All CVEs — page 10 of 1220
The complete archive, 25 per page, newest first. 30483 records. Search instead.
Adobe Connect contains an SQL injection vulnerability (CWE-89) due to improper neutralization of special SQL elements in user-supplied input. A low-privileged attacker can exploit this without user interaction to execute arbitrary code in the context of the current user, with scope changed from original to connected system.
Adobe Connect contains an SQL injection vulnerability (CWE-89) due to improper neutralization of user-supplied input in SQL commands. A low-privileged attacker can exploit this without user interaction to execute arbitrary SQL, potentially escalating privileges or compromising data integrity and confidentiality.
Adobe Connect contains a code injection vulnerability (CWE-94) allowing low-privileged attackers to execute arbitrary code in their own context without user interaction, due to improper control over code generation. The vulnerability has a changed scope, indicating it affects components beyond the immediate attack surface.
Adobe Connect contains a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) that allows an unauthenticated attacker to manipulate the application into making unintended internal or external HTTP requests, potentially leading to privilege escalation due to a changed scope.
Adobe Connect contains an XXE vulnerability (CWE-611) in its XML parsing logic that allows a low-privileged attacker to trigger external entity resolution, potentially leading to arbitrary code execution in the context of the current user. The vulnerability is exploitable remotely without user interaction and has a changed scope, indicating broader impact than initially assumed.
Adobe Connect contains a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) that allows an unauthenticated attacker to manipulate the application into making unintended internal or external HTTP requests, potentially leading to privilege escalation due to the changed scope.
Adobe Connect contains an Incorrect Authorization (CWE-863) flaw allowing unauthenticated or low-privileged users to escalate privileges and access sensitive resources without user interaction. This enables unauthorized elevation to higher access levels, compromising confidentiality and integrity of system data.
Adobe Connect contains a path traversal vulnerability (CWE-22) allowing authenticated low-privilege users to read arbitrary files on the server by manipulating file paths outside the intended directory scope. The flaw enables full confidentiality, integrity, and availability impact due to the changed scope.
Adobe Connect contains a CRLF injection vulnerability (CWE-93) that allows unauthenticated attackers to inject carriage return and line feed characters into HTTP responses, potentially enabling session fixation, header injection, or UI redressing attacks that could lead to account takeover or arbitrary code execution in the user's context. The vulnerability has a changed scope, indicating broader impact than initially assumed.
Adobe Connect contains an Incorrect Authorization (CWE-863) vulnerability allowing unauthenticated or low-privileged attackers to escalate privileges and access sensitive resources due to improper scope enforcement during authorization checks. The flaw is exploitable remotely without user interaction.
Adobe Connect contains a path traversal vulnerability (CWE-22) allowing unauthenticated remote attackers to read arbitrary files on the server by manipulating directory traversal sequences in a pathname. The vulnerability affects the application's file access logic and has full confidentiality impact due to scope change.
Adobe Connect contains a path traversal vulnerability (CWE-22) that allows a low-privileged attacker to escape directory restrictions by manipulating file paths, potentially leading to unauthorized access or arbitrary code execution in the current user's context. The vulnerability is exploitable over the network without user interaction and involves a scope change, indicating broader impact than initially intended.
Adobe Experience Manager contains an Incorrect Authorization (CWE-863) flaw allowing low-privileged users to bypass intended access controls and execute arbitrary code in their own context. The vulnerability affects the scope of authorization enforcement, enabling privilege escalation without user interaction.
Adobe Experience Manager contains an Incorrect Authorization (CWE-863) vulnerability allowing low-privileged users to bypass intended access controls and execute arbitrary code in their own context. The flaw enables privilege escalation without user interaction due to improper scope enforcement during authorization checks.