Threat Intelligence Database

Adobe Dimension contains a cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This flaw allows a local attacker with user permissions to execute arbitrary code in the context of the current user. Exploitation requires user interaction, specifically that the victim runs the application. The vulnerability affects Adobe Dimension versions from 0 up to and including 4.1.8. The vulnerability has a high severity rating with a CVSS score of 8.6.

Adobe Dimension contains an Uncontrolled Search Path Element vulnerability (CWE-427) that allows a local attacker with user permissions to execute arbitrary code by tricking a user into running the application. The vulnerability affects versions from 0 up to and including 4.1.8. Exploitation requires user interaction and changes the security scope. The CVSS 3.1 score is 8.6, indicating a high severity risk.

Adobe Dimension contains a NULL Pointer Dereference vulnerability (CWE-476) that can cause the application to crash, resulting in denial-of-service. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions from 0 up to and including 4.1.8. The CVSS score is 5.5, indicating medium severity.

Adobe Dimension contains a stack-based buffer overflow vulnerability (CWE-121) that could allow an attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions from 0 up to and including 4.1.8. The CVSS 3.1 score is 7.8, indicating high severity.

Adobe Dimension contains an out-of-bounds read vulnerability (CWE-125) that could allow an attacker to disclose sensitive memory information. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions from 0 up to and including 4.1.8. The CVSS 3.1 base score is 5.5, indicating a medium severity level.

Adobe Dimension versions up to 4.1.8 are affected by an Untrusted Search Path vulnerability (CWE-426) that could allow a local attacker with user permissions to execute arbitrary code. Exploitation requires user interaction, specifically running the vulnerable application. The vulnerability impacts confidentiality, integrity, and availability, and changes the security scope.

A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page.