Medium severity · published Feb 16, 2012
CVE-2012-0767
Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability
In wildKEV
6.1
CVSS
6.2%
EPSS
Yes
On KEV
Description
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)," as exploited in the wild in February 2012.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)6.2% · higher than 93% of CVEs
Exploited in the wildYes
CISA KEVListed Jun 8, 2022
Federal remediation dueJun 22, 2022
Ransomware campaign useNot known
Affected products
Which versions
FP
Flash Player · Adobe
before 10.3.183.15; 11.0 before 11.1.102.62; before 11.1.111.6; before 11.1.115.6 · source: NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-0767
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-0767
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00014.html
vendor-advisory
http://security.gentoo.org/glsa/glsa-201204-07.xml
third-party-advisory
http://secunia.com/advisories/48265
x_refsource_CONFIRM
http://www.adobe.com/support/security/bulletins/apsb12-03.html
vdb-entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14806
vendor-advisory
http://rhn.redhat.com/errata/RHSA-2012-0144.html
More from Flash Player
9.8
CVE-2016-4171
Adobe Flash Player Remote Code Execution Vulnerability
9.8
CVE-2016-4117
Adobe Flash Player Arbitrary Code Execution Vulnerability
9.8
CVE-2016-1019
Adobe Flash Player Arbitrary Code Execution Vulnerability
9.8
CVE-2015-5123
Adobe Flash Player Use-After-Free Vulnerability
9.8
CVE-2015-5122
Adobe Flash Player Use-After-Free Vulnerability