Adobe · BlazeDS
CVE-2009-3960
Adobe BlazeDS Information Disclosure Vulnerability
무엇인가
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
CISA: Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.
할 일
Apply updates per vendor instructions.
미국 연방 기관 조치 기한: 2022년 9월 7일
Adobe의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2026. 10. 27. | Unrestricted Upload of File with Dangerous Type | Commerce and Magento | 치명적 9.3 | 31% |
| 2026. 9. 24. | Commerce and Magento Incorrect Authorization Vulnerability | Commerce and Magento | 치명적 9.1 | 90% |
| 2026. 9. 8. | Improper Neutralization of Special Elements Used in a Template Engine | Commerce and Magento | 치명적 10.0 | 3.9% |
| 2026. 7. 7. | Path Traversal | ColdFusion | 치명적 10.0 | 42% |
| 2026. 5. 20. | Heap-Based Buffer Overflow | Acrobat and Reader | 높음 8.8 | 87% |
| 2026. 4. 13. | Use-After-Free | Acrobat | 높음 7.8 | 33% |
| 2026. 4. 13. | Prototype Pollution | Acrobat and Reader | 높음 8.6 | 7.2% |
| 2025. 10. 24. | Improper Input Validation | Commerce and Magento | 치명적 9.1 | 95% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.