DATABASE RESOURCES PRICING ABOUT US

{"id": "ADOBE_CONNECT_APSB21-19.NASL", "vendorId": null, "type": "nessus", "bulletinFamily": "scanner", "title": "Adobe Connect <= 11.0.5 Multiple Vulnerabilities (APSB21-19)", "description": "The version of Adobe Connect running on the remote host is 11.0.5 or earlier. It is, therefore, affected by multiple vulnerabilities, including the following:\n\n - Multiple reflected cross-site scripting vulnerabilities due to improper validation of user-supplied input before returning it to users. An remote attacker can exploit these, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser session. (CVE-2021-21079, CVE-2021-21080, CVE-2021-21081)\n\n - An arbitrary code execution vulnerability due to improper input validation. (CVE-2021-21085)\n\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-03-10T00:00:00", "modified": "2022-06-28T00:00:00", "epss": [], "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://www.tenable.com/plugins/nessus/147419", "reporter": "This script is Copyright (C) 2022 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21085", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21081", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21079", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21080", "https://helpx.adobe.com/security/products/connect/apsb21-19.html"], "cvelist": ["CVE-2021-21079", "CVE-2021-21080", "CVE-2021-21081", "CVE-2021-21085"], "immutableFields": [], "lastseen": "2023-05-18T15:25:55", "viewCount": 28, "enchantments": {"dependencies": {"references": [{"type": "adobe", "idList": ["APSB21-19"]}, {"type": "cve", "idList": ["CVE-2021-21079", "CVE-2021-21080", "CVE-2021-21085"]}, {"type": "threatpost", "idList": ["THREATPOST:B79D0A844D2D8BF7A75F2D397398D75A"]}]}, "score": {"value": -0.3, "vector": "NONE"}, "backreferences": {"references": [{"type": "adobe", "idList": ["APSB21-19"]}, {"type": "cve", "idList": ["CVE-2021-21079", "CVE-2021-21080", "CVE-2021-21085"]}, {"type": "nessus", "idList": ["ADOBE_CONNECT_DETECT.NBIN"]}, {"type": "threatpost", "idList": ["THREATPOST:B79D0A844D2D8BF7A75F2D397398D75A"]}]}, "exploitation": null, "epss": [{"cve": "CVE-2021-21079", "epss": 0.00079, "percentile": 0.32357, "modified": "2023-05-07"}, {"cve": "CVE-2021-21080", "epss": 0.00079, "percentile": 0.32357, "modified": "2023-05-07"}, {"cve": "CVE-2021-21085", "epss": 0.00814, "percentile": 0.7935, "modified": "2023-05-07"}], "vulnersScore": -0.3}, "_state": {"dependencies": 1684444545, "score": 1684423648, "epss": 0}, "_internal": {"score_hash": "a90d01897da4f96176be482def984e64"}, "pluginID": "147419", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147419);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/06/28\");\n\n script_cve_id(\n \"CVE-2021-21079\",\n \"CVE-2021-21080\",\n \"CVE-2021-21081\",\n \"CVE-2021-21085\"\n );\n script_xref(name:\"IAVB\", value:\"2021-B-0016-S\");\n\n script_name(english:\"Adobe Connect <= 11.0.5 Multiple Vulnerabilities (APSB21-19)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote web server contains an application that is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Adobe Connect running on the remote host is 11.0.5 or earlier. It is, therefore, affected by multiple \nvulnerabilities, including the following:\n\n - Multiple reflected cross-site scripting vulnerabilities due to improper validation of user-supplied input\n before returning it to users. An remote attacker can exploit these, by convincing a user to click a\n specially crafted URL, to execute arbitrary script code in a user's browser session. (CVE-2021-21079,\n CVE-2021-21080, CVE-2021-21081)\n\n - An arbitrary code execution vulnerability due to improper input validation. (CVE-2021-21085)\n\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://helpx.adobe.com/security/products/connect/apsb21-19.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Adobe Connect version 11.2 or later\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-21085\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/03/09\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/10\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:adobe:connect\");\n script_set_attribute(attribute:\"stig_severity\", value:\"II\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"CGI abuses\");\n\n script_copyright(english:\"This script is Copyright (C) 2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"adobe_connect_detect.nbin\");\n script_require_keys(\"installed_sw/Adobe Connect\");\n script_require_ports(\"Services/www\", 