially crafted Adobe Director File. When a malicious value is used during a memory dereference a possible 4-byte memory overwrite may occur. • http://secunia.com/advisories/35544 http://www.adobe.com/support/security/bulletins/apsb09-08.html http://www.securityfocus.com/bid/35469 http://www.securitytracker.com/id?1022440 •
CVSS: 10.0EPSS: 2%CPEs: 1EXPL: 2CVE-2007-5941 – Adobe Shockwave - 'ShockwaveVersion()' Stack Overflow (PoC)
https://notcve.org/view.php?id=CVE-2007-5941
Stack-based buffer overflow in the SWCtl.SWCtl ActiveX control in Adobe Shockwave allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long argument to the ShockwaveVersion method. Desbordamiento de búfer basado en pila en el control ActiveX SWCtl.SWCtl en Adobe Shockwave permite a atacantes remotos provocar denegación de servicio y posiblemente ejecutar código de su elección a través de un argumento largo en el método ShockwaveVersion. • https://www.exploit-db.com/exploits/4613 http://www.securityfocus.com/bid/26388 https://exchange.xforce.ibmcloud.com/vulnerabilities/38359 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 8%CPEs: 1EXPL: 0CVE-2007-5275 – Flash plugin DNS rebinding
https://notcve.org/view.php?id=CVE-2007-5275
The Adobe Macromedia Flash 9 plug-in allows remote attackers to cause a victim machine to establish TCP sessions with arbitrary hosts via a Flash (SWF) movie, related to lack of pinning of a hostname to a single IP address after receiving an allow-access-from element in a cross-domain-policy XML document, and the availability of a Flash Socket class that does not use the browser's DNS pins, aka DNS rebinding attacks, a different issue than CVE-2002-1467 and CVE-2007-4324. La extensión Adobe Macromedia Flash 9 permite a atacantes remotos provocar que la máquina de una víctima establezca sesiones TCP con anfitriones arbitrarios mediante una película Flash (SWF), relacionada con la falta de fijación de un nombre de anfitrión con una dirección IP única después de recibir un elemento permitir-acceso-desde (allow-access-from) en un documento XML de política-de-dominio-cruzado (cross-domain-policy), y la disponibilidad de una clase Socket Flash que no utiliza las fijaciones DNS del navegador, también conocidos como ataques de revinculación DNS, un problema diferente de CVE-2002-1467 Y CVE-2007-4324. • http://crypto.stanford.edu/dns/dns-rebinding.pdf http://lists.apple.com/archives/security-announce/2008//May/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00006.html http://secunia.com/advisories/28157 http://secunia.com/advisories/28161 http://secunia.com/advisories/28213 http://secunia.com/advisories/28570 http://secunia.com/advisories/29763 http://secunia.com/advisories/29865&# • CWE-20: Improper Input Validation •
CVSS: 9.3EPSS: 40%CPEs: 9EXPL: 0CVE-2005-3525 – Adobe Macromedia ShockWave Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2005-3525
Stack-based buffer overflow in an ActiveX control for the installer for Adobe Macromedia Shockwave Player 10.1.0.11 and earlier allows remote attackers to execute arbitrary code via crafted large values for unspecified parameters. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Macromedia Shockwave. Exploitation requires the target to visit a malicious web site. This specific flaw exists within the ActiveX control with CLSID 166B1BCA-3F9C-11CF-8075-444553540000. Specifying large values for two specific parameters to this control results in an exploitable stack based buffer overflow. Due to the nature of this vulnerability, the target user is not required to have fully completed an installation of Shockwave to be vulnerable. • http://secunia.com/advisories/19009 http://securityreason.com/securityalert/481 http://securitytracker.com/id?1015673 http://www.kb.cert.org/vuls/id/437212 http://www.macromedia.com/devnet/security/security_zone/apsb06-02.html http://www.osvdb.org/23461 http://www.securityfocus.com/archive/1/425900/100/0/threaded http://www.securityfocus.com/bid/16791 http://www.vupen.com/english/advisories/2006/0716 http://www.zerodayinitiative.com/advisories/ZDI-06-002.html https:// •