Action not permitted
Modal body text goes here.
Modal Title
Modal Body
wid-sec-w-2024-3677
Vulnerability from csaf_certbund
Published
2024-12-10 23:00
Modified
2024-12-10 23:00
Summary
Adobe Creative Cloud Applikationen: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Adobe Creative Cloud umfasst Anwendungen und Dienste für Video, Design, Fotografie und Web.
Angriff
Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, erhöhte Rechte zu erlangen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu erzeugen.
Betroffene Betriebssysteme
- Sonstiges
- UNIX
- Windows
{ document: { aggregate_severity: { text: "hoch", }, category: "csaf_base", csaf_version: "2.0", distribution: { tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "de-DE", notes: [ { category: "legal_disclaimer", text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.", }, { category: "description", text: "Adobe Creative Cloud umfasst Anwendungen und Dienste für Video, Design, Fotografie und Web.", title: "Produktbeschreibung", }, { category: "summary", text: "Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, erhöhte Rechte zu erlangen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu erzeugen.", title: "Angriff", }, { category: "general", text: "- Sonstiges\n- UNIX\n- Windows", title: "Betroffene Betriebssysteme", }, ], publisher: { category: "other", contact_details: "csaf-provider@cert-bund.de", name: "Bundesamt für Sicherheit in der Informationstechnik", namespace: "https://www.bsi.bund.de", }, references: [ { category: "self", summary: "WID-SEC-W-2024-3677 - CSAF Version", url: "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3677.json", }, { category: "self", summary: "WID-SEC-2024-3677 - Portal Version", url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3677", }, { category: "external", summary: "Adobe Security Bulletin APSB24-93 vom 2024-12-10", url: "https://helpx.adobe.com/security/products/media-encoder/apsb24-93.html", }, { category: "external", summary: "Adobe Security Bulletin APSB24-94 vom 2024-12-10", url: "https://helpx.adobe.com/security/products/illustrator/apsb24-94.html", }, { category: "external", summary: "Adobe Security Bulletin APSB24-95 vom 2024-12-10", url: "https://helpx.adobe.com/security/products/after_effects/apsb24-95.html", }, { category: "external", summary: "Adobe Security Bulletin APSB24-96 vom 2024-12-10", url: "https://helpx.adobe.com/security/products/animate/apsb24-96.html", }, { category: "external", summary: "Adobe Security Bulletin APSB24-97 vom 2024-12-10", url: "https://helpx.adobe.com/security/products/indesign/apsb24-97.html", }, { category: "external", summary: "Adobe Security Bulletin APSB24-98 vom 2024-12-10", url: "https://helpx.adobe.com/security/products/pdfl-sdk1/apsb24-98.html", }, { category: "external", summary: "Adobe Security Bulletin APSB24-99 vom 2024-12-10", url: "https://helpx.adobe.com/security/products/connect/apsb24-99.html", }, { category: "external", summary: "Adobe Security Bulletin APSB24-100 vom 2024-12-10", url: "https://helpx.adobe.com/security/products/substance3d-sampler/apsb24-100.html", }, { category: "external", summary: "Adobe Security Bulletin APSB24-102 vom 2024-12-10", url: "https://helpx.adobe.com/security/products/substance3d-modeler/apsb24-102.html", }, { category: "external", summary: "Adobe Security Bulletin APSB24-103 vom 2024-12-10", url: "https://helpx.adobe.com/security/products/bridge/apsb24-103.html", }, { category: "external", summary: "Adobe Security Bulletin APSB24-104 vom 2024-12-10", url: "https://helpx.adobe.com/security/products/premiere_pro/apsb24-104.html", }, { category: "external", summary: "Adobe Security Bulletin APSB24-105 vom 2024-12-10", url: "https://helpx.adobe.com/security/products/substance3d_painter/apsb24-105.html", }, ], source_lang: "en-US", title: "Adobe Creative Cloud Applikationen: Mehrere Schwachstellen", tracking: { current_release_date: "2024-12-10T23:00:00.000+00:00", generator: { date: "2024-12-11T12:11:57.545+00:00", engine: { name: "BSI-WID", version: "1.3.10", }, }, id: "WID-SEC-W-2024-3677", initial_release_date: "2024-12-10T23:00:00.000+00:00", revision_history: [ { date: "2024-12-10T23:00:00.000+00:00", number: "1", summary: "Initiale Fassung", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version_range", name: "Media Encoder <24.6.4", product: { name: "Adobe Creative Cloud Media Encoder <24.6.4", product_id: "T039758", }, }, { category: "product_version", name: "Media Encoder 24.6.4", product: { name: "Adobe Creative Cloud Media Encoder 24.6.4", product_id: "T039758-fixed", product_identification_helper: { cpe: "cpe:/a:adobe:creative_cloud:media_encoder__24.6.4", }, }, }, { category: "product_version_range", name: "Media Encoder <25.1", product: { name: "Adobe Creative Cloud Media Encoder <25.1", product_id: "T039759", }, }, { category: "product_version", name: "Media Encoder 25.1", product: { name: "Adobe Creative Cloud Media Encoder 25.1", product_id: "T039759-fixed", product_identification_helper: { cpe: "cpe:/a:adobe:creative_cloud:media_encoder__25.1", }, }, }, { category: "product_version_range", name: "Illustrator 2025 <29.1", product: { name: "Adobe Creative Cloud Illustrator 2025 <29.1", product_id: "T039760", }, }, { category: "product_version", name: "Illustrator 2025 29.1", product: { name: "Adobe Creative Cloud Illustrator 2025 29.1", product_id: "T039760-fixed", product_identification_helper: { cpe: "cpe:/a:adobe:creative_cloud:illustrator_2025__29.1", }, }, }, { category: "product_version_range", name: "Illustrator 2024 <28.7.3", product: { name: "Adobe Creative Cloud Illustrator 2024 <28.7.3", product_id: "T039761", }, }, { category: "product_version", name: "Illustrator 2024 28.7.3", product: { name: "Adobe Creative Cloud Illustrator 2024 28.7.3", product_id: "T039761-fixed", product_identification_helper: { cpe: "cpe:/a:adobe:creative_cloud:illustrator_2024__28.7.3", }, }, }, { category: "product_version_range", name: "After Effects <24.6.3", product: { name: "Adobe Creative Cloud After Effects <24.6.3", product_id: "T039766", }, }, { category: "product_version_range", name: "After Effects 24.6.3", product: { name: "Adobe Creative Cloud After Effects 24.6.3", product_id: "T039766-fixed", }, }, { category: "product_version_range", name: "After Effects <25.1", product: { name: "Adobe Creative Cloud After Effects <25.1", product_id: "T039767", }, }, { category: "product_version_range", name: "After Effects 25.1", product: { name: "Adobe Creative Cloud After Effects 25.1", product_id: "T039767-fixed", }, }, { category: "product_version_range", name: "Animate 2023 <23.0.9", product: { name: "Adobe Creative Cloud Animate 2023 <23.0.9", product_id: "T039768", }, }, { category: "product_version", name: "Animate 2023 23.0.9", product: { name: "Adobe Creative Cloud Animate 2023 23.0.9", product_id: "T039768-fixed", product_identification_helper: { cpe: "cpe:/a:adobe:creative_cloud:animate_2023__23.0.9", }, }, }, { category: "product_version_range", name: "Animate 2024 <24.0.6", product: { name: "Adobe Creative Cloud Animate 2024 <24.0.6", product_id: "T039769", }, }, { category: "product_version", name: "Animate 2024 24.0.6", product: { name: "Adobe Creative Cloud Animate 2024 24.0.6", product_id: "T039769-fixed", product_identification_helper: { cpe: "cpe:/a:adobe:creative_cloud:animate_2024__24.0.6", }, }, }, { category: "product_version_range", name: "InDesign <ID20.0", product: { name: "Adobe Creative Cloud InDesign <ID20.0", product_id: "T039770", }, }, { category: "product_version", name: "InDesign ID20.0", product: { name: "Adobe Creative Cloud InDesign ID20.0", product_id: "T039770-fixed", product_identification_helper: { cpe: "cpe:/a:adobe:creative_cloud:indesign__id20.0", }, }, }, { category: "product_version_range", name: "InDesign <ID19.5.1", product: { name: "Adobe Creative Cloud InDesign <ID19.5.1", product_id: "T039771", }, }, { category: "product_version", name: "InDesign ID19.5.1", product: { name: "Adobe Creative Cloud InDesign ID19.5.1", product_id: "T039771-fixed", product_identification_helper: { cpe: "cpe:/a:adobe:creative_cloud:indesign__id19.5.1", }, }, }, { category: "product_version_range", name: "PDFL Software Development Kit (SDK) <21.0.0.7", product: { name: "Adobe Creative Cloud PDFL Software Development Kit (SDK) <21.0.0.7", product_id: "T039772", }, }, { category: "product_version", name: "PDFL Software Development Kit (SDK) 21.0.0.7", product: { name: "Adobe Creative Cloud PDFL Software Development Kit (SDK) 21.0.0.7", product_id: "T039772-fixed", product_identification_helper: { cpe: "cpe:/a:adobe:creative_cloud:pdfl_software_development_kit_%2528sdk%2529__21.0.0.7", }, }, }, { category: "product_version_range", name: "Connect <12.7", product: { name: "Adobe Creative Cloud Connect <12.7", product_id: "T039773", }, }, { category: "product_version", name: "Connect 12.7", product: { name: "Adobe Creative Cloud Connect 12.7", product_id: "T039773-fixed", product_identification_helper: { cpe: "cpe:/a:adobe:creative_cloud:connect__12.7", }, }, }, { category: "product_version_range", name: "Connect <11.4.9", product: { name: "Adobe Creative Cloud Connect <11.4.9", product_id: "T039774", }, }, { category: "product_version", name: "Connect 11.4.9", product: { name: "Adobe Creative Cloud Connect 11.4.9", product_id: "T039774-fixed", product_identification_helper: { cpe: "cpe:/a:adobe:creative_cloud:connect__11.4.9", }, }, }, { category: "product_version_range", name: "Substance 3D Sampler <4.5.2", product: { name: "Adobe Creative Cloud Substance 3D Sampler <4.5.2", product_id: "T039775", }, }, { category: "product_version", name: "Substance 3D Sampler 4.5.2", product: { name: "Adobe Creative Cloud Substance 3D Sampler 4.5.2", product_id: "T039775-fixed", product_identification_helper: { cpe: "cpe:/a:adobe:creative_cloud:substance_3d_sampler__4.5.2", }, }, }, { category: "product_version_range", name: "Substance 3D Modeler <1.15.0", product: { name: "Adobe Creative Cloud Substance 3D Modeler <1.15.0", product_id: "T039785", }, }, { category: "product_version", name: "Substance 3D Modeler 1.15.0", product: { name: "Adobe Creative Cloud Substance 3D Modeler 1.15.0", product_id: "T039785-fixed", product_identification_helper: { cpe: "cpe:/a:adobe:creative_cloud:substance_3d_modeler__1.15.0", }, }, }, { category: "product_version_range", name: "Bridge <14.1.4", product: { name: "Adobe Creative Cloud Bridge <14.1.4", product_id: "T039786", }, }, { category: "product_version", name: "Bridge 14.1.4", product: { name: "Adobe Creative Cloud Bridge 14.1.4", product_id: "T039786-fixed", product_identification_helper: { cpe: "cpe:/a:adobe:creative_cloud:bridge__14.1.4", }, }, }, { category: "product_version_range", name: "Bridge <15.0.1", product: { name: "Adobe Creative Cloud Bridge <15.0.1", product_id: "T039787", }, }, { category: "product_version", name: "Bridge 15.0.1", product: { name: "Adobe Creative Cloud Bridge 15.0.1", product_id: "T039787-fixed", product_identification_helper: { cpe: "cpe:/a:adobe:creative_cloud:bridge__15.0.1", }, }, }, { category: "product_version_range", name: "Premiere Pro <25.1", product: { name: "Adobe Creative Cloud Premiere Pro <25.1", product_id: "T039790", }, }, { category: "product_version", name: "Premiere Pro 25.1", product: { name: "Adobe Creative Cloud Premiere Pro 25.1", product_id: "T039790-fixed", product_identification_helper: { cpe: "cpe:/a:adobe:creative_cloud:premiere_pro__25.1", }, }, }, { category: "product_version_range", name: "Premiere Pro <24.6.4", product: { name: "Adobe Creative Cloud Premiere Pro <24.6.4", product_id: "T039791", }, }, { category: "product_version", name: "Premiere Pro 24.6.4", product: { name: "Adobe Creative Cloud Premiere Pro 24.6.4", product_id: "T039791-fixed", product_identification_helper: { cpe: "cpe:/a:adobe:creative_cloud:premiere_pro__24.6.4", }, }, }, { category: "product_version_range", name: "Substance 3D Painter <10.1.2", product: { name: "Adobe Creative Cloud Substance 3D Painter <10.1.2", product_id: "T039793", }, }, { category: "product_version", name: "Substance 3D Painter 10.1.2", product: { name: "Adobe Creative Cloud Substance 3D Painter 10.1.2", product_id: "T039793-fixed", product_identification_helper: { cpe: "cpe:/a:adobe:creative_cloud:substance_3d_painter__10.1.2", }, }, }, ], category: "product_name", name: "Creative Cloud", }, ], category: "vendor", name: "Adobe", }, ], }, vulnerabilities: [ { cve: "CVE-2024-52994", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Substance 3D Sampler. Diese Schwachstellen bestehen aufgrund von Out-of-bounds Write und Heap-basierten Pufferüberläufen. Ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039775", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-52994", }, { cve: "CVE-2024-52995", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Substance 3D Sampler. Diese Schwachstellen bestehen aufgrund von Out-of-bounds Write und Heap-basierten Pufferüberläufen. Ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039775", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-52995", }, { cve: "CVE-2024-52996", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Substance 3D Sampler. Diese Schwachstellen bestehen aufgrund von Out-of-bounds Write und Heap-basierten Pufferüberläufen. Ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039775", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-52996", }, { cve: "CVE-2024-49551", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Media Encoder. Diese Schwachstellen bestehen aufgrund von Out-of-bounds Write, Heap-basiertem Pufferüberlauf und einem Null-Pointer-Dereferenz-Problem. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039759", "T039758", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-49551", }, { cve: "CVE-2024-49552", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Media Encoder. Diese Schwachstellen bestehen aufgrund von Out-of-bounds Write, Heap-basiertem Pufferüberlauf und einem Null-Pointer-Dereferenz-Problem. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039759", "T039758", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-49552", }, { cve: "CVE-2024-49553", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Media Encoder. Diese Schwachstellen bestehen aufgrund von Out-of-bounds Write, Heap-basiertem Pufferüberlauf und einem Null-Pointer-Dereferenz-Problem. