Adobe Livecycle Data Services vulnerabilities

5 CVEs affecting Adobe Livecycle Data Services, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-5255, published 2015-11-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2009-3960: Adobe BlazeDS Information Disclosure Vulnerability, published 2010-02-15. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2022-03-07. EPSS: 90.1% chance of exploitation in the next 30 days. Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0,…
CVE-2015-3269, published 2015-08-25. Medium severity, CVSS 5.0. EPSS: 9.8% chance of exploitation in the next 30 days. Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services (LCDS) 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and 4.7 before…
CVE-2011-2092, published 2011-06-16. High severity, CVSS 10.0. EPSS: 6.1% chance of exploitation in the next 30 days. Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creation of classes during deserialization of (1) AMF and (2) AMFX…
CVE-2015-5255, published 2015-11-18. Medium severity, CVSS 4.3. EPSS: 4.5% chance of exploitation in the next 30 days. Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x…
CVE-2011-2093, published 2011-06-16. Medium severity, CVSS 5.0. EPSS: 3.8% chance of exploitation in the next 30 days. Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly handle object graphs, which allows attackers to cause a denial of service…