Adobe Vulnerabilities

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

Type

The moderation team is working with the threat intelligence team to categorize software that is affected by security vulnerabilities. This helps to illustrate the assignment of these categories to determine the most affected software types.

Product

Adobe Acrobat Reader2016
Adobe Flash Player1095
Adobe Experience Manager352
Adobe Shockwave Player167
Adobe ColdFusion135

Grouping vulnerabilities by products helps to get an overview. This makes it possible to determine an homogeneous landscape or the most important hotspots in heterogeneous landscapes.

Remediation

Official Fix5153
Temporary Fix0
Workaround4
Unavailable10
Not Defined267

Vendors and researchers are eager to find countermeasures to mitigate security vulnerabilities. These can be distinguished between multiple forms and levels of remediation which influence risks differently.

Exploitability

High77
Functional5
Proof-of-Concept800
Unproven266
Not Defined4286

Researcher and attacker which are looking for security vulnerabilities try to exploit them for academic purposes or personal gain. The level and quality of exploitability can be distinguished to determine simplicity and strength of attacks.

Access Vector

Not Defined0
Physical3
Local293
Adjacent37
Network5101

The approach a vulnerability it becomes important to use the expected access vector. This is typically via the network, local, or physically even.

Authentication

Not Defined0
High56
Low539
None4839

To exploit a vulnerability a certail level of authentication might be required. Vulnerabilities without such a requirement are much more popular.

User Interaction

Not Defined0
Required3475
None1959

Some attack scenarios require some user interaction by a victim. This is typical for phishing, social engineering and cross site scripting attacks.

C3BM Index

Our unique C3BM Index (CVSSv3 Base Meta Index) cumulates the CVSSv3 Meta Base Scores of all entries over time. Comparing this index to the amount of disclosed vulnerabilities helps to pinpoint the most important events.

CVSSv3 Base

≤10
≤20
≤35
≤4127
≤5626
≤6843
≤71393
≤81602
≤9215
≤10623

The Common Vulnerability Scoring System (CVSS) is an industry standard to define the characteristics and impacts of security vulnerabilities. The base score represents the intrinsic aspects that are constant over time and across user environments. Our unique meta score merges all available scores from different sources to aggregate to the most reliable result.

CVSSv3 Temp

≤10
≤21
≤37
≤4165
≤5665
≤61166
≤71578
≤81037
≤9399
≤10416

The Common Vulnerability Scoring System (CVSS) uses temp scores to reflect the characteristics of a vulnerability that may change over time but not across user environments. This includes reporting confidence, exploitability and remediation levels. We do also provide our unique meta score for temp scores, even though other sources rarely publish them.

VulDB

≤10
≤20
≤365
≤4179
≤5921
≤6481
≤72243
≤8847
≤954
≤10644

The moderation team is always defining the base vector and base score for an entry. These and all other available scores are used to generate the meta score.

NVD

≤10
≤20
≤31
≤413
≤529
≤6127
≤7253
≤8567
≤9437
≤10791

The National Vulnerability Database (NVD) is also defining CVSS vectors and scores. These are usually not complete and might differ from VulDB scores.

CNA

≤10
≤20
≤32
≤474
≤522
≤6507
≤722
≤8577
≤913
≤1025

A CVE Numbering Authority (CNA) is responsible for assigning new CVE entries. They might also include a CVSS score. These are usually not complete and might differ from VulDB scores.

Vendor

≤10
≤20
≤30
≤40
≤51
≤68
≤72
≤813
≤91
≤105

Some vendors are willing to publish their own CVSS vectors and scores for vulnerabilities in their products. The coverage varies from vendor to vendor.

Research

≤10
≤20
≤30
≤40
≤50
≤60
≤70
≤80
≤90
≤100

There are sometimes also security researcher which provide their own CVSS vectors and scores for vulnerabilities they have found and published.

Exploit 0-day

<1k3
<2k175
<5k1089
<10k716
<25k1260
<50k1588
<100k593
≥100k10

The moderation team is working with the threat intelligence team to determine prices for exploits. Our unique algorithm is used to identify the 0-day prices for an exploit, before it got distributed or became public. Calculated prices are aligned to prices disclosed by vulnerability broker and compared to prices we see on exploit markets.

Exploit Today

<1k3716
<2k553
<5k741
<10k388
<25k29
<50k7
<100k0
≥100k0

The 0-day prices do not consider time-relevant factors. The today price does reflect price impacts like disclosure of vulnerability details, alternative exploits, availability of countermeasures. These dynamic aspects might decrease the exploit prices over time. Under certain circumstances this happens very fast.

