Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
t execute commands or access sensitive files on the EDA worker. In OpenShift, it can lead to service account token theft. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:9986 - https://access.redhat.com/security/cve/CVE-2025-49521 - https://bugzilla.redhat.com/show_bug.cgi?id=2370817
CVE ID: CVE-2025-49524 State: PUBLISHED Published: 2025-07-08T22:01:11.807Z Last Updated: 2025-07-09T13:28:22.275Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-476 Description: Illustrator versions 28.7.6, 29.5.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing a disruption in service. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.ado
a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb25-65.html
CVE ID: CVE-2025-49525 State: PUBLISHED Published: 2025-07-08T22:01:07.347Z Last Updated: 2025-07-09T19:15:49.199Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Illustrator Problem Types: CWE-125 Description: Illustrator versions 28.7.6, 29.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb25-65.html
CVE ID: CVE-2025-49526 State: PUBLISHED Published: 2025-07-08T22:01:04.435Z Last Updated: 2025-07-10T03:55:40.365Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-787 Description: Illustrator versions 28.7.6, 29.5.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb25-65.html
CVE ID: CVE-2025-49527 State: PUBLISHED Published: 2025-07-08T22:01:09.485Z Last Updated: 2025-07-10T03:55:38.152Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-121 Description: Illustrator versions 28.7.6, 29.5.1 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb25-65.html
CVE ID: CVE-2025-49528 State: PUBLISHED Published: 2025-07-08T22:01:11.060Z Last Updated: 2025-07-10T03:55:37.022Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-121 Description: Illustrator versions 28.7.6, 29.5.1 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb25-65.html
CVE ID: CVE-2025-49529 State: PUBLISHED Published: 2025-07-08T22:01:06.580Z Last Updated: 2025-07-10T03:55:42.821Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-824 Description: Illustrator versions 28.7.6, 29.5.1 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb25-65.html
CVE ID: CVE-2025-49530 State: PUBLISHED Published: 2025-07-08T22:01:05.799Z Last Updated: 2025-07-10T03:55:41.448Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-787 Description: Illustrator versions 28.7.6, 29.5.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb25-65.html
CVE ID: CVE-2025-49531 State: PUBLISHED Published: 2025-07-08T22:01:10.256Z Last Updated: 2025-07-10T03:55:43.968Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-190 Description: Illustrator versions 28.7.6, 29.5.1 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb25-65.html
CVE ID: CVE-2025-49532 State: PUBLISHED Published: 2025-07-08T22:01:08.703Z Last Updated: 2025-07-10T03:55:45.574Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-191 Description: Illustrator versions 28.7.6, 29.5.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb25-65.html
CVE ID: CVE-2025-49533 State: PUBLISHED Published: 2025-07-08T21:32:12.973Z Last Updated: 2025-07-10T03:55:57.876Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Adobe Experience Manager (MS) Problem Types: CWE-502 Description: Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction. Scope is unchanged. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/aem-forms/apsb25-67.html
CVE ID: CVE-2025-49534 State: PUBLISHED Published: 2025-07-08T21:40:35.588Z Last Updated: 2025-07-09T13:26:22.745Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 11.4 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Scope is changed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
page containing the vulnerable field. Scope is changed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/aem-screens/apsb25-68.html
CVE ID: CVE-2025-49535 State: PUBLISHED Published: 2025-07-08T20:49:40.710Z Last Updated: 2025-07-09T16:05:25.413Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H) Vendors: Adobe Products: ColdFusion Problem Types: CWE-611 Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a Security feature bypass. An attacker could exploit this vulnerability to access sensitive information or denial of service by bypassing security measures. Exploitation of this issue does not require user interaction and scope is changed. The vulnerable component
y measures. Exploitation of this issue does not require user interaction and scope is changed. The vulnerable component is restricted to internal IP addresses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE ID: CVE-2025-49536 State: PUBLISHED Published: 2025-07-08T20:49:39.291Z Last Updated: 2025-07-10T03:55:47.807Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Adobe Products: ColdFusion Problem Types: CWE-863 Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction. The vulnerable component is restricted to internal IP addresses. Additional Analyst Notes: - CISA AD
e user interaction. The vulnerable component is restricted to internal IP addresses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE ID: CVE-2025-49537 State: PUBLISHED Published: 2025-07-08T20:49:35.749Z Last Updated: 2025-07-10T03:55:46.681Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Adobe Products: ColdFusion Problem Types: CWE-78 Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code execution by a high-privileged attacker. Exploitation of this issue requires user interaction and scope is changed. The vulnerable component is restricted to internal IP addresses. Additional Analyst Notes: - CISA ADP Vulnrichme
hanged. The vulnerable component is restricted to internal IP addresses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE ID: CVE-2025-49538 State: PUBLISHED Published: 2025-07-08T20:49:29.949Z Last Updated: 2025-07-09T16:06:34.728Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: Adobe Products: ColdFusion Problem Types: CWE-91 Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An attacker can exploit this issue by injecting crafted XML or XPath queries to access unauthorized files or lead to denial of service. Exploitation of this issue does not require user interaction, and attack must have access to shared secrets. Additional Analyst Notes: - CISA ADP Vulnrichme
require user interaction, and attack must have access to shared secrets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE ID: CVE-2025-49539 State: PUBLISHED Published: 2025-07-08T20:49:38.539Z Last Updated: 2025-07-09T16:05:37.961Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Adobe Products: ColdFusion Problem Types: CWE-611 Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information. Exploitation of this issue does not require user interaction. The vulnerable component is restricted to internal IP addresses. Additional Analyst
