cisa.gov | Bulletins
Follow
Vulnerability Summary for the Week of June 9, 2025
Acer ControlCenter has a remote code execution vulnerability due to a misconfigured Windows Named Pipe, allowing remote attackers to execute arbitrary code with elevated privileges. Adobe Acrobat Reader has multiple vulnerabilities, including use-after-free and out-of-bounds write vulnerabilities, that could result in arbitrary code execution in the context of the current user. Adobe Commerce has multiple vulnerabilities, including stored cross-site scripting and improper authorization vulnerabilities, that could lead to security feature bypass and privilege escalation. Adobe Experience Manager has reflected cross-site scripting and improper authorization vulnerabilities that could lead to session takeover. Adobe InCopy and InDesign Desktop have multiple vulnerabilities, including integer overflow, heap-based buffer overflow, and use-after-free vulnerabilities, that could result in arbitrary code execution in the context of the current user. Adobe Substance3D - Painter and Sampler have out-of-bounds write vulnerabilities that could result in arbitrary code execution in the context of the current user. Alex Zaytseff Multi CryptoCurrency Payments has a SQL injection vulnerability that allows SQL injection. Amazon Cloud Cam has a pairing status vulnerability that allows network traffic interception and modification. AMD EPYC 7002 Series Processors have an improper register access control vulnerability that may allow privileged attackers to perform unauthorized access to ASP's Crypto Co-Processor registers.