Adobe Flash Player vulnerabilities
1,081 known vulnerabilities affecting adobe/flash_player.
Total CVEs
1,081
CISA KEV
36
actively exploited
Public exploits
183
Exploited in wild
67
Severity breakdown
CRITICAL606HIGH370MEDIUM104LOW1
Vulnerabilities
Page 54 of 55
CVE-2014-0509P4MEDIUMCVSS 4.3v11.0v11.0.1.152+76 more2014-04-08
CVE-2014-0509 [MEDIUM] CWE-79 CVE-2014-0509: Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x throug
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows remote attackers to inject arbitrary web script o
nvd
CVE-2009-0522P4MEDIUMCVSS 4.3≤ 10.0.12.36v7.0+30 more2009-02-26
CVE-2009-0522 [MEDIUM] CVE-2009-0522: Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 on Windows allows remote attacker
Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 on Windows allows remote attackers to trick a user into visiting an arbitrary URL via an unspecified manipulation of the "mouse pointer display," related to a "Clickjacking attack."
nvd
CVE-2007-3457P4MEDIUMCVSS 4.3≤ 8.0.34.02007-07-11
CVE-2007-3457 [MEDIUM] CWE-352 CVE-2007-3457: Adobe Flash Player 8.0.34.0 and earlier insufficiently validates HTTP Referer headers, which might a
Adobe Flash Player 8.0.34.0 and earlier insufficiently validates HTTP Referer headers, which might allow remote attackers to conduct a CSRF attack via a crafted SWF file.
nvd
CVE-2008-4821P4MEDIUMCVSS 4.3≤ 9.0.124.0v7.0.69.0+16 more2008-11-10
CVE-2008-4821 [MEDIUM] CWE-200 CVE-2008-4821: Adobe Flash Player 9.0.124.0 and earlier, when a Mozilla browser is used, does not properly interpre
Adobe Flash Player 9.0.124.0 and earlier, when a Mozilla browser is used, does not properly interpret jar: URLs, which allows attackers to obtain sensitive information via unknown vectors.
nvd
CVE-2008-5362P4MEDIUMCVSS 4.3≥ 9.0.16.0, < 9.0.151.0≥ 10, < 10.0.12.362008-12-08
CVE-2008-5362 [MEDIUM] CWE-20 CVE-2008-5362: The DefineConstantPool action in the ActionScript 2 virtual machine in Adobe Flash Player 10.x befor
The DefineConstantPool action in the ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, accepts an untrusted input value for a "constant count," which allows remote attackers to read sensitive data from process memory via a crafted PDF file.
nvd
CVE-2014-5333P4MEDIUMCVSS 4.3≤ 13.0.0.231v13.0.0.182+35 more2014-08-19
CVE-2014-5333 [MEDIUM] CWE-352 CVE-2014-5333: Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attacke
nvd
CVE-2015-5571P4MEDIUMCVSS 4.3≤ 11.2.202.508≤ 13.0.0.289+24 more2015-09-22
CVE-2015-5571 [MEDIUM] CVE-2015-5571: Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.
Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks again
nvd
CVE-2011-0575P4MEDIUMCVSS 6.9≤ 10.2.152v6.0.21.0+73 more2011-02-10
CVE-2011-0575 [MEDIUM] CVE-2011-0575: Untrusted search path vulnerability in Adobe Flash Player before 10.2.152.26 allows local users to g
Untrusted search path vulnerability in Adobe Flash Player before 10.2.152.26 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
nvd
CVE-2008-4818P4MEDIUMCVSS 4.3≤ 9.0.124.0v7.0.69.0+16 more2008-11-10
CVE-2008-4818 [MEDIUM] CWE-79 CVE-2008-4818: Cross-site scripting (XSS) vulnerability in Adobe Flash Player 9.0.124.0 and earlier allows remote a
Cross-site scripting (XSS) vulnerability in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving HTTP response headers.
nvd
CVE-2010-3638P4MEDIUMCVSS 4.3≤ 9.0.277.0v9.0.16+39 more2010-11-07
CVE-2010-3638 [MEDIUM] CVE-2010-3638: Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Mac
Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Mac OS X, when Safari is used, allows attackers to obtain sensitive information via unknown vectors.