80, 443);\n\n exit(0);\n}\n\ninclude('http.inc');\ninclude('vcf.inc');\n\nport = get_http_port(default:80);\napp_info = vcf::get_app_info(app:'Adobe Connect', port:port, webapp:TRUE);\n\nconstraints = [{'fixed_version' : '11.0.6', 'fixed_display' : '11.2'}];\n\nvcf::check_version_and_report(\n app_info:app_info,\n constraints:constraints,\n severity:SECURITY_WARNING,\n flags:{'xss':TRUE}\n);\n", "naslFamily": "CGI abuses", "cpe": ["cpe:/a:adobe:connect"], "solution": "Upgrade to Adobe Connect version 11.2 or later", "nessusSeverity": "Medium", "cvssScoreSource": "CVE-2021-21085", "vendor_cvss2": {"score": 6.8, "vector": "CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "vendor_cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "vpr": {"risk factor": "Medium", "score": "5.9"}, "exploitAvailable": false, "exploitEase": "No known exploits are available", "patchPublicationDate": "2021-03-09T00:00:00", "vulnerabilityPublicationDate": "2021-03-09T00:00:00", "exploitableWith": []}

{"adobe": [{"lastseen": "2023-05-27T14:32:36", "description": "Adobe has released a security update for Adobe Connect. This update resolves a [critical]() and an [important]() vulnerability. Successful exploitation could lead to arbitrary JavaScript execution within the context of the victim's browser. \n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-03-09T00:00:00", "type": "adobe", "title": "APSB21-19 Security update available for Adobe Connect", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-21078", "CVE-2021-21079", "CVE-2021-21080", "CVE-2021-21081", "CVE-2021-21085"], "modified": "2021-03-09T00:00:00", "id": "APSB21-19", "href": "https://helpx.adobe.com/security/products/connect/apsb21-19.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "threatpost": [{"lastseen": "2021-03-09T20:51:30", "description": "Adobe has issued patches for a slew of critical security vulnerabilities, which, if exploited, could allow for arbitrary code execution on vulnerable Windows systems.\n\nAffected products include Adobe\u2019s Framemaker document processor, designed for writing and editing large or complex documents; Adobe\u2019s Connect software used for remote web conferencing; and the Adobe Creative Cloud software suite for video editing.\n\n\u201cAdobe is not aware of any exploits in the wild for any of the issues addressed in these updates,\u201d according to an Adobe spokesperson.\n\n[](<https://threatpost.com/newsletter-sign/>)\n\nWhile these vulnerabilities are classified as critical-severity flaws, it\u2019s important to note that they were given \u201cpriority 3\u201d ratings by Adobe. This means that the update \u201cresolves vulnerabilities in a product that has historically not been a target for attackers,\u201d and that administrators are urged to \u201cinstall the update at their discretion.\u201d\n\n## **Adobe Framemaker Security Flaw**\n\nAdobe [fixed a critical flaw](<https://helpx.adobe.com/security/products/framemaker/apsb21-14.html>) (CVE-2021-21056) in Framemaker, which could allow for arbitrary code execution if exploited. The vulnerability is an out-of-bounds read error; which is [a type of buffer-overflow flaw](<https://cwe.mitre.org/data/definitions/125.html>) where the software reads data past the end of the intended buffer. An attacker who can read out-of-bounds memory might be able to get \u201csecret values\u201d (like memory addresses) that could ultimately allow him to achieve code execution or denial of service.\n\nAdobe Framemaker version 2019.0.8 and below (for Windows) are affected by the flaw; a patch is issued in version 2020.0.2. Francis Provencher, working with Trend Micro\u2019s Zero Day Initiative, is credited with finding the bug.\n\n## **Creative Cloud Desktop Application For Windows**\n\nAdobe also [fixed three critical vulnerabilities](<https://helpx.adobe.com/security/products/creative-cloud/apsb21-18.html>) in the desktop application version of Adobe Creative Cloud for Windows users.\n\nTwo of the three critical flaws could enable arbitrary code execution: One of these (CVE-2021-21068) stems from an arbitrary file-overwrite hole, while the other (CVE-2021-21078) exists due to an OS command-injection error. The third critical flaw (CVE-2021-21069) stems from improper input validation and could allow an attacker to gain escalated privileges.\n\nThe Creative Cloud desktop application versions 5.3 and earlier are affected; fixes are released in version 5.4.