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039759", "T039758", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-49553", }, { cve: "CVE-2024-49554", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Media Encoder. Diese Schwachstellen bestehen aufgrund von Out-of-bounds Write, Heap-basiertem Pufferüberlauf und einem Null-Pointer-Dereferenz-Problem. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039759", "T039758", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-49554", }, { cve: "CVE-2024-49538", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Illustrator. Diese Schwachstellen bestehen aufgrund von Out-of-bounds-Write- und Heap-basierten Pufferüberläufen. Ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039760", "T039761", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-49538", }, { cve: "CVE-2024-49541", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Illustrator. Diese Schwachstellen bestehen aufgrund von Out-of-bounds-Write- und Heap-basierten Pufferüberläufen. Ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039760", "T039761", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-49541", }, { cve: "CVE-2024-49537", notes: [ { category: "description", text: "Es besteht eine Schwachstelle in Adobe Creative Cloud After Effects aufgrund eines stapelbasierten Pufferüberlaufs. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039766", "T039767", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-49537", }, { cve: "CVE-2024-45155", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Animate. Diese Schwachstellen sind auf verschiedene Sicherheitsprobleme zurückzuführen, darunter Out-of-bounds Write, Heap-basierter Pufferüberlauf und Integer Underflow. Ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039769", "T039768", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-45155", }, { cve: "CVE-2024-45156", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Animate. Diese Schwachstellen sind auf verschiedene Sicherheitsprobleme zurückzuführen, darunter Out-of-bounds Write, Heap-basierter Pufferüberlauf und Integer Underflow. Ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039769", "T039768", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-45156", }, { cve: "CVE-2024-52982", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Animate. Diese Schwachstellen sind auf verschiedene Sicherheitsprobleme zurückzuführen, darunter Out-of-bounds Write, Heap-basierter Pufferüberlauf und Integer Underflow. Ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039769", "T039768", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-52982", }, { cve: "CVE-2024-52983", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Animate. Diese Schwachstellen sind auf verschiedene Sicherheitsprobleme zurückzuführen, darunter Out-of-bounds Write, Heap-basierter Pufferüberlauf und Integer Underflow. Ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039769", "T039768", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-52983", }, { cve: "CVE-2024-52984", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Animate. Diese Schwachstellen sind auf verschiedene Sicherheitsprobleme zurückzuführen, darunter Out-of-bounds Write, Heap-basierter Pufferüberlauf und Integer Underflow. Ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039769", "T039768", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-52984", }, { cve: "CVE-2024-52985", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Animate. Diese Schwachstellen sind auf verschiedene Sicherheitsprobleme zurückzuführen, darunter Out-of-bounds Write, Heap-basierter Pufferüberlauf und Integer Underflow. Ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039769", "T039768", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-52985", }, { cve: "CVE-2024-52986", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Animate. Diese Schwachstellen sind auf verschiedene Sicherheitsprobleme zurückzuführen, darunter Out-of-bounds Write, Heap-basierter Pufferüberlauf und Integer Underflow. Ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039769", "T039768", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-52986", }, { cve: "CVE-2024-52987", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Animate. Diese Schwachstellen sind auf verschiedene Sicherheitsprobleme zurückzuführen, darunter Out-of-bounds Write, Heap-basierter Pufferüberlauf und Integer Underflow. Ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039769", "T039768", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-52987", }, { cve: "CVE-2024-52988", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Animate. Diese Schwachstellen sind auf verschiedene Sicherheitsprobleme zurückzuführen, darunter Out-of-bounds Write, Heap-basierter Pufferüberlauf und Integer Underflow. Ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039769", "T039768", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-52988", }, { cve: "CVE-2024-52989", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Animate. Diese Schwachstellen sind auf verschiedene Sicherheitsprobleme zurückzuführen, darunter Out-of-bounds Write, Heap-basierter Pufferüberlauf und Integer Underflow. Ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039769", "T039768", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-52989", }, { cve: "CVE-2024-52990", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Animate. Diese Schwachstellen sind auf verschiedene Sicherheitsprobleme zurückzuführen, darunter Out-of-bounds Write, Heap-basierter Pufferüberlauf und Integer Underflow. Ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039769", "T039768", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-52990", }, { cve: "CVE-2024-53953", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Animate. Diese Schwachstellen sind auf verschiedene Sicherheitsprobleme zurückzuführen, darunter Out-of-bounds Write, Heap-basierter Pufferüberlauf und Integer Underflow. Ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039769", "T039768", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-53953", }, { cve: "CVE-2024-53954", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Animate. Diese Schwachstellen sind auf verschiedene Sicherheitsprobleme zurückzuführen, darunter Out-of-bounds Write, Heap-basierter Pufferüberlauf und Integer Underflow. Ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039769", "T039768", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-53954", }, { cve: "CVE-2024-49543", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud InDesign. Diese Schwachstellen bestehen aufgrund verschiedener Sicherheitsprobleme, darunter Out-of-bounds Write und Read, Stack-based Buffer Overflow und eine NULL Pointer Dereference. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039771", "T039770", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-49543", }, { cve: "CVE-2024-49544", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud InDesign. Diese Schwachstellen bestehen aufgrund verschiedener Sicherheitsprobleme, darunter Out-of-bounds Write und Read, Stack-based Buffer Overflow und eine NULL Pointer Dereference. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039771", "T039770", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-49544", }, { cve: "CVE-2024-49545", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud InDesign. Diese Schwachstellen bestehen aufgrund verschiedener Sicherheitsprobleme, darunter Out-of-bounds Write und Read, Stack-based Buffer Overflow und eine NULL Pointer Dereference. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039771", "T039770", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-49545", }, { cve: "CVE-2024-49546", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud InDesign. Diese Schwachstellen bestehen aufgrund verschiedener Sicherheitsprobleme, darunter Out-of-bounds Write und Read, Stack-based Buffer Overflow und eine NULL Pointer Dereference. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039771", "T039770", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-49546", }, { cve: "CVE-2024-49547", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud InDesign. Diese Schwachstellen bestehen aufgrund verschiedener Sicherheitsprobleme, darunter Out-of-bounds Write und Read, Stack-based Buffer Overflow und eine NULL Pointer Dereference. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039771", "T039770", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-49547", }, { cve: "CVE-2024-49548", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud InDesign. Diese Schwachstellen bestehen aufgrund verschiedener Sicherheitsprobleme, darunter Out-of-bounds Write und Read, Stack-based Buffer Overflow und eine NULL Pointer Dereference. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039771", "T039770", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-49548", }, { cve: "CVE-2024-49549", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud InDesign. Diese Schwachstellen bestehen aufgrund verschiedener Sicherheitsprobleme, darunter Out-of-bounds Write und Read, Stack-based Buffer Overflow und eine NULL Pointer Dereference. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039771", "T039770", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-49549", }, { cve: "CVE-2024-53951", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud InDesign. Diese Schwachstellen bestehen aufgrund verschiedener Sicherheitsprobleme, darunter Out-of-bounds Write und Read, Stack-based Buffer Overflow und eine NULL Pointer Dereference. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039771", "T039770", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-53951", }, { cve: "CVE-2024-53952", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud InDesign. Diese Schwachstellen bestehen aufgrund verschiedener Sicherheitsprobleme, darunter Out-of-bounds Write und Read, Stack-based Buffer Overflow und eine NULL Pointer Dereference. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039771", "T039770", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-53952", }, { cve: "CVE-2024-49513", notes: [ { category: "description", text: "Es besteht eine Schwachstelle in Adobe Creative Cloud PDFL Software Development Kit (SDK) aufgrund eines Out-of-bounds Write-Problems. Ein lokaler Angreifer kann diese Schwachstelle zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039772", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-49513", }, { cve: "CVE-2024-49550", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-49550", }, { cve: "CVE-2024-54032", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-54032", }, { cve: "CVE-2024-54033", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-54033", }, { cve: "CVE-2024-54034", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-54034", }, { cve: "CVE-2024-54035", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-54035", }, { cve: "CVE-2024-54036", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-54036", }, { cve: "CVE-2024-54037", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-54037", }, { cve: "CVE-2024-54038", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-54038", }, { cve: "CVE-2024-54039", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-54039", }, { cve: "CVE-2024-54040", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-54040", }, { cve: "CVE-2024-54041", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-54041", }, { cve: "CVE-2024-54042", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-54042", }, { cve: "CVE-2024-54043", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-54043", }, { cve: "CVE-2024-54044", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-54044", }, { cve: "CVE-2024-54045", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-54045", }, { cve: "CVE-2024-54046", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-54046", }, { cve: "CVE-2024-54047", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-54047", }, { cve: "CVE-2024-54048", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-54048", }, { cve: "CVE-2024-54049", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-54049", }, { cve: "CVE-2024-54050", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-54050", }, { cve: "CVE-2024-54051", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-54051", }, { cve: "CVE-2024-54052", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Connect. Diese Schwachstellen sind auf verschiedene Sicherheitslücken zurückzuführen, darunter unsachgemäße Zugriffskontrolle und Reflected XSS-Probleme. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039773", "T039774", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-54052", }, { cve: "CVE-2024-52833", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Substance 3D Modeler. Diese Schwachstellen bestehen aufgrund verschiedener Sicherheitsprobleme, darunter Out-of-bounds Writes und Reads, Heap-basierte Pufferüberläufe und eine NULL-Zeiger-Dereferenz. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktio", }, ], product_status: { known_affected: [ "T039785", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-52833", }, { cve: "CVE-2024-52999", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Substance 3D Modeler. Diese Schwachstellen bestehen aufgrund verschiedener Sicherheitsprobleme, darunter Out-of-bounds Writes und Reads, Heap-basierte Pufferüberläufe und eine NULL-Zeiger-Dereferenz. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktio", }, ], product_status: { known_affected: [ "T039785", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-52999", }, { cve: "CVE-2024-53000", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Substance 3D Modeler. Diese Schwachstellen bestehen aufgrund verschiedener Sicherheitsprobleme, darunter Out-of-bounds Writes und Reads, Heap-basierte Pufferüberläufe und eine NULL-Zeiger-Dereferenz. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktio", }, ], product_status: { known_affected: [ "T039785", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-53000", }, { cve: "CVE-2024-53001", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Substance 3D Modeler. Diese Schwachstellen bestehen aufgrund verschiedener Sicherheitsprobleme, darunter Out-of-bounds Writes und Reads, Heap-basierte Pufferüberläufe und eine NULL-Zeiger-Dereferenz. