Adobe Flash Player vulnerabilities
1,081 known vulnerabilities affecting adobe/flash_player.
Total CVEs
1,081
CISA KEV
36
actively exploited
Public exploits
183
Exploited in wild
46
Severity breakdown
CRITICAL607HIGH369MEDIUM104LOW1
Vulnerabilities
Page 53 of 55
CVE-2009-1867MEDIUMCVSS 4.3≤ 10.0.22.87v7.0+29 more2009-07-31
CVE-2009-1867 [MEDIUM] CWE-59 CVE-2009-1867: Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows a
Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to trick a user into (1) selecting a link or (2) completing a dialog, related to a "clickjacking vulnerability."
nvd
CVE-2009-1870MEDIUMCVSS 4.9≤ 10.0.22.87v7.0+29 more2009-07-31
CVE-2009-1870 [MEDIUM] CWE-200 CVE-2009-1870: Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows a
Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to obtain sensitive information via vectors involving saving an SWF file to a hard drive, related to a "local sandbox vulnerability."
nvd
CVE-2009-1862HIGHCVSS 7.8KEV≥ 9.0, ≤ 9.0.159.0≥ 10.0, ≤ 10.0.22.872009-07-23
CVE-2009-1862 [HIGH] CWE-787 CVE-2009-1862: Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x
Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exp
nvd
CVE-2009-0520CRITICALCVSS 9.3PoC≤ 10.0.12.36v7.0+30 more2009-02-26
CVE-2009-0520 [CRITICAL] CWE-119 CVE-2009-0520: Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove referenc
Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave Flash file processing, which allows remote attackers to execute arbitrary code via a crafted file, related to a "buffer overflow issue."
nvd
CVE-2009-0519CRITICALCVSS 9.3≤ 10.0.12.36v7.0+30 more2009-02-26
CVE-2009-0519 [CRITICAL] CWE-20 CVE-2009-0519: Unspecified vulnerability in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 allo
Unspecified vulnerability in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a crafted Shockwave Flash (aka .swf) file.
nvd
CVE-2009-0522MEDIUMCVSS 4.3≤ 10.0.12.36v7.0+30 more2009-02-26
CVE-2009-0522 [MEDIUM] CVE-2009-0522: Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 on Windows allows remote attacker
Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 on Windows allows remote attackers to trick a user into visiting an arbitrary URL via an unspecified manipulation of the "mouse pointer display," related to a "Clickjacking attack."
nvd
CVE-2009-0114MEDIUMCVSS 5.8≤ 10.0.12.36v7.0+30 more2009-02-26
CVE-2009-0114 [MEDIUM] CVE-2009-0114: Unspecified vulnerability in the Settings Manager in Adobe Flash Player 9.x before 9.0.159.0 and 10.
Unspecified vulnerability in the Settings Manager in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87, and possibly other versions, allows remote attackers to trick a user into visiting an arbitrary URL via unknown vectors, related to "a potential Clickjacking issue variant."
nvd
CVE-2008-5363MEDIUMCVSS 4.3≥ 9.0.16.0, < 9.0.151.0≥ 10, < 10.0.12.362008-12-08
CVE-2008-5363 [MEDIUM] CWE-399 CVE-2008-5363: The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.1
The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not validate character elements during retrieval from the dictionary data structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF file.
nvd
CVE-2008-5361MEDIUMCVSS 4.3≥ 9.0.16.0, < 9.0.151.0≥ 10, < 10.0.12.362008-12-08
CVE-2008-5361 [MEDIUM] CWE-399 CVE-2008-5361: The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.1
The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not verify a member element's size when performing (1) DefineConstantPool, (2) ActionJump, (3) ActionPush, (4) ActionTry, and unspecified other actions, which allows remote attackers to read sensitive data from proce
nvd
CVE-2008-5362MEDIUMCVSS 4.3≥ 9.0.16.0, < 9.0.151.0≥ 10, < 10.0.12.362008-12-08
CVE-2008-5362 [MEDIUM] CWE-20 CVE-2008-5362: The DefineConstantPool action in the ActionScript 2 virtual machine in Adobe Flash Player 10.x befor
The DefineConstantPool action in the ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, accepts an untrusted input value for a "constant count," which allows remote attackers to read sensitive data from process memory via a crafted PDF file.
