CVE coverage
View on NVD →
CVE-2014-4671
CVSS 4.3
2 detections found
Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API.
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| suricata | ET WEB_SERVER Adobe Flash Player Rosetta Flash compressed CWS in URI | rev 3 | 2020-04-30 |
| snort | ET WEB_SERVER Adobe Flash Player Rosetta Flash compressed CWS in URI | rev 1 | 2014-07-18 |