CVEvulnerability

CVE-2010-3636

9.3 HIGH Published 2010-11-07 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2010-11-07
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-264

Description

Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors.

Affected configurations

• adobe flash player (>= 9.0 < 9.0.289.0) • adobe flash player (>= 10.0 < 10.1.102.64) • adobe flash player (<= 10.1.95.1)

Related

Weakness · not in database (1)

Referenced by CWE · observed example (1)

  • CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains weakness

References