CVE-2021-40716

XMP Toolkit SDK SVG_Adapter Out-of-bounds Read Information Disclosure

XMP Toolkit SDK versions 2021.07 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS 2.3% KEV · Not listed

Vendors

Adobe Debian

Products

Xmp Toolkit Software Development Kit Debian Linux

CVE-2021-39847

XMP Toolkit SDK Stack-based Buffer Overflow Could Lead To Arbitrary Code Execution

XMP Toolkit SDK version 2020.1 (and earlier) is affected by a stack-based buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file.

CVSS 3.1 · 7.8 High EPSS 5.4% KEV · Not listed

Vendors

Adobe Debian

Products

Xmp Toolkit Software Development Kit Debian Linux

CVE-2021-36064

XMP Toolkit SDK SVG_Adapter ParseFullNS Buffer Underflow

XMP Toolkit version 2020.1 (and earlier) is affected by a Buffer Underflow vulnerability which could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS 2.7% KEV · Not listed

Vendors

Adobe Debian

Products

Xmp Toolkit Software Development Kit Debian Linux

CVE-2021-36058

XMP Toolkit SDK Integer Overflow Vulnerability Could Result In Application Denial Of Service

XMP Toolkit SDK version 2020.1 (and earlier) is affected by an Integer Overflow vulnerability potentially resulting in application-level denial of service in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file.

CVSS 3.1 · 5.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Adobe Debian

Products

Xmp Toolkit Software Development Kit Debian Linux

CVE-2021-36057

XMP Toolkit SDK Write-What-Where Condition Could Lead To Local Application Denial Of Service

XMP Toolkit SDK version 2020.1 (and earlier) is affected by a write-what-where condition vulnerability caused during the application's memory allocation process. This may cause the memory management functions to become mismatched resulting in local application denial of service in the context of the current user.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Adobe Debian

Products

Xmp Toolkit Software Development Kit Debian Linux

CVE-2021-36056

XMP Toolkit SDK Heap-based Buffer Overflow Could Lead To Arbitrary Code Execution

XMP Toolkit SDK version 2020.1 (and earlier) is affected by a buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file.

CVSS 3.1 · 5.5 Medium EPSS 4.4% KEV · Not listed

Vendors

Adobe Debian

Products

Xmp Toolkit Software Development Kit Debian Linux

CVE-2021-36055

XMP Toolkit SDK Use After Free Vulnerability In ReadingXMPNewDOM Could Lead To Arbitrary Code Execution

XMP Toolkit SDK versions 2020.1 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS 2.7% KEV · Not listed

Vendors

Adobe Debian

Products

Xmp Toolkit Software Development Kit Debian Linux

CVE-2021-36054

XMP Toolkit SDK Heap-based Buffer Overflow in the PSD_MetaHandler::CacheFileData Could Lead To Application Denial Of Service

XMP Toolkit SDK version 2020.1 (and earlier) is affected by a buffer overflow vulnerability potentially resulting in local application denial of service in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file.

CVSS 3.1 · 3.3 Low EPSS 3.7% KEV · Not listed

Vendors

Adobe Debian

Products

Xmp Toolkit Software Development Kit Debian Linux

CVE-2021-36053

XMP Toolkit SDK Out-of-bounds Read Vulnerability In FindAndReadXMPChunk Could Lead To Information Exposure

XMP Toolkit SDK versions 2020.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 3.3 Low EPSS 2.0% KEV · Not listed

Vendors

Adobe Debian

Products

Xmp Toolkit Software Development Kit Debian Linux

CVE-2021-36052

XMPToolkit SDK ImportTIFF_CheckStandardMapping Memory Corruption

XMP Toolkit version 2020.1 (and earlier) is affected by a memory corruption vulnerability, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.

CVSS 3.1 · 7.8 High EPSS 3.2% KEV · Not listed

Vendors

Adobe Debian

Products

Xmp Toolkit Software Development Kit Debian Linux

CVE-2021-36051

XMP Toolkit SDK Buffer Overflow Could Lead To Arbitrary Code Execution

XMP Toolkit SDK version 2020.1 (and earlier) is affected by a buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a specially-crafted .cpp file.

CVSS 3.1 · 7.8 High EPSS 5.8% KEV · Not listed

Vendors

Adobe Debian

Products

Xmp Toolkit Software Development Kit Debian Linux

CVE-2021-36050

XMP Toolkit SDK Heap-based Buffer Overflow Could Lead To Arbitrary Code Execution

XMP Toolkit SDK version 2020.1 (and earlier) is affected by a buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file.

CVSS 3.1 · 7.8 High EPSS 5.4% KEV · Not listed

Vendors

Adobe Debian

Products

Xmp Toolkit Software Development Kit Debian Linux

CVE-2021-36048

XMP Toolkit SDK Improper Input Validation Could Lead To Arbitrary Code Execution

XMP Toolkit SDK version 2020.1 (and earlier) is affected by an Improper Input Validation vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file.

CVSS 3.1 · 7.8 High EPSS 2.7% KEV · Not listed

Vendors

Adobe Debian

Products

Xmp Toolkit Software Development Kit Debian Linux

CVE-2021-36047

XMP Toolkit SDK Improper Input Validation Could Lead To Arbitrary Code Execution

XMP Toolkit SDK version 2020.1 (and earlier) is affected by an Improper Input Validation vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file.

CVSS 3.1 · 7.8 High EPSS 2.7% KEV · Not listed

Vendors

Adobe Debian

Products

Xmp Toolkit Software Development Kit Debian Linux

CVE-2021-36046

XMP Toolkit SDK TIFF_MemoryReader::SortIFD function Memory Corruption

XMP Toolkit version 2020.1 (and earlier) is affected by a memory corruption vulnerability, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.

CVSS 3.1 · 7.8 High EPSS 2.5% KEV · Not listed

Vendors

Adobe Debian

Products

Xmp Toolkit Software Development Kit Debian Linux

CVE-2021-36045

XMP Toolkit SDK Out-of-bounds Read Vulnerability In PostScriptSupport::ConvertToDate Could Lead To Information Exposure

XMP Toolkit SDK versions 2020.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 3.3 Low EPSS 1.9% KEV · Not listed

Vendors

Adobe Debian

Products

Xmp Toolkit Software Development Kit Debian Linux

CVE-2023-26369

[Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild

Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS 7.5% KEV · Listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2024-34102

XXE can expose crypt key and other secrets granting full admin access

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 9.8 Critical EPSS 100.0% KEV · Listed

Vendors

Adobe

Products

Commerce Commerce Webhooks Magento

CVE-2023-21608

Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution Vulnerability

Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS 59.4% KEV · Listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2022-24086

Adobe Commerce checkout improper input validation leads to remote code execution

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

CVSS 3.1 · 9.8 Critical EPSS 99.2% KEV · Listed

Vendors

Adobe

Products

Commerce Magento