nvd
CVE-2010-2215P4MEDIUMCVSS 4.3≤ 10.1.53.64v7.0+45 more2010-08-11
CVE-2010-2215 [MEDIUM] CVE-2010-2215: Adobe Flash Player before 9.0.280 and 10.x before 10.1.82.76, and Adobe AIR before 2.0.3, allows att
Adobe Flash Player before 9.0.280 and 10.x before 10.1.82.76, and Adobe AIR before 2.0.3, allows attackers to trick a user into (1) selecting a link or (2) completing a dialog, related to a "click-jacking" issue.
nvd
CVE-2012-4168P4MEDIUMCVSS 4.3≥ 10.3, < 10.3.183.23≥ 11.4, < 11.4.402.265+3 more2012-08-21
CVE-2012-4168 [MEDIUM] CWE-200 CVE-2012-4168: Adobe Flash Player before 10.3.183.23 and 11.x before 11.4.402.265 on Windows and Mac OS X, before 1
Adobe Flash Player before 10.3.183.23 and 11.x before 11.4.402.265 on Windows and Mac OS X, before 10.3.183.23 and 11.x before 11.2.202.238 on Linux, before 11.1.111.16 on Android 2.x and 3.x, and before 11.1.115.17 on Android 4.x; Adobe AIR before 3.4.0.2540; and Adobe AIR SDK before 3.4.0.2540 allow remote attackers to read content from a different
nvd
CVE-2015-3101P4MEDIUMCVSS 4.3≤ 13.0.0.289v14.0.0.125+17 more2015-06-10
CVE-2015-3101 [MEDIUM] CWE-264 CVE-2015-3101: The Flash broker in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on
The Flash broker in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144
nvd
CVE-2010-2179P4MEDIUMCVSS 4.3fixed in 9.0.277.0≥ 10.0.0.0, < 10.1.53.642010-06-15
CVE-2010-2179 [MEDIUM] CWE-79 CVE-2010-2179: Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, when Firefox or Chrome is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to URL parsing.
nvd
CVE-2010-2172P4MEDIUMCVSS 4.3v9.0.16v9.0.20+17 more2010-06-15
CVE-2010-2172 [MEDIUM] CVE-2010-2172: Adobe Flash Player 9 before 9.0.277.0 on unspecified UNIX platforms allows attackers to cause a deni
Adobe Flash Player 9 before 9.0.277.0 on unspecified UNIX platforms allows attackers to cause a denial of service via unknown vectors.
nvd
CVE-2008-4823P4MEDIUMCVSS 4.3≤ 9.0.124.0v7.0.69.0+16 more2008-11-10
CVE-2008-4823 [MEDIUM] CWE-79 CVE-2008-4823: Cross-site scripting (XSS) vulnerability in Adobe Flash Player 9.0.124.0 and earlier allows remote a
Cross-site scripting (XSS) vulnerability in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to loose interpretation of an ActionScript attribute.
nvd
CVE-2007-6637P4MEDIUMCVSS 4.3v7.0.25v7.0.63+16 more2008-01-04
CVE-2007-6637 [MEDIUM] CVE-2007-6637: Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player allow remote attackers to
Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via a crafted SWF file, related to "pre-generated SWF files" and Adobe Dreamweaver CS3 or Adobe Acrobat Connect. NOTE: the asfunction: vector is already covered by CVE-2007-6244.1.
nvd
CVE-2009-1867P4MEDIUMCVSS 4.3≤ 10.0.22.87v7.0+29 more2009-07-31
CVE-2009-1867 [MEDIUM] CWE-59 CVE-2009-1867: Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows a
Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to trick a user into (1) selecting a link or (2) completing a dialog, related to a "clickjacking vulnerability."
nvd
CVE-2008-5363P4MEDIUMCVSS 4.3≥ 9.0.16.0, < 9.0.151.0≥ 10, < 10.0.12.362008-12-08
CVE-2008-5363 [MEDIUM] CWE-399 CVE-2008-5363: The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.1
The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not validate character elements during retrieval from the dictionary data structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF file.
nvd
CVE-2006-3588P4LOWCVSS 2.6v8.0.24.02006-07-13
CVE-2006-3588 [LOW] CVE-2006-3588: Unspecified vulnerability in Adobe (Macromedia) Flash Player 8.0.24.0 allows remote attackers to cau
Unspecified vulnerability in Adobe (Macromedia) Flash Player 8.0.24.0 allows remote attackers to cause a denial of service (browser crash) via a malformed, compressed .swf file, a different issue than CVE-2006-3587.
nvd