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktio", }, ], product_status: { known_affected: [ "T039785", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-53001", }, { cve: "CVE-2024-53002", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Substance 3D Modeler. Diese Schwachstellen bestehen aufgrund verschiedener Sicherheitsprobleme, darunter Out-of-bounds Writes und Reads, Heap-basierte Pufferüberläufe und eine NULL-Zeiger-Dereferenz. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktio", }, ], product_status: { known_affected: [ "T039785", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-53002", }, { cve: "CVE-2024-53003", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Substance 3D Modeler. Diese Schwachstellen bestehen aufgrund verschiedener Sicherheitsprobleme, darunter Out-of-bounds Writes und Reads, Heap-basierte Pufferüberläufe und eine NULL-Zeiger-Dereferenz. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktio", }, ], product_status: { known_affected: [ "T039785", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-53003", }, { cve: "CVE-2024-53004", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Substance 3D Modeler. Diese Schwachstellen bestehen aufgrund verschiedener Sicherheitsprobleme, darunter Out-of-bounds Writes und Reads, Heap-basierte Pufferüberläufe und eine NULL-Zeiger-Dereferenz. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktio", }, ], product_status: { known_affected: [ "T039785", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-53004", }, { cve: "CVE-2024-53005", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Substance 3D Modeler. Diese Schwachstellen bestehen aufgrund verschiedener Sicherheitsprobleme, darunter Out-of-bounds Writes und Reads, Heap-basierte Pufferüberläufe und eine NULL-Zeiger-Dereferenz. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktio", }, ], product_status: { known_affected: [ "T039785", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-53005", }, { cve: "CVE-2024-53006", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Substance 3D Modeler. Diese Schwachstellen bestehen aufgrund verschiedener Sicherheitsprobleme, darunter Out-of-bounds Writes und Reads, Heap-basierte Pufferüberläufe und eine NULL-Zeiger-Dereferenz. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktio", }, ], product_status: { known_affected: [ "T039785", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-53006", }, { cve: "CVE-2024-53007", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Substance 3D Modeler. Diese Schwachstellen bestehen aufgrund verschiedener Sicherheitsprobleme, darunter Out-of-bounds Writes und Reads, Heap-basierte Pufferüberläufe und eine NULL-Zeiger-Dereferenz. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen und einen Denial-of-Service-Zustand zu erzeugen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktio", }, ], product_status: { known_affected: [ "T039785", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-53007", }, { cve: "CVE-2024-53955", notes: [ { category: "description", text: "Es besteht eine Schwachstelle in Adobe Creative Cloud Bridge aufgrund eines Integer-Underflow-Problems. Ein lokaler Angreifer kann diese Schwachstelle zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039787", "T039786", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-53955", }, { cve: "CVE-2024-53956", notes: [ { category: "description", text: "Es besteht eine Schwachstelle in Adobe Creative Cloud Premiere Pro aufgrund eines Heap-basierten Pufferüberlaufproblems. Ein lokaler Angreifer kann diese Schwachstelle zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039791", "T039790", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-53956", }, { cve: "CVE-2024-53957", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Substance 3D Painter. Diese Schwachstellen bestehen aufgrund eines Out-of-bounds Write und eines Heap-basierten Pufferüberlaufs. Ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039793", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-53957", }, { cve: "CVE-2024-53958", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Adobe Creative Cloud Substance 3D Painter. Diese Schwachstellen bestehen aufgrund eines Out-of-bounds Write und eines Heap-basierten Pufferüberlaufs. Ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T039793", ], }, release_date: "2024-12-10T23:00:00.000+00:00", title: "CVE-2024-53958", }, ], }
CVE-2024-49513 (GCVE-0-2024-49513)
Vulnerability from cvelistv5
Published
2024-12-10 20:57
Modified
2024-12-16 16:36
Severity ?
EPSS score ?
Summary
PDFL SDK versions 21.0.0.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/pdfl-sdk1/apsb24-98.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Not a product |
Version: 0 ≤ 21.0.0.5 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-49513", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-10T21:24:58.573279Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-10T21:25:08.246Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Not a product", vendor: "Adobe", versions: [ { lessThanOrEqual: "21.0.0.5", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "PDFL SDK versions 21.0.0.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-787", description: "Out-of-bounds Write (CWE-787)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-16T16:36:38.059Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/pdfl-sdk1/apsb24-98.html", }, ], source: { discovery: "EXTERNAL", }, title: "Not a product | Out-of-bounds Write (CWE-787)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-49513", datePublished: "2024-12-10T20:57:57.480Z", dateReserved: "2024-10-15T15:35:47.027Z", dateUpdated: "2024-12-16T16:36:38.059Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-53004 (GCVE-0-2024-53004)
Vulnerability from cvelistv5
Published
2024-12-10 21:12
Modified
2024-12-11 14:49
Severity ?
EPSS score ?
Summary
Substance3D - Modeler versions 1.14.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/substance3d-modeler/apsb24-102.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Substance3D - Modeler |
Version: 0 ≤ 1.14.1 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-53004", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:39:49.597855Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:49:52.695Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Substance3D - Modeler", vendor: "Adobe", versions: [ { lessThanOrEqual: "1.14.1", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Substance3D - Modeler versions 1.14.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 5.5, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "NONE", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "NONE", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 5.5, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-125", description: "Out-of-bounds Read (CWE-125)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T21:12:22.044Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/substance3d-modeler/apsb24-102.html", }, ], source: { discovery: "EXTERNAL", }, title: "Substance3D - Modeler | Out-of-bounds Read (CWE-125)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-53004", datePublished: "2024-12-10T21:12:22.044Z", dateReserved: "2024-11-18T17:46:25.286Z", dateUpdated: "2024-12-11T14:49:52.695Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-53951 (GCVE-0-2024-53951)
Vulnerability from cvelistv5
Published
2024-12-10 20:51
Modified
2024-12-10 21:25
Severity ?
EPSS score ?
Summary
InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/indesign/apsb24-97.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | InDesign Desktop |
Version: 0 ≤ ID18.5.4 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-53951", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-10T21:25:23.094643Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-10T21:25:32.938Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "InDesign Desktop", vendor: "Adobe", versions: [ { lessThanOrEqual: "ID18.5.4", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 5.5, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "NONE", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "NONE", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 5.5, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-125", description: "Out-of-bounds Read (CWE-125)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:51:12.608Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/indesign/apsb24-97.html", }, ], source: { discovery: "EXTERNAL", }, title: "InDesign Desktop | Out-of-bounds Read (CWE-125)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-53951", datePublished: "2024-12-10T20:51:12.608Z", dateReserved: "2024-11-25T17:39:04.107Z", dateUpdated: "2024-12-10T21:25:32.938Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-45156 (GCVE-0-2024-45156)
Vulnerability from cvelistv5
Published
2024-12-10 20:27
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
Animate versions 23.0.8, 24.0.5 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/animate/apsb24-96.html | vendor-advisory |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-45156", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:42.117Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Animate", vendor: "Adobe", versions: [ { lessThanOrEqual: "24.0.5", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Animate versions 23.0.8, 24.0.5 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-476", description: "NULL Pointer Dereference (CWE-476)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:27:47.634Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/animate/apsb24-96.html", }, ], source: { discovery: "EXTERNAL", }, title: "Animate | NULL Pointer Dereference (CWE-476)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-45156", datePublished: "2024-12-10T20:27:47.634Z", dateReserved: "2024-08-21T23:00:59.354Z", dateUpdated: "2024-12-17T04:55:42.117Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-54048 (GCVE-0-2024-54048)
Vulnerability from cvelistv5
Published
2024-12-10 20:42
Modified
2025-01-07 18:52
Severity ?
EPSS score ?
Summary
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/connect/apsb24-99.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Adobe Connect |
Version: 0 ≤ 11.4.7 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-54048", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-10T21:03:57.368280Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-10T21:04:06.434Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Adobe Connect", vendor: "Adobe", versions: [ { lessThanOrEqual: "11.4.7", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 6.1, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "LOW", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "NETWORK", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "LOW", modifiedIntegrityImpact: "LOW", modifiedPrivilegesRequired: "NONE", modifiedScope: "CHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "CHANGED", temporalScore: 6.1, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-79", description: "Cross-site Scripting (Reflected XSS) (CWE-79)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-07T18:52:13.405Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/connect/apsb24-99.html", }, ], source: { discovery: "EXTERNAL", }, title: "Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-54048", datePublished: "2024-12-10T20:42:21.420Z", dateReserved: "2024-11-27T16:21:41.944Z", dateUpdated: "2025-01-07T18:52:13.405Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-54051 (GCVE-0-2024-54051)
Vulnerability from cvelistv5
Published
2024-12-10 20:42
Modified
2025-01-07 18:54
Severity ?
EPSS score ?
Summary
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/connect/apsb24-99.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Adobe Connect |
Version: 0 ≤ 11.4.7 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-54051", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:42:39.360292Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:42:51.563Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Adobe Connect", vendor: "Adobe", versions: [ { lessThanOrEqual: "11.4.7", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 6.1, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "LOW", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "NETWORK", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "LOW", modifiedIntegrityImpact: "LOW", modifiedPrivilegesRequired: "NONE", modifiedScope: "CHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "CHANGED", temporalScore: 6.1, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-601", description: "URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-07T18:54:17.664Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/connect/apsb24-99.html", }, ], source: { discovery: "EXTERNAL", }, title: "Adobe Connect | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-54051", datePublished: "2024-12-10T20:42:13.399Z", dateReserved: "2024-11-27T16:21:41.945Z", dateUpdated: "2025-01-07T18:54:17.664Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-49544 (GCVE-0-2024-49544)
Vulnerability from cvelistv5
Published
2024-12-10 20:51
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/indesign/apsb24-97.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | InDesign Desktop |
Version: 0 ≤ ID18.5.4 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-49544", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:47.144Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "InDesign Desktop", vendor: "Adobe", versions: [ { lessThanOrEqual: "ID18.5.4", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-787", description: "Out-of-bounds Write (CWE-787)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:51:08.861Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/indesign/apsb24-97.html", }, ], source: { discovery: "EXTERNAL", }, title: "InDesign Desktop | Out-of-bounds Write (CWE-787)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-49544", datePublished: "2024-12-10T20:51:08.861Z", dateReserved: "2024-10-15T15:35:47.037Z", dateUpdated: "2024-12-17T04:55:47.144Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-52833 (GCVE-0-2024-52833)
Vulnerability from cvelistv5
Published
2024-12-10 21:12
Modified
2024-12-11 14:49
Severity ?
