Adobe Livecycle vulnerabilities

5 CVEs affecting Adobe Livecycle, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-6934, published 2016-12-15.

More from Adobe.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2009-3960: Adobe BlazeDS Information Disclosure Vulnerability, published 2010-02-15. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2022-03-07. EPSS: 90.1% chance of exploitation in the next 30 days. Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0,…
• CVE-2011-2092, published 2011-06-16. High severity, CVSS 10.0. EPSS: 6.1% chance of exploitation in the next 30 days. Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creation of classes during deserialization of (1) AMF and (2) AMFX…
• CVE-2011-2093, published 2011-06-16. Medium severity, CVSS 5.0. EPSS: 3.8% chance of exploitation in the next 30 days. Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly handle object graphs, which allows attackers to cause a denial of service…
• CVE-2016-6934, published 2016-12-15. Medium severity, CVSS 6.1. EPSS: 2.6% chance of exploitation in the next 30 days. Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the PMAdmin module that could be used in cross-site scripting attacks.
• CVE-2016-6933, published 2016-12-15. Medium severity, CVSS 6.1. EPSS: 2% chance of exploitation in the next 30 days. Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the AACComponent that could be used in cross-site scripting attacks.