Adobe · BlazeDS
CVE-2009-3960
Adobe BlazeDS Information Disclosure Vulnerability
De quoi s'agit-il
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
CISA: Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.
Que faire
Apply updates per vendor instructions.
Échéance pour les agences fédérales américaines : 7 septembre 2022
Autres failles exploitées chez Adobe
| Ajouté | Faille | Produit | Gravité | Risque d'attaque |
|---|---|---|---|---|
| 27 oct. 2026 | Unrestricted Upload of File with Dangerous Type | Commerce and Magento | Critique 9,3 | 31% |
| 24 sept. 2026 | Commerce and Magento Incorrect Authorization Vulnerability | Commerce and Magento | Critique 9,1 | 90% |
| 8 sept. 2026 | Improper Neutralization of Special Elements Used in a Template Engine | Commerce and Magento | Critique 10,0 | 3,9% |
| 7 juil. 2026 | Path Traversal | ColdFusion | Critique 10,0 | 42% |
| 20 mai 2026 | Heap-Based Buffer Overflow | Acrobat and Reader | Élevé 8,8 | 87% |
| 13 avr. 2026 | Use-After-Free | Acrobat | Élevé 7,8 | 33% |
| 13 avr. 2026 | Prototype Pollution | Acrobat and Reader | Élevé 8,6 | 7,2% |
| 24 oct. 2025 | Improper Input Validation | Commerce and Magento | Critique 9,1 | 95% |
Sources : Known Exploited Vulnerabilities (CISA, domaine public), CVE records (cve.org) et EPSS (FIRST). Le risque d'attaque est l'estimation EPSS qu'une personne tente d'exploiter la faille dans les 30 prochains jours.