EPSS score ?
Summary
Substance3D - Modeler versions 1.14.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/substance3d-modeler/apsb24-102.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Substance3D - Modeler |
Version: 0 ≤ 1.14.1 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-52833", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:39:46.763521Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:49:37.511Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Substance3D - Modeler", vendor: "Adobe", versions: [ { lessThanOrEqual: "1.14.1", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Substance3D - Modeler versions 1.14.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 5.5, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "NONE", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "NONE", modifiedIntegrityImpact: "NONE", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 5.5, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-476", description: "NULL Pointer Dereference (CWE-476)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T21:12:23.405Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/substance3d-modeler/apsb24-102.html", }, ], source: { discovery: "EXTERNAL", }, title: "Substance3D - Modeler | NULL Pointer Dereference (CWE-476)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-52833", datePublished: "2024-12-10T21:12:23.405Z", dateReserved: "2024-11-15T18:03:25.997Z", dateUpdated: "2024-12-11T14:49:37.511Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-52984 (GCVE-0-2024-52984)
Vulnerability from cvelistv5
Published
2024-12-10 20:27
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/animate/apsb24-96.html | vendor-advisory |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-52984", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:31.217Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Animate", vendor: "Adobe", versions: [ { lessThanOrEqual: "24.0.5", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-191", description: "Integer Underflow (Wrap or Wraparound) (CWE-191)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:27:40.652Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/animate/apsb24-96.html", }, ], source: { discovery: "EXTERNAL", }, title: "Animate | Integer Underflow (Wrap or Wraparound) (CWE-191)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-52984", datePublished: "2024-12-10T20:27:40.652Z", dateReserved: "2024-11-18T17:46:25.279Z", dateUpdated: "2024-12-17T04:55:31.217Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-54034 (GCVE-0-2024-54034)
Vulnerability from cvelistv5
Published
2024-12-10 20:42
Modified
2025-01-16 17:36
Severity ?
EPSS score ?
Summary
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/connect/apsb24-99.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Adobe Connect |
Version: 0 ≤ 11.4.7 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-54034", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:50.888Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Adobe Connect", vendor: "Adobe", versions: [ { lessThanOrEqual: "11.4.7", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 9.3, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 9.3, environmentalSeverity: "CRITICAL", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "NETWORK", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "CHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "CHANGED", temporalScore: 9.3, temporalSeverity: "CRITICAL", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-79", description: "Cross-site Scripting (Reflected XSS) (CWE-79)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-16T17:36:33.545Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/connect/apsb24-99.html", }, ], source: { discovery: "EXTERNAL", }, title: "Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-54034", datePublished: "2024-12-10T20:42:11.085Z", dateReserved: "2024-11-27T16:21:41.942Z", dateUpdated: "2025-01-16T17:36:33.545Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-53954 (GCVE-0-2024-53954)
Vulnerability from cvelistv5
Published
2024-12-10 20:27
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/animate/apsb24-96.html | vendor-advisory |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-53954", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:44.535Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Animate", vendor: "Adobe", versions: [ { lessThanOrEqual: "24.0.5", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-191", description: "Integer Underflow (Wrap or Wraparound) (CWE-191)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:27:42.953Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/animate/apsb24-96.html", }, ], source: { discovery: "EXTERNAL", }, title: "Animate | Integer Underflow (Wrap or Wraparound) (CWE-191)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-53954", datePublished: "2024-12-10T20:27:42.953Z", dateReserved: "2024-11-25T17:39:04.108Z", dateUpdated: "2024-12-17T04:55:44.535Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-49537 (GCVE-0-2024-49537)
Vulnerability from cvelistv5
Published
2024-12-10 20:13
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
After Effects versions 24.6.2, 25.0.1 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/after_effects/apsb24-95.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | After Effects |
Version: 0 ≤ 25.0.1 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-49537", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:27.486Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "After Effects", vendor: "Adobe", versions: [ { lessThanOrEqual: "25.0.1", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "After Effects versions 24.6.2, 25.0.1 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-121", description: "Stack-based Buffer Overflow (CWE-121)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:13:24.092Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/after_effects/apsb24-95.html", }, ], source: { discovery: "EXTERNAL", }, title: "After Effects | Stack-based Buffer Overflow (CWE-121)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-49537", datePublished: "2024-12-10T20:13:24.092Z", dateReserved: "2024-10-15T15:35:47.031Z", dateUpdated: "2024-12-17T04:55:27.486Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-54038 (GCVE-0-2024-54038)
Vulnerability from cvelistv5
Published
2024-12-10 20:42
Modified
2025-01-07 18:30
Severity ?
EPSS score ?
Summary
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confidentiality. Exploitation of this issue does not require user interaction.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/connect/apsb24-99.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Adobe Connect |
Version: 0 ≤ 11.4.7 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-54038", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:43:50.666052Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:44:04.609Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Adobe Connect", vendor: "Adobe", versions: [ { lessThanOrEqual: "11.4.7", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Adobe Connect versions 12.6, 11.4.7 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confidentiality. Exploitation of this issue does not require user interaction.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 4.3, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 4.3, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "NONE", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "NETWORK", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "LOW", modifiedIntegrityImpact: "NONE", modifiedPrivilegesRequired: "LOW", modifiedScope: "UNCHANGED", modifiedUserInteraction: "NONE", privilegesRequired: "LOW", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 4.3, temporalSeverity: "MEDIUM", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-284", description: "Improper Access Control (CWE-284)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-07T18:30:05.883Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/connect/apsb24-99.html", }, ], source: { discovery: "EXTERNAL", }, title: "Adobe Connect | Improper Access Control (CWE-284)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-54038", datePublished: "2024-12-10T20:42:07.558Z", dateReserved: "2024-11-27T16:21:41.943Z", dateUpdated: "2025-01-07T18:30:05.883Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-54043 (GCVE-0-2024-54043)
Vulnerability from cvelistv5
Published
2024-12-10 20:42
Modified
2025-01-07 18:37
Severity ?
EPSS score ?
Summary
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/connect/apsb24-99.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Adobe Connect |
Version: 0 ≤ 11.4.7 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-54043", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-10T21:30:13.242064Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-10T21:30:18.967Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Adobe Connect", vendor: "Adobe", versions: [ { lessThanOrEqual: "11.4.7", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 6.1, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "LOW", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "NETWORK", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "LOW", modifiedIntegrityImpact: "LOW", modifiedPrivilegesRequired: "NONE", modifiedScope: "CHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "CHANGED", temporalScore: 6.1, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-79", description: "Cross-site Scripting (Reflected XSS) (CWE-79)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-07T18:37:36.860Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/connect/apsb24-99.html", }, ], source: { discovery: "EXTERNAL", }, title: "Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-54043", datePublished: "2024-12-10T20:42:17.843Z", dateReserved: "2024-11-27T16:21:41.943Z", dateUpdated: "2025-01-07T18:37:36.860Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-54047 (GCVE-0-2024-54047)
Vulnerability from cvelistv5
Published
2024-12-10 20:42
Modified
2025-01-07 18:45
Severity ?
EPSS score ?
Summary
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/connect/apsb24-99.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Adobe Connect |
Version: 0 ≤ 11.4.7 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-54047", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:43:05.339188Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:43:19.242Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Adobe Connect", vendor: "Adobe", versions: [ { lessThanOrEqual: "11.4.7", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 6.1, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "LOW", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "NETWORK", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "LOW", modifiedIntegrityImpact: "LOW", modifiedPrivilegesRequired: "NONE", modifiedScope: "CHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "CHANGED", temporalScore: 6.1, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-79", description: "Cross-site Scripting (Reflected XSS) (CWE-79)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-07T18:45:04.662Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/connect/apsb24-99.html", }, ], source: { discovery: "EXTERNAL", }, title: "Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-54047", datePublished: "2024-12-10T20:42:08.329Z", dateReserved: "2024-11-27T16:21:41.944Z", dateUpdated: "2025-01-07T18:45:04.662Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-52985 (GCVE-0-2024-52985)
Vulnerability from cvelistv5
Published
2024-12-10 20:27
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/animate/apsb24-96.html | vendor-advisory |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-52985", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:32.636Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Animate", vendor: "Adobe", versions: [ { lessThanOrEqual: "24.0.5", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-191", description: "Integer Underflow (Wrap or Wraparound) (CWE-191)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:27:49.979Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/animate/apsb24-96.html", }, ], source: { discovery: "EXTERNAL", }, title: "Animate | Integer Underflow (Wrap or Wraparound) (CWE-191)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-52985", datePublished: "2024-12-10T20:27:49.979Z", dateReserved: "2024-11-18T17:46:25.279Z", dateUpdated: "2024-12-17T04:55:32.636Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-54049 (GCVE-0-2024-54049)
Vulnerability from cvelistv5
Published
2024-12-10 20:42
Modified
2024-12-11 14:39
Severity ?
EPSS score ?
Summary
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/connect/apsb24-99.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Adobe Connect |
Version: 0 ≤ 11.4.7 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-54049", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:39:09.935634Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:39:24.393Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Adobe Connect", vendor: "Adobe", versions: [ { lessThanOrEqual: "11.4.7", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 6.1, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "LOW", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "NETWORK", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "LOW", modifiedIntegrityImpact: "LOW", modifiedPrivilegesRequired: "NONE", modifiedScope: "CHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "CHANGED", temporalScore: 6.1, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-79", description: "Cross-site Scripting (Reflected XSS) (CWE-79)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:42:16.221Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/connect/apsb24-99.html", }, ], source: { discovery: "EXTERNAL", }, title: "Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-54049", datePublished: "2024-12-10T20:42:16.221Z", dateReserved: "2024-11-27T16:21:41.945Z", dateUpdated: "2024-12-11T14:39:24.393Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-54050 (GCVE-0-2024-54050)
Vulnerability from cvelistv5
Published
2024-12-10 20:42
Modified
2025-01-07 18:54
Severity ?
EPSS score ?
