Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2023-29306: Adobe Security Bulletin

Adobe Connect versions 12.3 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser.

CVE
#xss#vulnerability#java

Security update available for Adobe Connect | APSB23-33

Bulletin ID

Date Published

Priority

APSB23-33

September 12, 2023

3

Summary

Adobe has released a security update for Adobe Connect. This update resolves important vulnerabilities. Successful exploitation could lead to arbitrary code execution.

Affected product versions

Product

Version

Platform

Adobe Connect

12.3  and earlier versions

All

Solution

Adobe categorizes these updates with the following  priority ratings and recommends users update their installation to the latest version.

Product

Version

Platform

Priority

Availability

Adobe Connect

12.4.1

All

3

Release notes

Vulnerability details

Vulnerability Category

Vulnerability Impact

Severity

CVSS base score

CVSS vector

CVE Number

Cross-site Scripting (Reflected XSS) (CWE-79)

Arbitrary code execution

Important

4.7

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

CVE-2023-29305

Cross-site Scripting (Reflected XSS) (CWE-79)

Arbitrary code execution

Important

4.7

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

CVE-2023-29306

Acknowledgments

Adobe would like to thank the following researchers for reporting these issue and for working with Adobe to help protect our customers:

  • Iskander Rehouma (pretorian) - CVE-2023-29305

  • Nitescu Lucian (luciann) - CVE-2023-29306

NOTE: Adobe has a private, invite-only, bug bounty program with HackerOne. If you are interested in working with Adobe as an external security researcher, please fill out this form for next steps.

For more information, visit https://helpx.adobe.com/security.html, or email [email protected].

Related news

Update Adobe Acrobat and Reader to Patch Actively Exploited Vulnerability

Adobe's Patch Tuesday update for September 2023 comes with a patch for a critical actively exploited security flaw in Acrobat and Reader that could permit an attacker to execute malicious code on susceptible systems. The vulnerability, tracked as CVE-2023-26369, is rated 7.8 for severity on the CVSS scoring system and impacts both Windows and macOS versions of Acrobat DC, Acrobat Reader DC,

Update Adobe Acrobat and Reader to Patch Actively Exploited Vulnerability

Adobe's Patch Tuesday update for September 2023 comes with a patch for a critical actively exploited security flaw in Acrobat and Reader that could permit an attacker to execute malicious code on susceptible systems. The vulnerability, tracked as CVE-2023-26369, is rated 7.8 for severity on the CVSS scoring system and impacts both Windows and macOS versions of Acrobat DC, Acrobat Reader DC,

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907