Adobe Download Manager vulnerabilities

5 CVEs affecting Adobe Download Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-2926, published 2022-09-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2006-5856, published 2006-12-06. Medium severity, CVSS 6.8. EPSS: 14.7% chance of exploitation in the next 30 days. Stack-based buffer overflow in the Adobe Download Manager before 2.2 allows remote attackers to execute arbitrary code via a long section name in the dm.ini file, which is populated via an AOM file.
CVE-2010-0189, published 2010-02-23. High severity, CVSS 9.3. EPSS: 5.2% chance of exploitation in the next 30 days. A certain ActiveX control in NOS Microsystems getPlus Download Manager (aka DLM or Downloader) 1.5.2.35, as used in Adobe Download Manager, improperly validates requests involving web sites that are…
CVE-2020-9688, published 2020-07-17. High severity, CVSS 7.8. EPSS: 4.8% chance of exploitation in the next 30 days. Adobe Download Manager version 2.0.0.518 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2019-8071, published 2019-10-17. Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days. Adobe Download Manager versions 2.0.0.363 have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation.
CVE-2022-2926, published 2022-09-26. Medium severity, CVSS 4.9. EPSS: 1.7% chance of exploitation in the next 30 days. The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as admin to list and read arbitrary files and folders outside of…