Macromedia vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2007-1403 Multiple stack-based buffer overflows in an ActiveX control in SwDir.dll 10.1.4.20 in Macromedia Shockwave allow remote attackers to cause a denial of service (High 7.5 · Mar 10, 2007
• CVE-2006-3979 The AdminAPI of ColdFusion MX 7 allows attackers to bypass authentication by using "programmatic access" to the adminAPI instead of the ColdFusion AdministratorHigh 7.2 · Aug 9, 2006
• CVE-2005-4472 Stack-based buffer overflow in the Macromedia JRun 4 web server (JWS) allows remote attackers to cause a denial of service and possibly execute arbitrary code vHigh 7.5 · Dec 21, 2005
• CVE-2005-4342 ColdFusion Sandbox on Adobe (formerly Macromedia) ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 does not throw an exception if the SecurityManager is disabled,High 7.5 · Dec 18, 2005
• CVE-2005-4345 Adobe (formerly Macromedia) ColdFusion MX 7.0 exposes the password hash of the Administrator in an API call, which allows local developers to obtain the hash anHigh 7.2 · Dec 18, 2005
• CVE-2005-4216 The Administration Service (FMSAdmin.exe) in Macromedia Flash Media Server 2.0 r1145 allows remote attackers to cause a denial of service (application crash) viHigh 7.8 · Dec 14, 2005
• CVE-2005-3901 Macromedia Flash Communication Server MX 1.0 and 1.5 does not sufficiently validate certain RTMP data, which allows attackers to cause a denial of service (instHigh 7.8 · Nov 29, 2005
• CVE-2005-3591 Macromedia Flash plugin (1) Flash.ocx 7.0.19.0 (Windows) and earlier and (2) libflashplayer.so before 7.0.25.0 (Unix) allows remote attackers to cause a denial High 7.5 · Nov 16, 2005
• CVE-2004-2182 Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by theHigh 7.5 · Dec 31, 2004
• CVE-2004-2204 Macromedia ColdFusion MX 6.0 and 6.1 application server, when running with the CreateObject function or CFOBJECT tag enabled, allows local users to conduct unauHigh 7.2 · Dec 31, 2004
• CVE-2004-2335 The Macromedia installers and e-licensing client on Mac OS X, as used for Macromedia Contribute 2, Director, Dreamweaver, Fireworks, Flash, and Studio, install High 7.2 · Dec 31, 2004
• CVE-2004-0646 Buffer overflow in the WriteToLog function for JRun 3.0 through 4.0 web server connectors, such as (1) mod_jrun and (2) mod_jrun20 for Apache, with verbose loggHigh 10 · Dec 23, 2004
• CVE-2002-1382 Macromedia Flash Player before 6.0.65.0 allows remote attackers to execute arbitrary code via certain malformed data headers in Shockwave Flash file format (SWFHigh 7.5 · Dec 23, 2002
• CVE-2002-1309 Heap-based buffer overflow in the error-handling mechanism for the IIS ISAPI handler in Macromedia ColdFusion 6.0 allows remote attackers to execute arbitrary vHigh 7.5 · Nov 29, 2002
• CVE-2002-1310 Heap-based buffer overflow in the error-handling mechanism for the IIS ISAPI handler in Macromedia JRun 4.0 and earlier allows remote attackers to execute arbitHigh 7.5 · Nov 29, 2002
• CVE-2002-1027 Cross-site scripting vulnerability in the default HTTP 500 error script (500error.jsp) for Macromedia Sitespring 1.2.0 (277.1) allows remote attackers to executHigh 7.5 · Oct 4, 2002
• CVE-2002-0477 Standalone Macromedia Flash Player 5.0 before 5,0,30,2 allows remote attackers to execute arbitrary programs via a .SWF file containing the "exec" FSCommand.High 7.5 · Aug 12, 2002
• CVE-2002-0801 Buffer overflow in the ISAPI DLL filter for Macromedia JRun 3.1 allows remote attackers to execute arbitrary code via a direct request to the filter with a longHigh 10 · Aug 12, 2002
• CVE-2002-0846 The decoder for Macromedia Shockwave Flash allows remote attackers to execute arbitrary code via a malformed SWF header that contains more data than the specifiHigh 7.5 · Aug 12, 2002
• CVE-2002-0665 Macromedia JRun Administration Server allows remote attackers to bypass authentication on the login form via an extra slash (/) in the URL.High 10 · Jul 11, 2002
• CVE-2002-0605 Buffer overflow in Flash OCX for Macromedia Flash 6 revision 23 (6,0,23,0) allows remote attackers to execute arbitrary code via a long movie parameter.High 7.5 · Jun 18, 2002
• CVE-2001-1513 Macromedia JRun 3.0 and 3.1 allows remote attackers to obtain duplicate active user session IDs and perform actions as other users via a URL request for the webHigh 7.5 · Dec 31, 2001
• CVE-2001-1514 ColdFusion 4.5 and 5, when running on Windows with the advanced security sandbox type set to "operating system," does not properly pass security context to (1) High 10 · Dec 31, 2001
• CVE-2001-0535 Example applications (Exampleapps) in ColdFusion Server 4.x do not properly restrict prevent access from outside the local host's domain, which allows remote atHigh 7.5 · Oct 30, 2001
• CVE-2001-1427 Unknown vulnerability in ColdFusion Server 2.0 through 4.5.1 SP2 allows remote attackers to overwrite templates with zero byte files via unknown attack vectors.High 7.5 · Jul 11, 2001