Summary
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/connect/apsb24-99.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Adobe Connect |
Version: 0 ≤ 11.4.7 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-54050", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-10T21:19:34.533891Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-10T21:19:43.269Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Adobe Connect", vendor: "Adobe", versions: [ { lessThanOrEqual: "11.4.7", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 6.1, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "LOW", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "NETWORK", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "LOW", modifiedIntegrityImpact: "LOW", modifiedPrivilegesRequired: "NONE", modifiedScope: "CHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "CHANGED", temporalScore: 6.1, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-601", description: "URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-07T18:54:08.511Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/connect/apsb24-99.html", }, ], source: { discovery: "EXTERNAL", }, title: "Adobe Connect | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-54050", datePublished: "2024-12-10T20:42:20.227Z", dateReserved: "2024-11-27T16:21:41.945Z", dateUpdated: "2025-01-07T18:54:08.511Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-49543 (GCVE-0-2024-49543)
Vulnerability from cvelistv5
Published
2024-12-10 20:51
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/indesign/apsb24-97.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | InDesign Desktop |
Version: 0 ≤ ID18.5.4 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-49543", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:45.924Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "InDesign Desktop", vendor: "Adobe", versions: [ { lessThanOrEqual: "ID18.5.4", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-121", description: "Stack-based Buffer Overflow (CWE-121)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:51:05.465Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/indesign/apsb24-97.html", }, ], source: { discovery: "EXTERNAL", }, title: "InDesign Desktop | Stack-based Buffer Overflow (CWE-121)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-49543", datePublished: "2024-12-10T20:51:05.465Z", dateReserved: "2024-10-15T15:35:47.037Z", dateUpdated: "2024-12-17T04:55:45.924Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-52982 (GCVE-0-2024-52982)
Vulnerability from cvelistv5
Published
2024-12-10 20:27
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
Animate versions 23.0.8, 24.0.5 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/animate/apsb24-96.html | vendor-advisory |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-52982", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:28.686Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Animate", vendor: "Adobe", versions: [ { lessThanOrEqual: "24.0.5", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Animate versions 23.0.8, 24.0.5 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-20", description: "Improper Input Validation (CWE-20)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:27:46.835Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/animate/apsb24-96.html", }, ], source: { discovery: "EXTERNAL", }, title: "Animate | Improper Input Validation (CWE-20)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-52982", datePublished: "2024-12-10T20:27:46.835Z", dateReserved: "2024-11-18T17:46:25.279Z", dateUpdated: "2024-12-17T04:55:28.686Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-52996 (GCVE-0-2024-52996)
Vulnerability from cvelistv5
Published
2024-12-10 21:02
Modified
2024-12-10 21:21
Severity ?
EPSS score ?
Summary
Substance3D - Sampler versions 4.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/substance3d-sampler/apsb24-100.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Substance3D - Sampler |
Version: 0 ≤ 4.5.1 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-52996", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-10T21:21:18.733043Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-10T21:21:27.201Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Substance3D - Sampler", vendor: "Adobe", versions: [ { lessThanOrEqual: "4.5.1", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Substance3D - Sampler versions 4.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-122", description: "Heap-based Buffer Overflow (CWE-122)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T21:02:47.288Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/substance3d-sampler/apsb24-100.html", }, ], source: { discovery: "EXTERNAL", }, title: "Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-52996", datePublished: "2024-12-10T21:02:47.288Z", dateReserved: "2024-11-18T17:46:25.283Z", dateUpdated: "2024-12-10T21:21:27.201Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-53000 (GCVE-0-2024-53000)
Vulnerability from cvelistv5
Published
2024-12-10 21:12
Modified
2024-12-11 14:50
Severity ?
EPSS score ?
Summary
Substance3D - Modeler versions 1.14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/substance3d-modeler/apsb24-102.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Substance3D - Modeler |
Version: 0 ≤ 1.14.1 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-53000", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:42:57.087316Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:50:12.966Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Substance3D - Modeler", vendor: "Adobe", versions: [ { lessThanOrEqual: "1.14.1", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Substance3D - Modeler versions 1.14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-787", description: "Out-of-bounds Write (CWE-787)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T21:12:20.578Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/substance3d-modeler/apsb24-102.html", }, ], source: { discovery: "EXTERNAL", }, title: "Substance3D - Modeler | Out-of-bounds Write (CWE-787)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-53000", datePublished: "2024-12-10T21:12:20.578Z", dateReserved: "2024-11-18T17:46:25.285Z", dateUpdated: "2024-12-11T14:50:12.966Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-52999 (GCVE-0-2024-52999)
Vulnerability from cvelistv5
Published
2024-12-10 21:12
Modified
2024-12-11 14:50
Severity ?
EPSS score ?
Summary
Substance3D - Modeler versions 1.14.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/substance3d-modeler/apsb24-102.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Substance3D - Modeler |
Version: 0 ≤ 1.14.1 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-52999", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:43:05.511054Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:50:53.505Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Substance3D - Modeler", vendor: "Adobe", versions: [ { lessThanOrEqual: "1.14.1", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Substance3D - Modeler versions 1.14.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-122", description: "Heap-based Buffer Overflow (CWE-122)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T21:12:16.182Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/substance3d-modeler/apsb24-102.html", }, ], source: { discovery: "EXTERNAL", }, title: "Substance3D - Modeler | Heap-based Buffer Overflow (CWE-122)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-52999", datePublished: "2024-12-10T21:12:16.182Z", dateReserved: "2024-11-18T17:46:25.284Z", dateUpdated: "2024-12-11T14:50:53.505Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-53956 (GCVE-0-2024-53956)
Vulnerability from cvelistv5
Published
2024-12-10 21:18
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
Premiere Pro versions 25.0, 24.6.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/premiere_pro/apsb24-104.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Premiere Pro |
Version: 0 ≤ 24.6.3 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-53956", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:56.183Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Premiere Pro", vendor: "Adobe", versions: [ { lessThanOrEqual: "24.6.3", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Premiere Pro versions 25.0, 24.6.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-122", description: "Heap-based Buffer Overflow (CWE-122)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T21:18:08.121Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/premiere_pro/apsb24-104.html", }, ], source: { discovery: "EXTERNAL", }, title: "Premiere Pro | Heap-based Buffer Overflow (CWE-122)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-53956", datePublished: "2024-12-10T21:18:08.121Z", dateReserved: "2024-11-25T17:39:04.108Z", dateUpdated: "2024-12-17T04:55:56.183Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-53955 (GCVE-0-2024-53955)
Vulnerability from cvelistv5
Published
2024-12-10 21:15
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
Bridge versions 14.1.3, 15.0 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/bridge/apsb24-103.html | vendor-advisory |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-53955", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:54.949Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Bridge", vendor: "Adobe", versions: [ { lessThanOrEqual: "15.0", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Bridge versions 14.1.3, 15.0 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-191", description: "Integer Underflow (Wrap or Wraparound) (CWE-191)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T21:15:49.980Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/bridge/apsb24-103.html", }, ], source: { discovery: "EXTERNAL", }, title: "Bridge | Integer Underflow (Wrap or Wraparound) (CWE-191)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-53955", datePublished: "2024-12-10T21:15:49.980Z", dateReserved: "2024-11-25T17:39:04.108Z", dateUpdated: "2024-12-17T04:55:54.949Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-53958 (GCVE-0-2024-53958)
Vulnerability from cvelistv5
Published
2024-12-10 21:21
Modified
2024-12-11 14:48
Severity ?
EPSS score ?
Summary
Substance3D - Painter versions 10.1.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/substance3d_painter/apsb24-105.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Substance3D - Painter |
Version: 0 ≤ 10.1.1 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-53958", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:42:39.102544Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:48:53.396Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Substance3D - Painter", vendor: "Adobe", versions: [ { lessThanOrEqual: "10.1.1", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Substance3D - Painter versions 10.1.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-787", description: "Out-of-bounds Write (CWE-787)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T21:21:33.207Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/substance3d_painter/apsb24-105.html", }, ], source: { discovery: "EXTERNAL", }, title: "Substance3D - Painter | Out-of-bounds Write (CWE-787)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-53958", datePublished: "2024-12-10T21:21:33.207Z", dateReserved: "2024-11-25T17:39:04.108Z", dateUpdated: "2024-12-11T14:48:53.396Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-52989 (GCVE-0-2024-52989)
Vulnerability from cvelistv5
Published
2024-12-10 20:27
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/animate/apsb24-96.html | vendor-advisory |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-52989", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:38.553Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Animate", vendor: "Adobe", versions: [ { lessThanOrEqual: "24.0.5", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-191", description: "Integer Underflow (Wrap or Wraparound) (CWE-191)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:27:44.560Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/animate/apsb24-96.html", }, ], source: { discovery: "EXTERNAL", }, title: "Animate | Integer Underflow (Wrap or Wraparound) (CWE-191)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-52989", datePublished: "2024-12-10T20:27:44.560Z", dateReserved: "2024-11-18T17:46:25.280Z", dateUpdated: "2024-12-17T04:55:38.553Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-54042 (GCVE-0-2024-54042)
Vulnerability from cvelistv5
Published
2024-12-10 20:42
Modified
2025-01-07 18:35
Severity ?
EPSS score ?
Summary
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/connect/apsb24-99.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Adobe Connect |
Version: 0 ≤ 11.4.7 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-54042", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:40:06.371398Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:51:53.304Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Adobe Connect", vendor: "Adobe", versions: [ { lessThanOrEqual: "11.4.7", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 6.1, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "LOW", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "NETWORK", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "LOW", modifiedIntegrityImpact: "LOW", modifiedPrivilegesRequired: "NONE", modifiedScope: "CHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "CHANGED", temporalScore: 6.1, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-79", description: "Cross-site Scripting (Reflected XSS) (CWE-79)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-07T18:35:53.915Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/connect/apsb24-99.html", }, ], source: { discovery: "EXTERNAL", }, title: "Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-54042", datePublished: "2024-12-10T20:42:11.872Z", dateReserved: "2024-11-27T16:21:41.943Z", dateUpdated: "2025-01-07T18:35:53.915Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-52986 (GCVE-0-2024-52986)
Vulnerability from cvelistv5
Published
2024-12-10 20:27
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/animate/apsb24-96.html | vendor-advisory |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-52986", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:33.979Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Animate", vendor: "Adobe", versions: [ { lessThanOrEqual: "24.0.5", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-191", description: "Integer Underflow (Wrap or Wraparound) (CWE-191)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:27:39.767Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/animate/apsb24-96.html", }, ], source: { discovery: "EXTERNAL", }, title: "Animate | Integer Underflow (Wrap or Wraparound) (CWE-191)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-52986", datePublished: "2024-12-10T20:27:39.767Z", dateReserved: "2024-11-18T17:46:25.279Z", dateUpdated: "2024-12-17T04:55:33.979Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-49553 (GCVE-0-2024-49553)
Vulnerability from cvelistv5
Published
2024-12-10 20:09
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
Media Encoder versions 25.0, 24.6.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/media-encoder/apsb24-93.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Media Encoder |
Version: 0 ≤ 24.6.3 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-49553", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:23.743Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Media Encoder", vendor: "Adobe", versions: [ { lessThanOrEqual: "24.6.3", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Media Encoder versions 25.0, 24.6.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-787", description: "Out-of-bounds Write (CWE-787)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:09:16.342Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/media-encoder/apsb24-93.html", }, ], source: { discovery: "EXTERNAL", }, title: "Media Encoder | Out-of-bounds Write (CWE-787)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-49553", datePublished: "2024-12-10T20:09:16.342Z", dateReserved: "2024-10-15T15:35:47.038Z", dateUpdated: "2024-12-17T04:55:23.743Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-49548 (GCVE-0-2024-49548)
Vulnerability from cvelistv5
Published
2024-12-10 20:51
Modified
2024-12-10 21:27
Severity ?
EPSS score ?