Exploit Market Volume

Our unique calculation of exploit prices makes it possible to forecast the expected exploit market volume. The calculated prices for all possible 0-day expoits are cumulated for this task. Comparing the volume to the amount of disclosed vulnerabilities helps to pinpoint the most important events.

🔴 CTI Activities

Our unique Cyber Threat Intelligence aims to determine the ongoing research of actors to anticipiate their acitivities. Observing exploit markets on the Darknet, discussions of vulnerabilities on mailinglists, and exchanges on social media makes it possible to identify planned attacks. Monitored actors and activities are classified whether they are offensive or defensive. They are also weighted as some actors are well-known for certain products and technologies. And some of their disclosures might contain more or less details about technical aspects and personal context. The world map highlights active actors in real-time.

Affected Products (170): ACS Commons (3), AEM (7), AEM Forms Cloud Service (1), AEM Forms add-on (2), AIR (6), Acrobat (84), Acrobat 2020 (13), Acrobat Chrome Extension (1), Acrobat DC (13), Acrobat Reader (2016), Acrobat Reader 2020 (13), Acrobat Reader DC (40), Acrobat Reader Plugin (4), Acrobat reader (1), Adobe Air (1), Adobe Php Ria Sdk (1), After Affects (4), After Effects (77), Air SDK (1), Analytics AppMeasurement for Flash Library (1), Animate (44), Animate CC (1), Application Manager (1), Audition (29), Brackets (2), Breeze Licensed Server (1), Bridge (101), Bridge CC (11), CSS-Tools (2), Campaign (12), Campaign Classic (2), Captivate (4), Captivate 2019 (1), Character Animator (15), ColdFusion (135), ColdFusion 2016 (1), ColdFusion 2018 (1), ColdFusion Builder (1), ColdFusion MX (10), ColdFusion Server (3), Coldfusion MX (2), Commerce (47), Connec (1), Connect (33), Connect Enterprise Server (1), Connect Server (1), Content Server (3), Context (4), Copiler (1), Creative Cloud (3), Creative Cloud Desktop (2), Creative Cloud Desktop Application (27), Creative Suite (1), DNG Converter (2), DNG Software Development Kit (13), Device Central CS4 (1), Device Central CS5 (1), Digital Editions (71), Dimension (99), Document Server (5), Download Manager (3), Dreamweaver (7), Dreamweaver CC (1), Experience Manager (352), Experience Manager Cloud Service (4), Experience Manager Core Components (1), Experience Manager Forms (6), Extendedscript Toolkit Cs5 (1), Extension Manager CS5 (1), Flash (10), Flash Media Server (13), Flash Media Server 2 (3), Flash Player (1095), Flash Player For Linux (1), Flash Player for Linux (1), Flash Professional (1), Flex (2), Flex SDK (1), Flex Sdk (1), Form Client (1), FrameMaker (5), FrameMaker Publishing Server (1), Framemaker (56), Framemaker Publishing Server (1), Genuine Integrity Service (1), Genuine Service (4), Genuine Services (1), Graphics Server (1), Illustrator (94), Illustrator 2023 (3), Illustrator 2024 (3), Illustrator CC (8), Illustrator CS6 (1), InCopy (39), InDesign (76), InDesign CS3 (1), InDesign CS4 (1), InDesign Desktop (7), InDesign Server (2), Integrated Runtime AIR (1), JRun (3), Lightroom (2), Lightroom Classic (2), LiveCycle (4), LiveCycle Designer (1), LiveCycle Designer ES2 (1), LiveCycle ES4 (1), LiveCycle Workflow (1), Livecycle Form Manager (1), Macromedia Products (1), Magento (10), Magento Commerce (24), Magento Open Source (2), Marketo Sales Insight Plugin (1), Media Encoder (44), Medium (1), Onlocation Cs4 (1), Ops CLI (1), PageMaker (4), PhoneGap (4), PhoneGap Push Plugin (1), PhotoDeluxe (1), PhotoShop (1), Photoshop (76), Photoshop 2020 (22), Photoshop CC (46), Photoshop CC 2017 (2), Photoshop CC 2018 (2), Photoshop CC 2019 (22), Photoshop CS4 (1), Photoshop Camera Raw (2), Photoshop Desktop (6), Photoshop Elements (4), Prelude (21), Prelude CC (1), Premier Pro CS4 (1), Premiere Clip App (1), Premiere Elements (13), Premiere Elements version (1), Premiere Pro (27), Premiere Pro CC (1), Premiere Rush (23), Presenter (2), Products (4), Reader (1), Reader Mobile (2), RoboHelp (13), RoboHelp Server (12), Robohelp (1), SVG Viewer (3), Server (1), Shockwave (7), Shockwave Player (167), Stock API (2), Substance 3D Designer (6), Substance 3D Painter (23), Substance 3D Sampler (6), Substance 3D Stager (47), Technical Communications Suite (1), Thor (2), Version Cue (3), Version Cue CS3 Server (1), View (1), XD (2), XMP Toolkit (6), XMP Toolkit SDK (17), XMP Toolkit for Java (1), git-server (1), installer (1), svg-native-viewer (1)

