Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2014-4671
HistoryJul 09, 2014 - 5:04 a.m.

CVE-2014-4671

2014-07-0905:04:24
CWE-352
[email protected]
web.nvd.nist.gov
6

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

AI Score

6.4

Confidence

Low

EPSS

0.018

Percentile

88.2%

JSON

Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API.

Affected configurations

Nvd
Node
adobeflash_playerRange≤11.2.202.378
OR
adobeflash_playerMatch11.2.202.223
OR
adobeflash_playerMatch11.2.202.228
OR
adobeflash_playerMatch11.2.202.233
OR
adobeflash_playerMatch11.2.202.235
OR
adobeflash_playerMatch11.2.202.236
OR
adobeflash_playerMatch11.2.202.238
OR
adobeflash_playerMatch11.2.202.243
OR
adobeflash_playerMatch11.2.202.251
OR
adobeflash_playerMatch11.2.202.258
OR
adobeflash_playerMatch11.2.202.261
OR
adobeflash_playerMatch11.2.202.262
OR
adobeflash_playerMatch11.2.202.270
OR
adobeflash_playerMatch11.2.202.273
OR
adobeflash_playerMatch11.2.202.275
OR
adobeflash_playerMatch11.2.202.280
OR
adobeflash_playerMatch11.2.202.285
OR
adobeflash_playerMatch11.2.202.291
OR
adobeflash_playerMatch11.2.202.297
OR
adobeflash_playerMatch11.2.202.310
OR
adobeflash_playerMatch11.2.202.332
OR
adobeflash_playerMatch11.2.202.335
OR
adobeflash_playerMatch11.2.202.336
OR
adobeflash_playerMatch11.2.202.341
OR
adobeflash_playerMatch11.2.202.346
OR
adobeflash_playerMatch11.2.202.350
OR
adobeflash_playerMatch11.2.202.356
OR
adobeflash_playerMatch11.2.202.359
AND
linuxlinux_kernel
Node
adobeadobe_airRange≤14.0.0.110
OR
adobeadobe_airMatch13.0.0.83
OR
adobeadobe_airMatch13.0.0.111
Node
adobeadobe_air_sdkRange≤14.0.0.110
OR
adobeadobe_air_sdkMatch13.0.0.83
OR
adobeadobe_air_sdkMatch13.0.0.111
Node
adobeflash_playerRange≤13.0.0.223
OR
adobeflash_playerMatch13.0.0.182
OR
adobeflash_playerMatch13.0.0.201
OR
adobeflash_playerMatch13.0.0.206
OR
adobeflash_playerMatch13.0.0.214
OR
adobeflash_playerMatch14.0.0.125
AND
applemac_os_x
OR
microsoftwindows
VendorProductVersionCPE
adobeflash_player*cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
adobeflash_player11.2.202.223cpe:2.3:a:adobe:flash_player:11.2.202.223:*:*:*:*:*:*:*
adobeflash_player11.2.202.228cpe:2.3:a:adobe:flash_player:11.2.202.228:*:*:*:*:*:*:*
adobeflash_player11.2.202.233cpe:2.3:a:adobe:flash_player:11.2.202.233:*:*:*:*:*:*:*
adobeflash_player11.2.202.235cpe:2.3:a:adobe:flash_player:11.2.202.235:*:*:*:*:*:*:*
adobeflash_player11.2.202.236cpe:2.3:a:adobe:flash_player:11.2.202.236:*:*:*:*:*:*:*
adobeflash_player11.2.202.238cpe:2.3:a:adobe:flash_player:11.2.202.238:*:*:*:*:*:*:*
adobeflash_player11.2.202.243cpe:2.3:a:adobe:flash_player:11.2.202.243:*:*:*:*:*:*:*
adobeflash_player11.2.202.251cpe:2.3:a:adobe:flash_player:11.2.202.251:*:*:*:*:*:*:*
adobeflash_player11.2.202.258cpe:2.3:a:adobe:flash_player:11.2.202.258:*:*:*:*:*:*:*
Rows per page:
1-10 of 421