\n\n## **Adobe Connect Critical and Important Flaws**\n\nSeveral [critical- and important-severity bugs](<https://helpx.adobe.com/security/products/connect/apsb21-19.html>) were patched in Adobe Connect.\n\nOne critical bug (CVE-2021-21078) stemmed from improper input validation; this could allow for arbitrary code execution.\n\nAnd, three important cross-site scripting (XSS) flaws (CVE-2021-21079, CVE-2021-21080, CVE-2021-21081) were patched. These could allow for arbitrary JavaScript execution in the victim\u2019s browser, if exploited.\n\nAdobe Connect version 11.0.5 and earlier are affected; the fix was released in version 11.2.\n\n## **Adobe Security Updates Continue **\n\nThis month\u2019s regularly-scheduled security fixes come on the heels of [an actively-exploited critical flaw in February](<https://threatpost.com/critical-adobe-windows-flaw/163789/>), which attackers leveraged to target Adobe Reader users on Windows.\n\nThat bug (CVE-2021-21017) was exploited in \u201climited attacks,\u201d according to [Adobe\u2019s monthly advisory](<https://helpx.adobe.com/security/products/acrobat/apsb21-09.html>), containing its regularly scheduled February updates. The flaw in question is a critical-severity [heap-based buffer-overflow](<https://threatpost.com/google-chrome-zero-day-windows-mac/163688/>) flaw.\n\n**_Check out our free _****_[upcoming live webinar events](<https://threatpost.com/category/webinars/>)_****_ \u2013 unique, dynamic discussions with cybersecurity experts and the Threatpost community:_** \n\u00b7 March 24: **Economics of 0-Day Disclosures: The Good, Bad and Ugly **([Learn more and register!](<https://threatpost.com/webinars/economics-of-0-day-disclosures-the-good-bad-and-ugly/>)) \n\u00b7 April 21: **Underground Markets: A Tour of the Dark Economy** ([Learn more and register!](<https://threatpost.com/webinars/underground-markets-a-tour-of-the-dark-economy/>))\n", "cvss3": {}, "published": "2021-03-09T20:44:18", "type": "threatpost", "title": "Adobe Critical Code-Execution Flaws Plague Windows Users", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2021-21017", "CVE-2021-21056", "CVE-2021-21068", "CVE-2021-21069", "CVE-2021-21078", "CVE-2021-21079", "CVE-2021-21080", "CVE-2021-21081"], "modified": "2021-03-09T20:44:18", "id": "THREATPOST:B79D0A844D2D8BF7A75F2D397398D75A", "href": "https://threatpost.com/adobe-critical-flaws-windows/164611/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "cve": [{"lastseen": "2023-05-27T14:19:18", "description": "Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious JavaScript content that may be executed within the context of the victim's browser when they browse to the page containing the vulnerable field.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2021-03-12T19:15:00", "type": "cve", "title": "CVE-2021-21079", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-21079"], "modified": "2021-12-03T17:46:00", "cpe": ["cpe:/a:adobe:connect:11.0.7"], "id": "CVE-2021-21079", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-21079", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:adobe:connect:11.0.7:*:*:*:*:*:*:*"]}, {"lastseen": "2023-05-27T14:19:19", "description": "Adobe Connect version 11.0.7 (and earlier) is affected by an Input Validation vulnerability in the export feature. An attacker could exploit this vulnerability by injecting a payload into an online event form and achieve code execution if the victim exports and opens the data on their local machine.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-03-12T19:15:00", "type": "cve", "title": "CVE-2021-21085", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-21085"], "modified": "2021-12-10T19:44:00", "cpe": ["cpe:/a:adobe:connect:11.0.7"], "id": "CVE-2021-21085", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-21085", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:adobe:connect:11.0.7:*:*:*:*:*:*:*"]}, {"lastseen": "2023-05-27T14:19:18", "description": "Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious JavaScript content that may be executed within the context of the victim's browser when they browse to the page containing the vulnerable field.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2021-03-12T19:15:00", "type": "cve", "title": "CVE-2021-21080", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-21080"], "modified": "2021-12-03T17:46:00", "cpe": ["cpe:/a:adobe:connect:11.0.7"], "id": "CVE-2021-21080", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-21080", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:adobe:connect:11.0.7:*:*:*:*:*:*:*"]}]}