CVE-2021-40713

Adobe Experience Manager Improper Certificate Validation Could Lead to Man In The Middle Attack

Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a improper certificate validation vulnerability in the cold storage component. If an attacker can achieve a man in the middle when the cold server establishes a new certificate, they would be able to harvest sensitive information.

CVSS 3.1 · 5.9 Medium EPSS 1.0% KEV · Not listed

Vendors

Adobe

Products

Experience Manager

CVE-2021-39828

Adobe Digital Editions Installer flaw leads to Local Privilege Escalation

Adobe Digital Editions 4.5.11.187646 (and earlier) are affected by a privilege escalation vulnerability in the Digital Editions installer. An authenticated attacker could leverage this vulnerability to escalate privileges. User interaction is required before product installation to abuse this vulnerability.

CVSS 3.1 · 5.8 Medium EPSS 1.5% KEV · Not listed

Vendors

Adobe Apple

Products

Digital Editions Macos

CVE-2021-40709

Adobe Photoshop Buffer Overflow leads to Arbitrary Code Execution

Adobe Photoshop versions 21.2.11 (and earlier) and 22.5 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted SVG file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS 4.6% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Photoshop 2020 Photoshop 2021 Macos and 1 more

CVE-2021-40714

Adobe Experience Manager Reflected Cross Site Scripting via accesskey parameter

Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the accesskey parameter. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser

CVSS 3.1 · 6.1 Medium EPSS 1.1% KEV · Not listed

Vendors

Adobe

Products

Experience Manager

CVE-2021-40712

Adobe Experience Manager Path parameter Improper Input Validation Could Lead To DOS

Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a improper input validation vulnerability via the path parameter. An authenticated attacker can send a malformed POST request to achieve server-side denial of service.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed

Vendors

Adobe

Products

Experience Manager

CVE-2021-39821

Adobe InDesign TIF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Adobe InDesign versions 16.3 (and earlier), and 16.3.1 (and earlier) are affected by an out-of-bounds read vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious TIF file.

CVSS 3.0 · 7.8 High EPSS 5.4% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Indesign Macos Windows

CVE-2021-39831

Adobe FrameMaker PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.

CVSS 3.1 · 7.8 High EPSS 2.2% KEV · Not listed

Vendors

Adobe Microsoft

Products

Framemaker Windows

CVE-2021-39833

Adobe FrameMaker TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious TIF file.

CVSS 3.0 · 3.3 Low EPSS 1.3% KEV · Not listed

Vendors

Adobe Microsoft

Products

Framemaker Windows

CVE-2021-39830

Adobe FrameMaker PDF File Parsing Memory Corruption Remote Code Execution Vulnerability

Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by a memory corruption vulnerability due to insecure handling of a malicious PDF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.

CVSS 3.0 · 7.8 High EPSS 2.0% KEV · Not listed

Vendors

Adobe Microsoft

Products

Framemaker Windows

CVE-2021-39834

Adobe FrameMaker TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious TIF file.

CVSS 3.0 · 3.3 Low EPSS 1.3% KEV · Not listed

Vendors

Adobe Microsoft

Products

Framemaker Windows

CVE-2021-39832

Adobe FrameMaker PDF File Parsing Memory Corruption Remote Code Execution Vulnerability

Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by a memory corruption vulnerability due to insecure handling of a malicious PDF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.

CVSS 3.0 · 7.8 High EPSS 2.0% KEV · Not listed

Vendors

Adobe Microsoft

Products

Framemaker Windows

CVE-2021-39829

Adobe FrameMaker PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.

CVSS 3.0 · 7.8 High EPSS 2.2% KEV · Not listed

Vendors

Adobe Microsoft

Products

Framemaker Windows

CVE-2021-39835

Adobe FrameMaker PDF File Parsing Use-After-Free Information Disclosure Vulnerability

Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by a use-after-free vulnerability in the processing of a malformed PDF file that could result in disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.

CVSS 3.0 · 4.3 Medium EPSS 1.5% KEV · Not listed

Vendors

Adobe Microsoft

Products

Framemaker Windows

CVE-2021-39857

Adobe Acrobat Reader DC Information Disclosure via ActiveX LoadFile

Adobe Acrobat Reader DC add-on for Internet Explorer versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an Information Disclosure vulnerability. An unauthenticated attacker could leverage this vulnerability to check for existence of local files. Exploitation of this issue requires user interaction in that a victim must visit an attacker controlled web page.

CVSS 3.0 · 4.3 Medium EPSS 2.5% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2021-40697

Adobe FrameMaker PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.0 · 3.3 Low EPSS 1.5% KEV · Not listed

Vendors

Adobe

Products

Framemaker

CVE-2021-28547

Adobe Creative Cloud for macOS Privilege Escalation Vulnerability

Adobe Creative Cloud Desktop Application for macOS version 5.3 (and earlier) is affected by a privilege escalation vulnerability that could allow a normal user to delete the OOBE directory and get permissions of any directory under the administrator authority.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Creative Cloud Desktop Application Macos Windows

CVE-2021-39864

Adobe Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Cart Addition

Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.

CVSS 3.1 · 6.5 Medium EPSS 1.6% KEV · Not listed

Vendors

Adobe

Products

Commerce Magento Open Source

CVE-2021-40729

Adobe Acrobat Reader DC PDF Out-of-Bound Read Vulnerability Information Disclosure

Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected by a out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.

CVSS 3.1 · 3.3 Low EPSS 4.3% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2021-40730

Adobe Acrobat Reader DC JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability

Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected by a use-after-free that allow a remote attacker to disclose sensitive information on affected installations of of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG2000 images.

CVSS 3.0 · 3.3 Low EPSS 3.9% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2021-40728

Adobe Acrobat Reader DC Use After Free Arbitrary Code Execution

Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected by a use-after-free vulnerability in the processing of the GetURL function on a global object window that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS 54.6% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more