Summary
InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/indesign/apsb24-97.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | InDesign Desktop |
Version: 0 ≤ ID18.5.4 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-49548", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-10T21:26:58.501004Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-10T21:27:08.288Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "InDesign Desktop", vendor: "Adobe", versions: [ { lessThanOrEqual: "ID18.5.4", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 5.5, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "NONE", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "NONE", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 5.5, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-125", description: "Out-of-bounds Read (CWE-125)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:51:09.654Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/indesign/apsb24-97.html", }, ], source: { discovery: "EXTERNAL", }, title: "InDesign Desktop | Out-of-bounds Read (CWE-125)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-49548", datePublished: "2024-12-10T20:51:09.654Z", dateReserved: "2024-10-15T15:35:47.038Z", dateUpdated: "2024-12-10T21:27:08.288Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-49551 (GCVE-0-2024-49551)
Vulnerability from cvelistv5
Published
2024-12-10 20:09
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
Media Encoder versions 25.0, 24.6.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/media-encoder/apsb24-93.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Media Encoder |
Version: 0 ≤ 24.6.3 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-49551", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:21.272Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Media Encoder", vendor: "Adobe", versions: [ { lessThanOrEqual: "24.6.3", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Media Encoder versions 25.0, 24.6.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-787", description: "Out-of-bounds Write (CWE-787)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:09:08.025Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/media-encoder/apsb24-93.html", }, ], source: { discovery: "EXTERNAL", }, title: "Media Encoder | Out-of-bounds Write (CWE-787)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-49551", datePublished: "2024-12-10T20:09:08.025Z", dateReserved: "2024-10-15T15:35:47.038Z", dateUpdated: "2024-12-17T04:55:21.272Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-53003 (GCVE-0-2024-53003)
Vulnerability from cvelistv5
Published
2024-12-10 21:12
Modified
2024-12-11 14:50
Severity ?
EPSS score ?
Summary
Substance3D - Modeler versions 1.14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/substance3d-modeler/apsb24-102.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Substance3D - Modeler |
Version: 0 ≤ 1.14.1 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-53003", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:43:02.931274Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:50:37.823Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Substance3D - Modeler", vendor: "Adobe", versions: [ { lessThanOrEqual: "1.14.1", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Substance3D - Modeler versions 1.14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-787", description: "Out-of-bounds Write (CWE-787)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T21:12:18.245Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/substance3d-modeler/apsb24-102.html", }, ], source: { discovery: "EXTERNAL", }, title: "Substance3D - Modeler | Out-of-bounds Write (CWE-787)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-53003", datePublished: "2024-12-10T21:12:18.245Z", dateReserved: "2024-11-18T17:46:25.286Z", dateUpdated: "2024-12-11T14:50:37.823Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-52990 (GCVE-0-2024-52990)
Vulnerability from cvelistv5
Published
2024-12-10 20:27
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
Animate versions 23.0.8, 24.0.5 and earlier are affected by a Buffer Underwrite ('Buffer Underflow') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could leverage this vulnerability to manipulate memory in such a way that they could execute code under the privileges of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/animate/apsb24-96.html | vendor-advisory |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-52990", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:39.718Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Animate", vendor: "Adobe", versions: [ { lessThanOrEqual: "24.0.5", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Animate versions 23.0.8, 24.0.5 and earlier are affected by a Buffer Underwrite ('Buffer Underflow') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could leverage this vulnerability to manipulate memory in such a way that they could execute code under the privileges of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-124", description: "Buffer Underwrite ('Buffer Underflow') (CWE-124)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:27:43.773Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/animate/apsb24-96.html", }, ], source: { discovery: "EXTERNAL", }, title: "Animate | Buffer Underwrite ('Buffer Underflow') (CWE-124)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-52990", datePublished: "2024-12-10T20:27:43.773Z", dateReserved: "2024-11-18T17:46:25.280Z", dateUpdated: "2024-12-17T04:55:39.718Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-49549 (GCVE-0-2024-49549)
Vulnerability from cvelistv5
Published
2024-12-10 20:51
Modified
2024-12-11 14:51
Severity ?
EPSS score ?
Summary
InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/indesign/apsb24-97.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | InDesign Desktop |
Version: 0 ≤ ID18.5.4 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-49549", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:39:58.260164Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:51:04.549Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "InDesign Desktop", vendor: "Adobe", versions: [ { lessThanOrEqual: "ID18.5.4", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 5.5, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "NONE", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "NONE", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 5.5, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-125", description: "Out-of-bounds Read (CWE-125)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:51:08.085Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/indesign/apsb24-97.html", }, ], source: { discovery: "EXTERNAL", }, title: "InDesign Desktop | Out-of-bounds Read (CWE-125)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-49549", datePublished: "2024-12-10T20:51:08.085Z", dateReserved: "2024-10-15T15:35:47.038Z", dateUpdated: "2024-12-11T14:51:04.549Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-49554 (GCVE-0-2024-49554)
Vulnerability from cvelistv5
Published
2024-12-10 20:09
Modified
2024-12-10 21:12
Severity ?
EPSS score ?
Summary
Media Encoder versions 25.0, 24.6.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/media-encoder/apsb24-93.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Media Encoder |
Version: 0 ≤ 24.6.3 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-49554", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-10T20:39:27.783696Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-10T21:12:28.424Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Media Encoder", vendor: "Adobe", versions: [ { lessThanOrEqual: "24.6.3", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Media Encoder versions 25.0, 24.6.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 5.5, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "NONE", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "NONE", modifiedIntegrityImpact: "NONE", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 5.5, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-476", description: "NULL Pointer Dereference (CWE-476)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:09:14.977Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/media-encoder/apsb24-93.html", }, ], source: { discovery: "EXTERNAL", }, title: "Media Encoder | NULL Pointer Dereference (CWE-476)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-49554", datePublished: "2024-12-10T20:09:14.977Z", dateReserved: "2024-10-15T15:35:47.038Z", dateUpdated: "2024-12-10T21:12:28.424Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-49550 (GCVE-0-2024-49550)
Vulnerability from cvelistv5
Published
2024-12-10 20:42
Modified
2024-12-11 14:03
Severity ?
EPSS score ?
Summary
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/connect/apsb24-99.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Adobe Connect |
Version: 0 ≤ 11.4.7 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-49550", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:03:37.017789Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:03:43.994Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Adobe Connect", vendor: "Adobe", versions: [ { lessThanOrEqual: "11.4.7", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 6.1, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "LOW", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "NETWORK", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "LOW", modifiedIntegrityImpact: "LOW", modifiedPrivilegesRequired: "NONE", modifiedScope: "CHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "CHANGED", temporalScore: 6.1, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-79", description: "Cross-site Scripting (Reflected XSS) (CWE-79)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:42:09.094Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/connect/apsb24-99.html", }, ], source: { discovery: "EXTERNAL", }, title: "Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-49550", datePublished: "2024-12-10T20:42:09.094Z", dateReserved: "2024-10-15T15:35:47.038Z", dateUpdated: "2024-12-11T14:03:43.994Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-52994 (GCVE-0-2024-52994)
Vulnerability from cvelistv5
Published
2024-12-10 21:02
Modified
2024-12-10 21:21
Severity ?
EPSS score ?
Summary
Substance3D - Sampler versions 4.5.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/substance3d-sampler/apsb24-100.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Substance3D - Sampler |
Version: 0 ≤ 4.5.1 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-52994", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-10T21:21:45.637194Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-10T21:21:52.259Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Substance3D - Sampler", vendor: "Adobe", versions: [ { lessThanOrEqual: "4.5.1", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Substance3D - Sampler versions 4.5.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-787", description: "Out-of-bounds Write (CWE-787)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T21:02:46.512Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/substance3d-sampler/apsb24-100.html", }, ], source: { discovery: "EXTERNAL", }, title: "Substance3D - Sampler | Out-of-bounds Write (CWE-787)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-52994", datePublished: "2024-12-10T21:02:46.512Z", dateReserved: "2024-11-18T17:46:25.283Z", dateUpdated: "2024-12-10T21:21:52.259Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-53953 (GCVE-0-2024-53953)
Vulnerability from cvelistv5
Published
2024-12-10 20:27
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
Animate versions 23.0.8, 24.0.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/animate/apsb24-96.html | vendor-advisory |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-53953", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:43.350Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Animate", vendor: "Adobe", versions: [ { lessThanOrEqual: "24.0.5", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Animate versions 23.0.8, 24.0.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-416", description: "Use After Free (CWE-416)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:27:45.380Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/animate/apsb24-96.html", }, ], source: { discovery: "EXTERNAL", }, title: "Animate | Use After Free (CWE-416)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-53953", datePublished: "2024-12-10T20:27:45.380Z", dateReserved: "2024-11-25T17:39:04.108Z", dateUpdated: "2024-12-17T04:55:43.350Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-49547 (GCVE-0-2024-49547)
Vulnerability from cvelistv5
Published
2024-12-10 20:51
Modified
2024-12-10 21:26
Severity ?
EPSS score ?
Summary
InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/indesign/apsb24-97.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | InDesign Desktop |
Version: 0 ≤ ID18.5.4 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-49547", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-10T21:26:05.444993Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-10T21:26:13.425Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "InDesign Desktop", vendor: "Adobe", versions: [ { lessThanOrEqual: "ID18.5.4", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 5.5, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "NONE", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "NONE", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 5.5, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-125", description: "Out-of-bounds Read (CWE-125)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:51:11.821Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/indesign/apsb24-97.html", }, ], source: { discovery: "EXTERNAL", }, title: "InDesign Desktop | Out-of-bounds Read (CWE-125)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-49547", datePublished: "2024-12-10T20:51:11.821Z", dateReserved: "2024-10-15T15:35:47.037Z", dateUpdated: "2024-12-10T21:26:13.425Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-54044 (GCVE-0-2024-54044)
Vulnerability from cvelistv5
Published
2024-12-10 20:42
Modified
2025-01-07 18:39
Severity ?
EPSS score ?
Summary
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/connect/apsb24-99.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Adobe Connect |
Version: 0 ≤ 11.4.7 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-54044", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:03:03.940800Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:03:12.716Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Adobe Connect", vendor: "Adobe", versions: [ { lessThanOrEqual: "11.4.7", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 6.1, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "LOW", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "NETWORK", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "LOW", modifiedIntegrityImpact: "LOW", modifiedPrivilegesRequired: "NONE", modifiedScope: "CHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "CHANGED", temporalScore: 6.1, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-79", description: "Cross-site Scripting (Reflected XSS) (CWE-79)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-07T18:39:36.336Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/connect/apsb24-99.html", }, ], source: { discovery: "EXTERNAL", }, title: "Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-54044", datePublished: "2024-12-10T20:42:09.878Z", dateReserved: "2024-11-27T16:21:41.943Z", dateUpdated: "2025-01-07T18:39:36.336Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-54046 (GCVE-0-2024-54046)
Vulnerability from cvelistv5
Published
2024-12-10 20:42
Modified
2025-01-07 18:44
Severity ?
EPSS score ?
Summary
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/connect/apsb24-99.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Adobe Connect |
Version: 0 ≤ 11.4.7 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-54046", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:44:58.289381Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:45:10.880Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Adobe Connect", vendor: "Adobe", versions: [ { lessThanOrEqual: "11.4.7", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 6.1, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "LOW", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "NETWORK", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "LOW", modifiedIntegrityImpact: "LOW", modifiedPrivilegesRequired: "NONE", modifiedScope: "CHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "CHANGED", temporalScore: 6.1, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-79", description: "Cross-site Scripting (Reflected XSS) (CWE-79)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-07T18:44:58.315Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/connect/apsb24-99.html", }, ], source: { discovery: "EXTERNAL", }, title: "Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-54046", datePublished: "2024-12-10T20:42:05.897Z", dateReserved: "2024-11-27T16:21:41.944Z", dateUpdated: "2025-01-07T18:44:58.315Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-54040 (GCVE-0-2024-54040)
Vulnerability from cvelistv5
Published
2024-12-10 20:42
Modified
2024-12-10 21:34
Severity ?
EPSS score ?
Summary
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/connect/apsb24-99.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Adobe Connect |
Version: 0 ≤ 11.4.7 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-54040", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-10T21:31:36.696712Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-10T21:34:33.033Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Adobe Connect", vendor: "Adobe", versions: [ { lessThanOrEqual: "11.4.7", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 5.4, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 5.4, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "LOW", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "NETWORK", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "LOW", modifiedIntegrityImpact: "LOW", modifiedPrivilegesRequired: "LOW", modifiedScope: "CHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "LOW", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "CHANGED", temporalScore: 5.4, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-79", description: "Cross-site Scripting (Stored XSS) (CWE-79)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:42:17.030Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/connect/apsb24-99.html", }, ], source: { discovery: "EXTERNAL", }, title: "Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-54040", datePublished: "2024-12-10T20:42:17.030Z", dateReserved: "2024-11-27T16:21:41.943Z", dateUpdated: "2024-12-10T21:34:33.033Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-53001 (GCVE-0-2024-53001)
Vulnerability from cvelistv5
Published
2024-12-10 21:12
Modified
2024-12-11 14:50
Severity ?
EPSS score ?
Summary
Substance3D - Modeler versions 1.14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/substance3d-modeler/apsb24-102.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Substance3D - Modeler |
Version: 0 ≤ 1.14.1 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-53001", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:42:59.603157Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:50:29.736Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Substance3D - Modeler", vendor: "Adobe", versions: [ { lessThanOrEqual: "1.14.1", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Substance3D - Modeler versions 1.14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-787", description: "Out-of-bounds Write (CWE-787)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T21:12:19.015Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/substance3d-modeler/apsb24-102.html", }, ], source: { discovery: "EXTERNAL", }, title: "Substance3D - Modeler | Out-of-bounds Write (CWE-787)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-53001", datePublished: "2024-12-10T21:12:19.015Z", dateReserved: "2024-11-18T17:46:25.285Z", dateUpdated: "2024-12-11T14:50:29.736Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-53006 (GCVE-0-2024-53006)
Vulnerability from cvelistv5
Published
2024-12-10 21:12
Modified
2024-12-11 14:50
Severity ?
EPSS score ?
Summary
Substance3D - Modeler versions 1.14.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/substance3d-modeler/apsb24-102.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Substance3D - Modeler |
Version: 0 ≤ 1.14.1 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-53006", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:39:52.287665Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:50:21.569Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Substance3D - Modeler", vendor: "Adobe", versions: [ { lessThanOrEqual: "1.14.1", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Substance3D - Modeler versions 1.14.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 5.5, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "NONE", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "NONE", modifiedIntegrityImpact: "NONE", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 5.5, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-476", description: "NULL Pointer Dereference (CWE-476)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T21:12:19.815Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/substance3d-modeler/apsb24-102.html", }, ], source: { discovery: "EXTERNAL", }, title: "Substance3D - Modeler | NULL Pointer Dereference (CWE-476)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-53006", datePublished: "2024-12-10T21:12:19.815Z", dateReserved: "2024-11-18T17:46:25.287Z", dateUpdated: "2024-12-11T14:50:21.569Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-53002 (GCVE-0-2024-53002)
Vulnerability from cvelistv5
Published
2024-12-10 21:12
Modified
2024-12-11 14:50
Severity ?
EPSS score ?
Summary
Substance3D - Modeler versions 1.14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/substance3d-modeler/apsb24-102.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Substance3D - Modeler |
Version: 0 ≤ 1.14.1 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-53002", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:42:54.359152Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:50:01.177Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Substance3D - Modeler", vendor: "Adobe", versions: [ { lessThanOrEqual: "1.14.1", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Substance3D - Modeler versions 1.14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-787", description: "Out-of-bounds Write (CWE-787)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T21:12:21.326Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/substance3d-modeler/apsb24-102.html", }, ], source: { discovery: "EXTERNAL", }, title: "Substance3D - Modeler | Out-of-bounds Write (CWE-787)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-53002", datePublished: "2024-12-10T21:12:21.326Z", dateReserved: "2024-11-18T17:46:25.285Z", dateUpdated: "2024-12-11T14:50:01.177Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-52995 (GCVE-0-2024-52995)
Vulnerability from cvelistv5
Published
2024-12-10 21:02
Modified
2024-12-10 21:23
Severity ?
EPSS score ?
Summary
Substance3D - Sampler versions 4.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/substance3d-sampler/apsb24-100.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Substance3D - Sampler |
Version: 0 ≤ 4.5.1 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-52995", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-10T21:23:12.803617Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-10T21:23:21.274Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Substance3D - Sampler", vendor: "Adobe", versions: [ { lessThanOrEqual: "4.5.1", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Substance3D - Sampler versions 4.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-122", description: "Heap-based Buffer Overflow (CWE-122)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T21:02:45.687Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/substance3d-sampler/apsb24-100.html", }, ], source: { discovery: "EXTERNAL", }, title: "Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-52995", datePublished: "2024-12-10T21:02:45.687Z", dateReserved: "2024-11-18T17:46:25.283Z", dateUpdated: "2024-12-10T21:23:21.274Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-53007 (GCVE-0-2024-53007)
Vulnerability from cvelistv5
Published
2025-01-31 00:00
Modified
2025-01-31 17:44
Severity ?
EPSS score ?
Summary
Bentley Systems ProjectWise Integration Server before 10.00.03.288 allows unintended SQL query execution by an authenticated user via an API call.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Bentley | ProjectWise Integration Server |
Version: 0 < 10.00.03.288 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-53007", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2025-01-31T17:44:23.621561Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2025-01-31T17:44:38.174Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "ProjectWise Integration Server", vendor: "Bentley", versions: [ { lessThan: "10.00.03.288", status: "affected", version: "0", versionType: "custom", }, ], }, ], descriptions: [ { lang: "en", value: "Bentley Systems ProjectWise Integration Server before 10.00.03.288 allows unintended SQL query execution by an authenticated user via an API call.", }, ], metrics: [ { cvssV3_1: { baseScore: 6.4, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N/E:P/RL:T/RC:C", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-648", description: "CWE-648 Incorrect Use of Privileged APIs", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-31T07:58:30.779Z", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { url: "https://www.bentley.com/advisories/be-2024-0002/", }, ], x_generator: { engine: "enrichogram 0.0.1", }, }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2024-53007", datePublished: "2025-01-31T00:00:00.000Z", dateReserved: "2024-11-18T00:00:00.000Z", dateUpdated: "2025-01-31T17:44:38.174Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-54032 (GCVE-0-2024-54032)
Vulnerability from cvelistv5
Published
2024-12-10 20:42
Modified
2025-01-14 21:44
Severity ?
EPSS score ?
Summary
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/connect/apsb24-99.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Adobe Connect |
Version: 0 ≤ 11.4.7 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-54032", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:49.687Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Adobe Connect", vendor: "Adobe", versions: [ { lessThanOrEqual: "11.4.7", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 9.3, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 9.3, environmentalSeverity: "CRITICAL", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "NETWORK", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "CHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "CHANGED", temporalScore: 9.3, temporalSeverity: "CRITICAL", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-79", description: "Cross-site Scripting (Stored XSS) (CWE-79)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-14T21:44:06.787Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/connect/apsb24-99.html", }, ], source: { discovery: "EXTERNAL", }, title: "Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-54032", datePublished: "2024-12-10T20:42:06.733Z", dateReserved: "2024-11-27T16:21:41.942Z", dateUpdated: "2025-01-14T21:44:06.787Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-49538 (GCVE-0-2024-49538)
Vulnerability from cvelistv5
Published
2024-12-10 20:20
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
Illustrator versions 29.0.0, 28.7.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/illustrator/apsb24-94.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Illustrator |
Version: 0 ≤ 28.7.2 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-49538", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:24.923Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Illustrator", vendor: "Adobe", versions: [ { lessThanOrEqual: "28.7.2", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Illustrator versions 29.0.0, 28.7.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-787", description: "Out-of-bounds Write (CWE-787)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:20:35.643Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/illustrator/apsb24-94.html", }, ], source: { discovery: "EXTERNAL", }, title: "Illustrator | Out-of-bounds Write (CWE-787)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-49538", datePublished: "2024-12-10T20:20:35.643Z", dateReserved: "2024-10-15T15:35:47.031Z", dateUpdated: "2024-12-17T04:55:24.923Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-54045 (GCVE-0-2024-54045)
Vulnerability from cvelistv5
Published
2024-12-10 20:42
Modified
2025-01-15 20:01
Severity ?
EPSS score ?
Summary
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/connect/apsb24-99.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Adobe Connect |
Version: 0 ≤ 11.4.7 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-54045", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-10T21:23:21.353273Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-10T21:23:31.351Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Adobe Connect", vendor: "Adobe", versions: [ { lessThanOrEqual: "11.4.7", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 6.1, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "LOW", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "NETWORK", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "LOW", modifiedIntegrityImpact: "LOW", modifiedPrivilegesRequired: "NONE", modifiedScope: "CHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "CHANGED", temporalScore: 6.1, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-79", description: "Cross-site Scripting (Reflected XSS) (CWE-79)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-15T20:01:52.218Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/connect/apsb24-99.html", }, ], source: { discovery: "EXTERNAL", }, title: "Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-54045", datePublished: "2024-12-10T20:42:19.437Z", dateReserved: "2024-11-27T16:21:41.943Z", dateUpdated: "2025-01-15T20:01:52.218Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-49546 (GCVE-0-2024-49546)
Vulnerability from cvelistv5
Published
2024-12-10 20:51
Modified
2024-12-11 14:51
Severity ?
EPSS score ?
Summary
InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/indesign/apsb24-97.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | InDesign Desktop |
Version: 0 ≤ ID18.5.4 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-49546", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:40:00.713491Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:51:15.172Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "InDesign Desktop", vendor: "Adobe", versions: [ { lessThanOrEqual: "ID18.5.4", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 5.5, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "NONE", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "NONE", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 5.5, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-125", description: "Out-of-bounds Read (CWE-125)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:51:07.311Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/indesign/apsb24-97.html", }, ], source: { discovery: "EXTERNAL", }, title: "InDesign Desktop | Out-of-bounds Read (CWE-125)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-49546", datePublished: "2024-12-10T20:51:07.311Z", dateReserved: "2024-10-15T15:35:47.037Z", dateUpdated: "2024-12-11T14:51:15.172Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-53005 (GCVE-0-2024-53005)
Vulnerability from cvelistv5
Published
2024-12-10 21:12
Modified
2024-12-11 14:50
Severity ?
EPSS score ?
Summary
Substance3D - Modeler versions 1.14.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/substance3d-modeler/apsb24-102.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Substance3D - Modeler |
Version: 0 ≤ 1.14.1 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-53005", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:39:55.393851Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:50:45.750Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Substance3D - Modeler", vendor: "Adobe", versions: [ { lessThanOrEqual: "1.14.1", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Substance3D - Modeler versions 1.14.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 5.5, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "NONE", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "NONE", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 5.5, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-125", description: "Out-of-bounds Read (CWE-125)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T21:12:17.022Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/substance3d-modeler/apsb24-102.html", }, ], source: { discovery: "EXTERNAL", }, title: "Substance3D - Modeler | Out-of-bounds Read (CWE-125)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-53005", datePublished: "2024-12-10T21:12:17.022Z", dateReserved: "2024-11-18T17:46:25.286Z", dateUpdated: "2024-12-11T14:50:45.750Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-52983 (GCVE-0-2024-52983)
Vulnerability from cvelistv5
Published
2024-12-10 20:27
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/animate/apsb24-96.html | vendor-advisory |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-52983", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:29.902Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Animate", vendor: "Adobe", versions: [ { lessThanOrEqual: "24.0.5", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-190", description: "Integer Overflow or Wraparound (CWE-190)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:27:42.195Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/animate/apsb24-96.html", }, ], source: { discovery: "EXTERNAL", }, title: "Animate | Integer Overflow or Wraparound (CWE-190)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-52983", datePublished: "2024-12-10T20:27:42.195Z", dateReserved: "2024-11-18T17:46:25.279Z", dateUpdated: "2024-12-17T04:55:29.902Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-54036 (GCVE-0-2024-54036)
Vulnerability from cvelistv5
Published
2024-12-10 20:42
Modified
2025-01-14 21:55
Severity ?
