Vulnerabilites related to adobe - flex_data_services
Vulnerability from fkie_nvd
Published
2010-02-15 18:30
Modified
2025-02-05 13:58
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| adobe | blazeds | * | |
| adobe | coldfusion | 7.0.2 | |
| adobe | coldfusion | 8.0 | |
| adobe | coldfusion | 8.0.1 | |
| adobe | coldfusion | 9.0 | |
| adobe | flex_data_services | 2.0.1 | |
| adobe | livecycle | 8.0.1 | |
| adobe | livecycle | 8.2.1 | |
| adobe | livecycle | 9.0 | |
| adobe | livecycle_data_services | 2.5.1 | |
| adobe | livecycle_data_services | 2.6.1 | |
| adobe | livecycle_data_services | 3.0 |
{ cisaActionDue: "2022-09-07", cisaExploitAdd: "2022-03-07", cisaRequiredAction: "Apply updates per vendor instructions.", cisaVulnerabilityName: "Adobe BlazeDS Information Disclosure Vulnerability", configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:adobe:blazeds:*:*:*:*:*:*:*:*", matchCriteriaId: "AEF7C97E-BE99-415D-B12B-D3E7BD9EDF08", versionEndIncluding: "3.2", vulnerable: true, }, { criteria: "cpe:2.3:a:adobe:coldfusion:7.0.2:*:*:*:*:*:*:*", matchCriteriaId: "B015715F-9672-480E-B0AA-968D8C9070D5", vulnerable: true, }, { criteria: "cpe:2.3:a:adobe:coldfusion:8.0:*:*:*:*:*:*:*", matchCriteriaId: "DD6C1877-7412-4FBE-9641-334971F9D153", vulnerable: true, }, { criteria: "cpe:2.3:a:adobe:coldfusion:8.0.1:*:*:*:*:*:*:*", matchCriteriaId: "28C8D6AF-EDE1-42BD-A47C-2EF8690299BD", vulnerable: true, }, { criteria: "cpe:2.3:a:adobe:coldfusion:9.0:*:*:*:*:*:*:*", matchCriteriaId: "113431FB-E4BE-4416-800C-6B13AD1C0E92", vulnerable: true, }, { criteria: "cpe:2.3:a:adobe:flex_data_services:2.0.1:*:*:*:*:*:*:*", matchCriteriaId: "B6F65E3F-F3E7-4BE9-A13B-87FFF3B3777E", vulnerable: true, }, { criteria: "cpe:2.3:a:adobe:livecycle:8.0.1:*:*:*:*:*:*:*", matchCriteriaId: "3890CE6C-D8D0-4406-ACE1-9849CFCA72F4", vulnerable: true, }, { criteria: "cpe:2.3:a:adobe:livecycle:8.2.1:*:*:*:*:*:*:*", matchCriteriaId: "82D29A25-10F2-4FFB-A9BC-B7AAD6D1A18A", vulnerable: true, }, { criteria: "cpe:2.3:a:adobe:livecycle:9.0:*:*:*:*:*:*:*", matchCriteriaId: "E6804632-7EA5-45AB-91A3-C05D3426CA9F", vulnerable: true, }, { criteria: "cpe:2.3:a:adobe:livecycle_data_services:2.5.1:*:*:*:*:*:*:*", matchCriteriaId: "262ED6C7-3C78-4863-9056-A9D55C7DB6CC", vulnerable: true, }, { criteria: "cpe:2.3:a:adobe:livecycle_data_services:2.6.1:*:*:*:*:*:*:*", matchCriteriaId: "BEFE9CD7-0DB5-4038-AFB5-1B756186605C", vulnerable: true, }, { criteria: "cpe:2.3:a:adobe:livecycle_data_services:3.0:*:*:*:*:*:*:*", matchCriteriaId: "2EE5075B-DB11-47F3-9601-F4956ECF5047", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.", }, { lang: "es", value: "Vulnerabilidad sin especificar en BlazeDS v3.2 y anteriores, tal como es utilizado en LiveCycle v8.0.1, v8.2.1 y v9.0, LiveCycle Data Services v2.5.1, v2.6.1 y v3.0, Flex Data Services v2.0.1 y ColdFusion v7.0.2, v8.0, v8.0.1 y v9.0. Permite a atacantes remotos obtener información confidencial a través de vectores de ataque asociados con una petición, y relacionados con una etiqueta inyectada y una referencia a una entidad externa en documentos XML.", }, ], id: "CVE-2009-3960", lastModified: "2025-02-05T13:58:19.200", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:M/Au:N/C:P/I:N/A:N", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 3.6, source: "nvd@nist.gov", type: "Primary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 3.6, source: "134c704f-9b21-4f2e-91b3-4a467353bcc0", type: "Secondary", }, ], }, published: "2010-02-15T18:30:00.407", references: [ { source: "psirt@adobe.com", tags: [ "Broken Link", ], url: "http://secunia.com/advisories/38543", }, { source: "psirt@adobe.com", tags: [ "Broken Link", "Third Party Advisory", "VDB Entry", ], url: "http://securitytracker.com/id?1023584", }, { source: "psirt@adobe.com", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://www.adobe.com/support/security/bulletins/apsb10-05.html", }, { source: "psirt@adobe.com", tags: [ "Broken Link", ], url: "http://www.osvdb.org/62292", }, { source: "psirt@adobe.com", tags: [ "Broken Link", "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/38197", }, { source: "psirt@adobe.com", tags: [ "Exploit", "Third Party Advisory", "VDB Entry", ], url: "https://www.exploit-db.com/exploits/41855/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "http://secunia.com/advisories/38543", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", "Third Party Advisory", "VDB Entry", ], url: "http://securitytracker.com/id?1023584", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", "Vendor Advisory", ], url: "http://www.adobe.com/support/security/bulletins/apsb10-05.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "http://www.osvdb.org/62292", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/38197", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Exploit", "Third Party Advisory", "VDB Entry", ], url: "https://www.exploit-db.com/exploits/41855/", }, ], sourceIdentifier: "psirt@adobe.com", vulnStatus: "Analyzed", weaknesses: [ { description: [ { lang: "en", value: "NVD-CWE-noinfo", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
