Adobe Patches 18 Critical Flaws in Out-Of-Band Update

Adobe patched 18 critical vulnerabilities Tuesday impacting key products Adobe After Effects, Illustrator, Premiere Pro, Premiere Rush and Audition. The out-of-band fixes address vulnerabilities allowing an attacker to execute arbitrary code, if bugs are exploited. In its security bulletin Adobe...

PT-2020-5354

Name of the Vulnerable Software and Affected Versions Adobe After Effects versions 17.1 and earlier Description The issue is related to a heap overflow, which could allow an attacker to execute arbitrary code. Successful exploitation of this issue could lead to arbitrary code execution in the...

PT-2020-2974

Name of the Vulnerable Software and Affected Versions Adobe After Effects versions 17.1 and earlier Description The issue is related to an out-of-bounds write vulnerability in the software. Successful exploitation could lead to arbitrary code execution in the context of the current user. This...

PT-2020-2975

Name of the Vulnerable Software and Affected Versions Adobe After Effects versions 17.1 and earlier Description The issue is related to an out-of-bounds write vulnerability in memory. This could allow an attacker to execute arbitrary code in the context of the current user. Recommendations For...

PT-2020-2973

Name of the Vulnerable Software and Affected Versions Adobe After Effects versions 17.1 and earlier Description The issue is related to an out-of-bounds read in memory, which could allow an attacker to execute arbitrary code in the context of the current user. Successful exploitation of this issu...

PT-2020-5355

Name of the Vulnerable Software and Affected Versions Adobe After Effects versions 17.1 and earlier Description The issue is related to a heap overflow in memory, which could allow a remote attacker to execute arbitrary code in the context of the current user. This can lead to arbitrary code...

APSB20-35 Security update available for Adobe After Effects

Adobe has released an update for Adobe After Effects for Windows and macOS. This update addresses critical vulnerabilities. Successful exploitation could lead to arbitrary code execution in the context of the current user...

TYPO3-CORE-SA-2020-004: Class destructors causing side-effects when being unserialized

More info at https://typo3.org/security/advisory/typo3-core-sa-2020-004...

TYPO3-CORE-SA-2020-004: Class destructors causing side-effects when being unserialized

More info at https://typo3.org/security/advisory/typo3-core-sa-2020-004...

Class destructors causing side-effects when being unserialized

Calling unserialize on malicious user-submitted content can result in the following scenarios:...

Adobe After Effects MP4 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe After Effects. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing...

CVE-2020-10663

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsi...

CVE-2020-10663

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsi...

Adobe After Effects < 17.0.6 Information Disclosure (APSB20-21)

The version of Adobe After Effects installed on the remote Windows host is prior to 17.0.6. It is, therefore, affected by a vulnerability as referenced in the APSB20-21 advisory. - Adobe After Effects versions 17.0.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation...

ThinkPHP - Multiple PHP Injection RCEs (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ThinkPHP Multiple PHP Injection RCEs', 'Description' = %q This module exploits one of two PHP injection vulnerabilities in the ThinkPHP web...

Adobe After Effects Out-of-Bounds Read Vulnerability

Adobe After Effects is a set of visual effects and motion graphics production software from the American company Audobee Adobe. The software is mainly used for 2D and 3D synthesis, animation and visual effects production. An out-of-bounds read vulnerability exists in Adobe After Effects. An...

Adobe After Effects TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe After Effects. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

ThinkPHP 5.0.23 Remote Code Execution Exploit

This Metasploit module exploits one of two PHP injection vulnerabilities in the ThinkPHP web framework to execute code as the web user. Versions up to and including 5.0.23 are exploitable, though 5.0.23 is vulnerable to a separate vulnerability. The module will automatically attempt to detect the...

Adobe Fixes 'Important' Flaws in ColdFusion, After Effects and Digital Editions

Adobe released security patches for vulnerabilities in its ColdFusion, After Effects and Digital Editions applications. If exploited, the flaws could enable attackers to view sensitive data, gain escalated privileges, and launch denial-of-service attacks. Each of the bugs were rated...

Adobe Releases Security Updates for Multiple Products

Adobe has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review the following...