does not require user interaction. The vulnerable component is restricted to internal IP addresses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE ID: CVE-2025-49540 State: PUBLISHED Published: 2025-07-08T20:49:30.821Z Last Updated: 2025-07-09T16:06:28.771Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: ColdFusion Problem Types: CWE-79 Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field, scope is changed. The vulnerable component is restricted to internal IP addresses. Additi
ntaining the vulnerable field, scope is changed. The vulnerable component is restricted to internal IP addresses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE ID: CVE-2025-49541 State: PUBLISHED Published: 2025-07-08T20:49:36.512Z Last Updated: 2025-07-09T16:05:52.292Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: ColdFusion Problem Types: CWE-79 Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field, scope is changed. The vulnerable component is restricted to internal IP addresses. Additi
CVE ID: CVE-2025-49542 State: PUBLISHED Published: 2025-07-08T20:49:41.481Z Last Updated: 2025-07-09T16:05:20.373Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: ColdFusion Problem Types: CWE-79 Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser, scope is changed. The vulnerable component is restricted to internal IP addresses. Additional Analyst Notes: - CISA ADP
scope is changed. The vulnerable component is restricted to internal IP addresses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE ID: CVE-2025-49543 State: PUBLISHED Published: 2025-07-08T20:49:31.639Z Last Updated: 2025-07-09T16:06:23.556Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: ColdFusion Problem Types: CWE-79 Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field, scope is changed. The vulnerable component is restricted to internal IP addresses. Additi
CVE ID: CVE-2025-49544 State: PUBLISHED Published: 2025-07-08T20:49:32.779Z Last Updated: 2025-07-09T16:06:17.709Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Adobe Products: ColdFusion Problem Types: CWE-611 Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information or bypass security measures. Exploitation of this issue does not require user interaction and scope is changed. Additional Analyst Notes: - CISA AD
. Exploitation of this issue does not require user interaction and scope is changed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE ID: CVE-2025-49545 State: PUBLISHED Published: 2025-07-08T20:49:37.785Z Last Updated: 2025-07-09T16:05:44.177Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Adobe Products: ColdFusion Problem Types: CWE-918 Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privilege authenticated attacker can force the application to make arbitrary requests via injection of URLs. Exploitation of this issue does not require user interaction and scope is changed. The vulnerable component is restricted to internal IP addresses. Addit
ot require user interaction and scope is changed. The vulnerable component is restricted to internal IP addresses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE ID: CVE-2025-49546 State: PUBLISHED Published: 2025-07-08T20:49:33.560Z Last Updated: 2025-07-14T20:53:48.403Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: Adobe Products: ColdFusion Problem Types: CWE-284 Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Access Control vulnerability that could lead to a partial application denial-of-service. A high-privileged attacker could exploit this vulnerability to partially disrupt the availability of the application. Exploitation of this issue does not require user interaction and scope is unchanged. The vulnerable component is restricted to internal IP addresses. A
not require user interaction and scope is unchanged. The vulnerable component is restricted to internal IP addresses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE ID: CVE-2025-49547 State: PUBLISHED Published: 2025-07-08T21:40:36.387Z Last Updated: 2025-07-09T13:25:30.605Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 11.4 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Scope is changed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
CVE ID: CVE-2025-49549 State: PUBLISHED Published: 2025-06-25T17:41:13.652Z Last Updated: 2025-06-25T18:12:41.002Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-863 Description: Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
ploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb25-50.html
CVE ID: CVE-2025-49550 State: PUBLISHED Published: 2025-06-25T17:41:58.948Z Last Updated: 2025-06-25T18:08:05.106Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-863 Description: Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access. Exploitation of this issue requires user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.a
f this issue requires user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb25-50.html
CVE ID: CVE-2025-49551 State: PUBLISHED Published: 2025-07-08T20:49:34.964Z Last Updated: 2025-07-10T03:55:39.264Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Adobe Products: ColdFusion Problem Types: CWE-798 Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a Use of Hard-coded Credentials vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain unauthorized access to sensitive systems or data. Exploitation of this issue does not require user interaction. The vulnerable component is restricted to internal IP addresses. Additional Analyst Notes: - CISA ADP Vulnrichment
tion. The vulnerable component is restricted to internal IP addresses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE ID: CVE-2025-49552 State: PUBLISHED Published: 2025-10-14T21:53:32.953Z Last Updated: 2025-10-21T03:55:31.199Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: Adobe Products: Adobe Connect Problem Types: CWE-79 Description: Adobe Connect versions 12.9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a high-privileged attacker to execute malicious scripts in a victim's browser. Exploitation of this issue requires user interaction in that a victim must navigate to a crafted web page. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact
. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. Scope is changed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/connect/apsb25-70.html
CVE ID: CVE-2025-49553 State: PUBLISHED Published: 2025-10-14T21:53:32.190Z Last Updated: 2025-10-21T03:55:30.116Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: Adobe Products: Adobe Connect Problem Types: CWE-79 Description: Adobe Connect versions 12.9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute malicious scripts in a victim's browser. Exploitation of this issue requires user interaction in that a victim must navigate to a crafted web page. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. Sc
ful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. Scope is changed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/connect/apsb25-70.html