Link to Vendor Website: https://www.adobe.com/

PublishedBaseTempVulnerabilityProdExpRemCTIEPSSCVE
02/14/20248.88.4Adobe Substance 3D Designer out-of-boundsUnknownNot DefinedOfficial Fix0.050.00000CVE-2024-20750
02/14/20248.88.4Adobe Audition heap-based overflowUnknownNot DefinedOfficial Fix0.130.00000CVE-2024-20739
02/14/20249.89.4Adobe FrameMaker Publishing Server improper authenticationUnknownNot DefinedOfficial Fix0.260.00000CVE-2024-20738
02/14/20244.34.1Adobe Substance 3D Painter out-of-boundsUnknownNot DefinedOfficial Fix0.000.00000CVE-2024-20725
02/14/20244.34.1Adobe Substance 3D Painter out-of-boundsUnknownNot DefinedOfficial Fix0.560.00000CVE-2024-20724
02/14/20244.34.1Adobe Substance 3D Painter out-of-boundsUnknownNot DefinedOfficial Fix0.040.00000CVE-2024-20722
02/14/20246.36.0Adobe Substance 3D Painter out-of-bounds writeUnknownNot DefinedOfficial Fix0.090.00000CVE-2024-20744
02/14/20246.36.0Adobe Substance 3D Painter out-of-bounds writeUnknownNot DefinedOfficial Fix0.020.00000CVE-2024-20743
02/14/20244.34.1Adobe Substance 3D Painter out-of-boundsUnknownNot DefinedOfficial Fix0.020.00000CVE-2024-20742
02/14/20244.34.1Adobe Substance 3D Painter out-of-boundsUnknownNot DefinedOfficial Fix0.450.00000CVE-2024-20741
02/14/20246.36.0Adobe Substance 3D Painter out-of-bounds writeUnknownNot DefinedOfficial Fix0.480.00000CVE-2024-20740
02/14/20246.36.0Adobe Substance 3D Painter buffer overflowUnknownNot DefinedOfficial Fix0.020.00000CVE-2024-20723
02/14/20243.53.4Adobe Commerce cross site scriptingUnknownNot DefinedOfficial Fix0.090.00000CVE-2024-20717
02/14/20242.12.0Adobe Commerce resource consumptionUnknownNot DefinedOfficial Fix0.150.00000CVE-2024-20716
02/14/20247.26.9Adobe Commerce os command injectionUnknownNot DefinedOfficial Fix0.200.00000CVE-2024-20720
02/14/20242.42.3Adobe Commerce cross site scriptingUnknownNot DefinedOfficial Fix0.310.00000CVE-2024-20719
02/14/20244.34.1Adobe Commerce cross-site request forgeryUnknownNot DefinedOfficial Fix0.110.00000CVE-2024-20718
02/14/20244.34.1Adobe Acrobat 2020 out-of-boundsDocument Reader SoftwareNot DefinedOfficial Fix0.080.00000CVE-2024-20749
02/14/20244.34.1Adobe Acrobat 2020 out-of-boundsDocument Reader SoftwareNot DefinedOfficial Fix0.020.00000CVE-2024-20748
02/14/20244.34.1Adobe Acrobat 2020 out-of-boundsDocument Reader SoftwareNot DefinedOfficial Fix0.080.00000CVE-2024-20747
02/14/20244.34.1Adobe Acrobat 2020 out-of-boundsDocument Reader SoftwareNot DefinedOfficial Fix0.020.00000CVE-2024-20736
02/14/20244.34.1Adobe Acrobat 2020 out-of-boundsDocument Reader SoftwareNot DefinedOfficial Fix0.630.00000CVE-2024-20735
02/14/20246.36.0Adobe Acrobat 2020 use after freeDocument Reader SoftwareNot DefinedOfficial Fix0.020.00000CVE-2024-20734
02/14/20244.34.1Adobe Acrobat 2020 denial of serviceDocument Reader SoftwareNot DefinedOfficial Fix0.170.00000CVE-2024-20733
02/14/20246.36.0Adobe Acrobat 2020 use after freeDocument Reader SoftwareNot DefinedOfficial Fix0.250.00000CVE-2024-20731
02/14/20246.36.0Adobe Acrobat 2020 integer overflowDocument Reader SoftwareNot DefinedOfficial Fix0.620.00000CVE-2024-20730