Related

metasploit 1
osv 2
packetstorm 1
cve 3
prion 3
ubuntucve 3
github 1
checkpoint_advisories 1
nodejs 1
cvelist 3
zdt 1
nvd 2
symfony 1
suse 3
nessus 11
altlinux 2
openvas 7
mageia 1
redhat 1
kaspersky 1
gentoo 1
metasploit
metasploit
Flash "Rosetta" JSONP GET/POST Response Disclosure
2014-07-10 14:09:10
osv
osv
python310-pyramid-2.0.2-1.3 on GA media
2024-07-12 00:00:00
Rosetta-Flash JSONP Vulnerability in hapi
2020-08-31 22:45:35
packetstorm
packetstorm
Flash Rosetta JSONP GET/POST Response Disclosure
2024-08-31 00:00:00
cve
cve
CVE-2014-4671
2014-07-09 05:04:24
CVE-2014-5333
2014-08-19 11:16:59
CVE-2015-5571
2015-09-22 10:59:03
prion
prion
Cross site request forgery (csrf)
2014-07-09 05:04:00
Cross site request forgery (csrf)
2014-08-19 11:16:00
Cross site request forgery (csrf)
2015-09-22 10:59:00
ubuntucve
ubuntucve
CVE-2014-4671
2014-07-09 00:00:00
CVE-2014-5333
2014-08-19 00:00:00
CVE-2015-5571
2015-09-22 00:00:00
github
github
Rosetta-Flash JSONP Vulnerability in hapi
2020-08-31 22:45:35
checkpoint_advisories
checkpoint_advisories
Adobe Flash Player JSONP Cross-Site Request Forgery (APSB14-17: CVE-2014-4671)
2014-07-29 00:00:00
nodejs
nodejs
Rosetta-Flash JSONP Vulnerability
2015-10-17 19:41:46
cvelist
cvelist
CVE-2014-4671
2014-07-09 01:00:00
CVE-2014-5333
2014-08-19 10:00:00
CVE-2015-5571
2015-09-22 10:00:00
zdt
zdt
Flash "Rosetta" JSONP GET/POST Response Disclosure Exploit
2014-07-13 00:00:00
nvd
nvd
CVE-2014-5333
2014-08-19 11:16:59
CVE-2015-5571
2015-09-22 10:59:03
symfony
symfony
Security releases (CVE-2014-4931): Symfony 2.3.18, 2.4.8, and 2.5.2 released
2014-07-15 00:00:00
suse
suse
Security update for flash-player (critical)
2014-07-15 07:04:19
flash-player (critical)
2014-07-17 09:04:16
flash-player (critical)
2014-07-16 12:04:13
nessus
nessus
RHEL 5 / 6 : flash-plugin (RHSA-2014:0860)
2014-07-10 00:00:00
GLSA-201407-02 : Adobe Flash Player: Multiple vulnerabilities
2014-07-10 00:00:00
Flash Player < 14.0.0.145 Multiple Vulnerabilities (APSB14-17)
2014-07-08 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 7 package adobe-flash-player version 3:11-alt31
2014-07-16 00:00:00
Security fix for the ALT Linux 6 package adobe-flash-player version 3:11-alt31
2014-07-16 00:00:00
openvas
openvas
SUSE: Security Advisory for flash-player (SUSE-SU-2014:0897-1)
2015-10-16 00:00:00
Adobe Flash Player Multiple Vulnerabilities-01 (Jul 2014) - Windows
2014-07-11 00:00:00
Mageia: Security Advisory (MGASA-2014-0291)
2022-01-28 00:00:00
mageia
mageia
Updated flash-player-plugin packages fix multiple vulnerabilities
2014-07-10 03:21:32
redhat
redhat
(RHSA-2014:0860) Critical: flash-plugin security update
2014-07-09 00:00:00
kaspersky
kaspersky
KLA10036 Multiple vulnerabilities in Adobe Flash and Adobe AIR
2014-07-08 00:00:00
gentoo
gentoo
Adobe Flash Player: Multiple vulnerabilities
2014-07-09 00:00:00

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

AI Score

6.4

Confidence

Low

EPSS

0.018

Percentile

88.2%

JSON
Related for NVD:CVE-2014-4671
metasploit1osv2packetstorm1cve3prion3ubuntucve3github1checkpoint_advisories1nodejs1cvelist3zdt1nvd2symfony1suse3nessus11altlinux2openvas7mageia1redhat1kaspersky1gentoo1