Macromedia's vulnerability footprint spans a modest but strategically important portfolio of media, application server, and plugin products—Flash Player, Shockwave, ColdFusion, and JRun—that achieved prominent deployment across web browsers and enterprise environments. Although the vulnerability volume is moderate, the vendor's disclosures frequently acquire public exploit code, reflecting the high visibility and attack appeal of widely embedded plugins and server-side application platforms. The recurring weakness classes cluster around memory-safety and code-injection issues—buffer boundary violations, code injection, and sensitive information exposure—that are characteristic of complex binary formats and dynamic scripting environments. These products represent legacy but historically significant attack vectors; defenders tracking older deployments or archived systems should recognize the durable risk profile of this vendor's exposure. Current exploitation activity, severity distribution, and CVE counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Macromedia over time
Signals from CVEs in this vendor scope (116 CVEs).
116 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2010-3654HIGH Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris and 10.1.95.1 on Android, and authplay.dll (aka AuthPlayLib.bundle or libau | Oct 29, 2010 | 9.3 | 83 | NO | YES |
CVE-2002-0665HIGH Macromedia JRun Administration Server allows remote attackers to bypass authentication on the login form via an extra slash (/) in the URL. | Jul 11, 2002 | 10.0 | 46 | NO | YES |
CVE-2007-1403HIGH Multiple stack-based buffer overflows in an ActiveX control in SwDir.dll 10.1.4.20 in Macromedia Shockwave allow remote attackers to cause a denial of service (Internet Explorer 7 | Mar 10, 2007 | 7.5 | 43 | NO | YES |
CVE-2000-1053HIGH Allaire JRun 2.3.3 server allows remote attackers to compile and execute JSP code by inserting it via a cross-site scripting (CSS) attack and directly calling the com.livesoftware. | Dec 11, 2000 | 10.0 | 40 | NO | YES |
CVE-2005-3591HIGH Macromedia Flash plugin (1) Flash.ocx 7.0.19.0 (Windows) and earlier and (2) libflashplayer.so before 7.0.25.0 (Unix) allows remote attackers to cause a denial of service (crash) a | Nov 16, 2005 | 7.5 | 34 | NO | YES |
CVE-2009-3793HIGH Unspecified vulnerability in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows attackers to cause a denial of service (memory | Jun 15, 2010 | 9.3 | 33 | NO | NO |
CVE-2010-2185HIGH Buffer overflow in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, might allow attackers to execute arbitrary code via unspecified | Jun 15, 2010 | 9.3 | 32 | NO | NO |
CVE-2010-2173HIGH Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, might allow attackers to execute arbitrary code via unspecified vectors, related t | Jun 15, 2010 | 9.3 | 32 | NO | NO |
CVE-2010-2170HIGH Integer overflow in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, might allow attackers to execute arbitrary code via unspecifie | Jun 15, 2010 | 9.3 | 32 | NO | NO |
CVE-2010-2167HIGH Multiple heap-based buffer overflows in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, might allow attackers to execute arbitrary | Jun 15, 2010 | 9.3 | 32 | NO | NO |
Signals from CVEs in this vendor scope (116 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Macromedia.
Media articles that mention a CVE ID that affects a product developed by Macromedia — matched by CVE ID, not by vendor name.