02/14/20246.36.0Adobe Acrobat 2020 use after freeDocument Reader SoftwareNot DefinedOfficial Fix0.070.00000CVE-2024-20729
02/14/20246.36.0Adobe Acrobat 2020 out-of-bounds writeDocument Reader SoftwareNot DefinedOfficial Fix0.170.00000CVE-2024-20728
02/14/20246.36.0Adobe Acrobat 2020 out-of-bounds writeDocument Reader SoftwareNot DefinedOfficial Fix0.080.00000CVE-2024-20727
02/14/20246.36.0Adobe Acrobat 2020 out-of-bounds writeDocument Reader SoftwareNot DefinedOfficial Fix0.150.00000CVE-2024-20726
01/18/20244.44.4Adobe Experience Manager cross site scriptingContent Management SystemNot DefinedOfficial Fix1.020.00047CVE-2023-51464
01/18/20244.44.4Adobe Experience Manager cross site scriptingContent Management SystemNot DefinedOfficial Fix1.000.00047CVE-2023-51463
01/15/20244.94.8Adobe Acrobat Reader denial of serviceDocument Reader SoftwareNot DefinedOfficial Fix0.020.00076CVE-2024-20721
01/15/20244.94.8Adobe Acrobat Reader denial of serviceDocument Reader SoftwareNot DefinedOfficial Fix0.000.00076CVE-2024-20709
01/10/20244.94.8Adobe Substance 3D Stager out-of-boundsUnknownNot DefinedOfficial Fix0.000.00092CVE-2024-20715
01/10/20244.94.8Adobe Substance 3D Stager out-of-boundsUnknownNot DefinedOfficial Fix0.080.00092CVE-2024-20714
01/10/20244.94.8Adobe Substance 3D Stager out-of-boundsUnknownNot DefinedOfficial Fix0.020.00092CVE-2024-20713
01/10/20244.94.8Adobe Substance 3D Stager out-of-boundsUnknownNot DefinedOfficial Fix0.030.00092CVE-2024-20712
01/10/20244.94.8Adobe Substance 3D Stager out-of-boundsUnknownNot DefinedOfficial Fix0.080.00092CVE-2024-20711
01/10/20244.94.8Adobe Substance 3D Stager out-of-boundsUnknownNot DefinedOfficial Fix0.000.00092CVE-2024-20710
12/20/20234.44.4Adobe Experience Manager cross site scriptingContent Management SystemNot DefinedOfficial Fix0.040.00047CVE-2023-51462
12/20/20234.44.4Adobe Experience Manager cross site scriptingContent Management SystemNot DefinedOfficial Fix0.030.00047CVE-2023-51461
12/20/20234.44.4Adobe Experience Manager cross site scriptingContent Management SystemNot DefinedOfficial Fix1.660.00047CVE-2023-51460
12/20/20234.44.4Adobe Experience Manager cross site scriptingContent Management SystemNot DefinedOfficial Fix0.040.00047CVE-2023-51459
12/20/20234.44.4Adobe Experience Manager cross site scriptingContent Management SystemNot DefinedOfficial Fix1.120.00047CVE-2023-51458
12/20/20234.44.4Adobe Experience Manager cross site scriptingContent Management SystemNot DefinedOfficial Fix1.060.00047CVE-2023-51457
12/15/20234.44.4Adobe Experience Manager cross site scriptingContent Management SystemNot DefinedOfficial Fix0.030.00047CVE-2023-47065
12/15/20234.44.4Adobe Experience Manager cross site scriptingContent Management SystemNot DefinedOfficial Fix0.060.00047CVE-2023-47064
12/15/20235.35.2Adobe Experience Manager access controlContent Management SystemNot DefinedOfficial Fix0.020.00065CVE-2023-48441
12/13/20234.94.8Adobe Dimension out-of-boundsUnknownNot DefinedOfficial Fix0.020.00198CVE-2023-47062

5384 more entries are not shown

Do you want to use VulDB in your project?

Use the official API to access entries easily!