Adobe BlazeDS vulnerabilities

3 CVEs affecting Adobe BlazeDS, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2011-2093, published 2011-06-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2009-3960: Adobe BlazeDS Information Disclosure Vulnerability, published 2010-02-15. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2022-03-07. EPSS: 90.1% chance of exploitation in the next 30 days. Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0,…
CVE-2011-2092, published 2011-06-16. High severity, CVSS 10.0. EPSS: 6.1% chance of exploitation in the next 30 days. Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creation of classes during deserialization of (1) AMF and (2) AMFX…
CVE-2011-2093, published 2011-06-16. Medium severity, CVSS 5.0. EPSS: 3.8% chance of exploitation in the next 30 days. Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly handle object graphs, which allows attackers to cause a denial of service…