EPSS score ?
Summary
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/connect/apsb24-99.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Adobe Connect |
Version: 0 ≤ 11.4.7 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-54036", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:41:47.507222Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:41:58.922Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Adobe Connect", vendor: "Adobe", versions: [ { lessThanOrEqual: "11.4.7", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 9.3, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 9.3, environmentalSeverity: "CRITICAL", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "NETWORK", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "CHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "CHANGED", temporalScore: 9.3, temporalSeverity: "CRITICAL", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-79", description: "Cross-site Scripting (Stored XSS) (CWE-79)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-14T21:55:54.286Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/connect/apsb24-99.html", }, ], source: { discovery: "EXTERNAL", }, title: "Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-54036", datePublished: "2024-12-10T20:42:14.941Z", dateReserved: "2024-11-27T16:21:41.942Z", dateUpdated: "2025-01-14T21:55:54.286Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-49552 (GCVE-0-2024-49552)
Vulnerability from cvelistv5
Published
2024-12-10 20:09
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
Media Encoder versions 25.0, 24.6.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/media-encoder/apsb24-93.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Media Encoder |
Version: 0 ≤ 24.6.3 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-49552", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:22.491Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Media Encoder", vendor: "Adobe", versions: [ { lessThanOrEqual: "24.6.3", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Media Encoder versions 25.0, 24.6.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-122", description: "Heap-based Buffer Overflow (CWE-122)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:09:08.813Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/media-encoder/apsb24-93.html", }, ], source: { discovery: "EXTERNAL", }, title: "Media Encoder | Heap-based Buffer Overflow (CWE-122)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-49552", datePublished: "2024-12-10T20:09:08.813Z", dateReserved: "2024-10-15T15:35:47.038Z", dateUpdated: "2024-12-17T04:55:22.491Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-49541 (GCVE-0-2024-49541)
Vulnerability from cvelistv5
Published
2024-12-10 20:20
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
Illustrator versions 29.0.0, 28.7.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/illustrator/apsb24-94.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Illustrator |
Version: 0 ≤ 28.7.2 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-49541", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:26.225Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Illustrator", vendor: "Adobe", versions: [ { lessThanOrEqual: "28.7.2", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Illustrator versions 29.0.0, 28.7.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 5.5, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "NONE", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "NONE", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 5.5, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-125", description: "Out-of-bounds Read (CWE-125)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:20:34.787Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/illustrator/apsb24-94.html", }, ], source: { discovery: "EXTERNAL", }, title: "Illustrator | Out-of-bounds Read (CWE-125)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-49541", datePublished: "2024-12-10T20:20:34.787Z", dateReserved: "2024-10-15T15:35:47.035Z", dateUpdated: "2024-12-17T04:55:26.225Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-53952 (GCVE-0-2024-53952)
Vulnerability from cvelistv5
Published
2024-12-10 20:51
Modified
2024-12-10 21:26
Severity ?
EPSS score ?
Summary
InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/indesign/apsb24-97.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | InDesign Desktop |
Version: 0 ≤ ID18.5.4 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-53952", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-10T21:26:33.366890Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-10T21:26:40.373Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "InDesign Desktop", vendor: "Adobe", versions: [ { lessThanOrEqual: "ID18.5.4", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 5.5, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "NONE", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "NONE", modifiedIntegrityImpact: "NONE", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 5.5, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-476", description: "NULL Pointer Dereference (CWE-476)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:51:10.408Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/indesign/apsb24-97.html", }, ], source: { discovery: "EXTERNAL", }, title: "InDesign Desktop | NULL Pointer Dereference (CWE-476)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-53952", datePublished: "2024-12-10T20:51:10.408Z", dateReserved: "2024-11-25T17:39:04.107Z", dateUpdated: "2024-12-10T21:26:40.373Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-54037 (GCVE-0-2024-54037)
Vulnerability from cvelistv5
Published
2024-12-10 20:42
Modified
2025-01-16 17:33
Severity ?
EPSS score ?
Summary
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the high-privileged attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/connect/apsb24-99.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Adobe Connect |
Version: 0 ≤ 11.4.7 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-54037", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:52.290Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Adobe Connect", vendor: "Adobe", versions: [ { lessThanOrEqual: "11.4.7", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the high-privileged attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 8.1, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 8.1, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "NETWORK", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "HIGH", modifiedScope: "CHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "HIGH", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "CHANGED", temporalScore: 8.1, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-79", description: "Cross-site Scripting (DOM-based XSS) (CWE-79)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-16T17:33:20.838Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/connect/apsb24-99.html", }, ], source: { discovery: "EXTERNAL", }, title: "Adobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-54037", datePublished: "2024-12-10T20:42:18.680Z", dateReserved: "2024-11-27T16:21:41.942Z", dateUpdated: "2025-01-16T17:33:20.838Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-52987 (GCVE-0-2024-52987)
Vulnerability from cvelistv5
Published
2024-12-10 20:27
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/animate/apsb24-96.html | vendor-advisory |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-52987", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:35.283Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Animate", vendor: "Adobe", versions: [ { lessThanOrEqual: "24.0.5", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-191", description: "Integer Underflow (Wrap or Wraparound) (CWE-191)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:27:48.421Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/animate/apsb24-96.html", }, ], source: { discovery: "EXTERNAL", }, title: "Animate | Integer Underflow (Wrap or Wraparound) (CWE-191)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-52987", datePublished: "2024-12-10T20:27:48.421Z", dateReserved: "2024-11-18T17:46:25.279Z", dateUpdated: "2024-12-17T04:55:35.283Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-52988 (GCVE-0-2024-52988)
Vulnerability from cvelistv5
Published
2024-12-10 20:27
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
Animate versions 23.0.8, 24.0.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/animate/apsb24-96.html | vendor-advisory |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-52988", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:36.869Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Animate", vendor: "Adobe", versions: [ { lessThanOrEqual: "24.0.5", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Animate versions 23.0.8, 24.0.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-787", description: "Out-of-bounds Write (CWE-787)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:27:41.436Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/animate/apsb24-96.html", }, ], source: { discovery: "EXTERNAL", }, title: "Animate | Out-of-bounds Write (CWE-787)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-52988", datePublished: "2024-12-10T20:27:41.436Z", dateReserved: "2024-11-18T17:46:25.280Z", dateUpdated: "2024-12-17T04:55:36.869Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-49545 (GCVE-0-2024-49545)
Vulnerability from cvelistv5
Published
2024-12-10 20:51
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/indesign/apsb24-97.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | InDesign Desktop |
Version: 0 ≤ ID18.5.4 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-49545", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:48.464Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "InDesign Desktop", vendor: "Adobe", versions: [ { lessThanOrEqual: "ID18.5.4", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-122", description: "Heap-based Buffer Overflow (CWE-122)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:51:06.539Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/indesign/apsb24-97.html", }, ], source: { discovery: "EXTERNAL", }, title: "InDesign Desktop | Heap-based Buffer Overflow (CWE-122)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-49545", datePublished: "2024-12-10T20:51:06.539Z", dateReserved: "2024-10-15T15:35:47.037Z", dateUpdated: "2024-12-17T04:55:48.464Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-54041 (GCVE-0-2024-54041)
Vulnerability from cvelistv5
Published
2024-12-10 20:42
Modified
2024-12-11 14:42
Severity ?
EPSS score ?
Summary
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/connect/apsb24-99.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Adobe Connect |
Version: 0 ≤ 11.4.7 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-54041", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:42:17.229838Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:42:25.440Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Adobe Connect", vendor: "Adobe", versions: [ { lessThanOrEqual: "11.4.7", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 5.4, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 5.4, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "LOW", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "NETWORK", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "LOW", modifiedIntegrityImpact: "LOW", modifiedPrivilegesRequired: "LOW", modifiedScope: "CHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "LOW", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "CHANGED", temporalScore: 5.4, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-79", description: "Cross-site Scripting (Stored XSS) (CWE-79)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:42:14.155Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/connect/apsb24-99.html", }, ], source: { discovery: "EXTERNAL", }, title: "Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-54041", datePublished: "2024-12-10T20:42:14.155Z", dateReserved: "2024-11-27T16:21:41.943Z", dateUpdated: "2024-12-11T14:42:25.440Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-53957 (GCVE-0-2024-53957)
Vulnerability from cvelistv5
Published
2024-12-10 21:21
Modified
2024-12-11 14:49
Severity ?
EPSS score ?
Summary
Substance3D - Painter versions 10.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/substance3d_painter/apsb24-105.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Substance3D - Painter |
Version: 0 ≤ 10.1.1 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-53957", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:42:42.881096Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:49:03.833Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Substance3D - Painter", vendor: "Adobe", versions: [ { lessThanOrEqual: "10.1.1", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Substance3D - Painter versions 10.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-122", description: "Heap-based Buffer Overflow (CWE-122)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T21:21:32.309Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/substance3d_painter/apsb24-105.html", }, ], source: { discovery: "EXTERNAL", }, title: "Substance3D - Painter | Heap-based Buffer Overflow (CWE-122)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-53957", datePublished: "2024-12-10T21:21:32.309Z", dateReserved: "2024-11-25T17:39:04.108Z", dateUpdated: "2024-12-11T14:49:03.833Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-45155 (GCVE-0-2024-45155)
Vulnerability from cvelistv5
Published
2024-12-10 20:27
Modified
2024-12-17 04:55
Severity ?
EPSS score ?
Summary
Animate versions 23.0.8, 24.0.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/animate/apsb24-96.html | vendor-advisory |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-45155", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-12-16T00:00:00+00:00", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-17T04:55:40.892Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Animate", vendor: "Adobe", versions: [ { lessThanOrEqual: "24.0.5", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Animate versions 23.0.8, 24.0.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "UNCHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-824", description: "Access of Uninitialized Pointer (CWE-824)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:27:49.222Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/animate/apsb24-96.html", }, ], source: { discovery: "EXTERNAL", }, title: "Animate | Access of Uninitialized Pointer (CWE-824)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-45155", datePublished: "2024-12-10T20:27:49.222Z", dateReserved: "2024-08-21T23:00:59.354Z", dateUpdated: "2024-12-17T04:55:40.892Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2024-54039 (GCVE-0-2024-54039)
Vulnerability from cvelistv5
Published
2024-12-10 20:42
Modified
2024-12-11 14:51
Severity ?
EPSS score ?
Summary
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
References
▼ | URL | Tags |
---|---|---|
https://helpx.adobe.com/security/products/connect/apsb24-99.html | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Adobe | Adobe Connect |
Version: 0 ≤ 11.4.7 |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2024-54039", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-12-11T14:40:03.437590Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-12-11T14:51:39.132Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Adobe Connect", vendor: "Adobe", versions: [ { lessThanOrEqual: "11.4.7", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2024-12-10T17:00:00.000Z", descriptions: [ { lang: "en", value: "Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", availabilityRequirement: "NOT_DEFINED", baseScore: 5.4, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 5.4, environmentalSeverity: "MEDIUM", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "LOW", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "NETWORK", modifiedAvailabilityImpact: "NONE", modifiedConfidentialityImpact: "LOW", modifiedIntegrityImpact: "LOW", modifiedPrivilegesRequired: "LOW", modifiedScope: "CHANGED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "LOW", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "CHANGED", temporalScore: 5.4, temporalSeverity: "MEDIUM", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-79", description: "Cross-site Scripting (Stored XSS) (CWE-79)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-12-10T20:42:12.622Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/connect/apsb24-99.html", }, ], source: { discovery: "EXTERNAL", }, title: "Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2024-54039", datePublished: "2024-12-10T20:42:12.622Z", dateReserved: "2024-11-27T16:21:41.943Z", dateUpdated: "2024-12-11T14:51:39.132Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.