nvd
CVE-2008-4824CRITICALCVSS 9.3≥ 9.0.16.0, < 9.0.151.0≥ 10, < 10.0.12.362008-11-17
CVE-2008-4824 [CRITICAL] CWE-20 CVE-2008-4824: Multiple unspecified vulnerabilities in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0
Multiple unspecified vulnerabilities in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0 allow remote attackers to execute arbitrary code via unknown vectors related to "input validation errors."
nvd
CVE-2008-4820HIGHCVSS 7.1≤ 9.0.124.0v7.0.69.0+16 more2008-11-10
CVE-2008-4820 [HIGH] CWE-200 CVE-2008-4820: Unspecified vulnerability in the Flash Player ActiveX control in Adobe Flash Player 9.0.124.0 and ea
Unspecified vulnerability in the Flash Player ActiveX control in Adobe Flash Player 9.0.124.0 and earlier on Windows allows attackers to obtain sensitive information via unknown vectors.
nvd
CVE-2008-4818MEDIUMCVSS 4.3≤ 9.0.124.0v7.0.69.0+16 more2008-11-10
CVE-2008-4818 [MEDIUM] CWE-79 CVE-2008-4818: Cross-site scripting (XSS) vulnerability in Adobe Flash Player 9.0.124.0 and earlier allows remote a
Cross-site scripting (XSS) vulnerability in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving HTTP response headers.
nvd
CVE-2008-4819MEDIUMCVSS 6.8≤ 9.0.124.0v7.0.69.0+16 more2008-11-10
CVE-2008-4819 [MEDIUM] CVE-2008-4819: Unspecified vulnerability in Adobe Flash Player 9.0.124.0 and earlier makes it easier for remote att
Unspecified vulnerability in Adobe Flash Player 9.0.124.0 and earlier makes it easier for remote attackers to conduct DNS rebinding attacks via unknown vectors.
nvd
CVE-2008-4822MEDIUMCVSS 6.8≤ 9.0.124.0v7.0.69.0+16 more2008-11-10
CVE-2008-4822 [MEDIUM] CWE-264 CVE-2008-4822: Adobe Flash Player 9.0.124.0 and earlier does not properly interpret policy files, which allows remo
Adobe Flash Player 9.0.124.0 and earlier does not properly interpret policy files, which allows remote attackers to bypass a non-root domain policy.
nvd
CVE-2008-4821MEDIUMCVSS 4.3≤ 9.0.124.0v7.0.69.0+16 more2008-11-10
CVE-2008-4821 [MEDIUM] CWE-200 CVE-2008-4821: Adobe Flash Player 9.0.124.0 and earlier, when a Mozilla browser is used, does not properly interpre
Adobe Flash Player 9.0.124.0 and earlier, when a Mozilla browser is used, does not properly interpret jar: URLs, which allows attackers to obtain sensitive information via unknown vectors.
nvd
CVE-2008-4823MEDIUMCVSS 4.3≤ 9.0.124.0v7.0.69.0+16 more2008-11-10
CVE-2008-4823 [MEDIUM] CWE-79 CVE-2008-4823: Cross-site scripting (XSS) vulnerability in Adobe Flash Player 9.0.124.0 and earlier allows remote a
Cross-site scripting (XSS) vulnerability in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to loose interpretation of an ActionScript attribute.
nvd
CVE-2008-4473CRITICALCVSS 9.3vcs3vmx_20042008-10-17
CVE-2008-4473 [CRITICAL] CWE-119 CVE-2008-4473: Multiple heap-based buffer overflows in Adobe Flash CS3 Professional on Windows and Flash MX 2004 al
Multiple heap-based buffer overflows in Adobe Flash CS3 Professional on Windows and Flash MX 2004 allow remote attackers to execute arbitrary code via an SWF file containing long control parameters.
nvd
CVE-2008-4401CRITICALCVSS 10.0≤ 9.0.124.0v7.0+18 more2008-10-17
CVE-2008-4401 [CRITICAL] CWE-264 CVE-2008-4401: ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjun
ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download operation in the FileReference download API, which allows remote attackers to create a browse dialog box, and possibly have unspecified
nvd
CVE-2008-4546MEDIUMCVSS 4.3PoCv9.0.45.0v9.0.112.0+2 more2008-10-14
CVE-2008-4546 [MEDIUM] CWE-399 CVE-2008-4546: Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, al
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows remote web servers to cause a denial of service (NULL pointer dereference and browser crash) by returning a different response when an HTTP request is sent a second time, as demonstrated by two responses that provide SWF files with different SWF ve
nvd