cve-2009-3960
Vulnerability from cvelistv5
Published
2010-02-15 18:00
Modified
2025-02-04 21:46
Severity ?
EPSS score ?
Summary
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/38197 | vdb-entry, x_refsource_BID | |
| http://securitytracker.com/id?1023584 | vdb-entry, x_refsource_SECTRACK | |
| http://www.osvdb.org/62292 | vdb-entry, x_refsource_OSVDB | |
| http://secunia.com/advisories/38543 | third-party-advisory, x_refsource_SECUNIA | |
| https://www.exploit-db.com/exploits/41855/ | exploit, x_refsource_EXPLOIT-DB | |
| http://www.adobe.com/support/security/bulletins/apsb10-05.html | x_refsource_CONFIRM |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-07T06:45:50.647Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "38197", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/38197", }, { name: "1023584", tags: [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred", ], url: "http://securitytracker.com/id?1023584", }, { name: "62292", tags: [ "vdb-entry", "x_refsource_OSVDB", "x_transferred", ], url: "http://www.osvdb.org/62292", }, { name: "38543", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/38543", }, { name: "41855", tags: [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred", ], url: "https://www.exploit-db.com/exploits/41855/", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://www.adobe.com/support/security/bulletins/apsb10-05.html", }, ], title: "CVE Program Container", }, { metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", version: "3.1", }, }, { other: { content: { id: "CVE-2009-3960", options: [ { Exploitation: "active", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2025-02-04T21:42:52.303476Z", version: "2.0.3", }, type: "ssvc", }, }, { other: { content: { dateAdded: "2022-03-07", reference: "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-3960", }, type: "kev", }, }, ], problemTypes: [ { descriptions: [ { description: "CWE-noinfo Not enough information", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-02-04T21:46:04.783Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2010-02-11T00:00:00.000Z", descriptions: [ { lang: "en", value: "Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2017-08-15T09:57:01.000Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { name: "38197", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/38197", }, { name: "1023584", tags: [ "vdb-entry", "x_refsource_SECTRACK", ], url: "http://securitytracker.com/id?1023584", }, { name: "62292", tags: [ "vdb-entry", "x_refsource_OSVDB", ], url: "http://www.osvdb.org/62292", }, { name: "38543", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/38543", }, { name: "41855", tags: [ "exploit", "x_refsource_EXPLOIT-DB", ], url: "https://www.exploit-db.com/exploits/41855/", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://www.adobe.com/support/security/bulletins/apsb10-05.html", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "psirt@adobe.com", ID: "CVE-2009-3960", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "38197", refsource: "BID", url: "http://www.securityfocus.com/bid/38197", }, { name: "1023584", refsource: "SECTRACK", url: "http://securitytracker.com/id?1023584", }, { name: "62292", refsource: "OSVDB", url: "http://www.osvdb.org/62292", }, { name: "38543", refsource: "SECUNIA", url: "http://secunia.com/advisories/38543", }, { name: "41855", refsource: "EXPLOIT-DB", url: "https://www.exploit-db.com/exploits/41855/", }, { name: "http://www.adobe.com/support/security/bulletins/apsb10-05.html", refsource: "CONFIRM", url: "http://www.adobe.com/support/security/bulletins/apsb10-05.html", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2009-3960", datePublished: "2010-02-15T18:00:00.000Z", dateReserved: "2009-11-16T00:00:00.000Z", dateUpdated: "2025-02-04T21:46:04.783Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }