{"schemaVersion":3,"id":"CVE-2010-3636","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors.","dates":{"published":"2010-11-07T21:00:00.000Z","modified":"2024-08-07T03:18:53.106Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.3,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9.3,"severity":"high","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.05256,"percentile":0.92468,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.05256},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.05256,"percentile":0.92468}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.05256,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.05256,"percentile":0.92468}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-264","name":"Permissions, Privileges, and Access Controls","description":"Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.","type":"category","status":"Obsolete","abstraction":null,"likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/264.html"}],"affected":[{"vendor":"adobe","product":"flash_player","name":"Flash Player","label":"flash_player","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 9.0, < 9.0.289.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 10.0, < 10.1.102.64","noFixRecorded":false,"fixedIn":null},{"text":"≤ 10.1.95.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 9.0, < 9.0.289.0 | ≥ 10.0, < 10.1.102.64 | ≤ 10.1.95.1","eol":null,"hubHref":"/vendor/adobe/flash_player"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.vupen.com/english/advisories/2011/0192","label":"www.vupen.com/english/advisories/2011/0192","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Third Party Advisory"]},{"url":"http://secunia.com/advisories/42183","label":"secunia.com/advisories/42183","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://support.apple.com/kb/HT4435","label":"support.apple.com/kb/HT4435","hostname":"support.apple.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1","label":"blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1","hostname":"blogs.sun.com","tags":["X Refsource CONFIRM","Broken Link"]},{"url":"http://secunia.com/advisories/43026","label":"secunia.com/advisories/43026","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://security.gentoo.org/glsa/glsa-201101-09.xml","label":"security.gentoo.org/glsa/glsa-201101-09.xml","hostname":"security.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/2918","label":"www.vupen.com/english/advisories/2010/2918","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/44691","label":"www.securityfocus.com/bid/44691","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html","label":"lists.apple.com/archives/security-announce/2010//Nov/msg00000.html","hostname":"lists.apple.com","tags":["Vendor Advisory","X Refsource APPLE","Mailing List","Third Party Advisory"]},{"url":"http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000054.html","label":"jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000054.html","hostname":"jvndb.jvn.jp","tags":["Third Party Advisory","X Refsource JVNDB","VDB Entry"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0834.html","label":"www.redhat.com/support/errata/RHSA-2010-0834.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00002.html","label":"lists.opensuse.org/opensuse-security-announce/2010-11/msg00002.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Third Party Advisory"]},{"url":"http://secunia.com/advisories/42926","label":"secunia.com/advisories/42926","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://marc.info/?l=bugtraq&m=130331642631603&w=2","label":"marc.info?l=bugtraq&m=130331642631603&w=2","hostname":"marc.info","tags":["Vendor Advisory","X Refsource HP","Mailing List","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/2903","label":"www.vupen.com/english/advisories/2010/2903","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2011/0173","label":"www.vupen.com/english/advisories/2011/0173","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Third Party Advisory"]},{"url":"http://jvn.jp/en/jp/JVN48425028/index.html","label":"jvn.jp/en/jp/JVN48425028/index.html","hostname":"jvn.jp","tags":["Third Party Advisory","X Refsource JVN","VDB Entry"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15913","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15913","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL","Third Party Advisory"]},{"url":"http://www.adobe.com/support/security/bulletins/apsb10-26.html","label":"www.adobe.com/support/security/bulletins/apsb10-26.html","hostname":"www.adobe.com","tags":["X Refsource CONFIRM","Patch","Vendor Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12142","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12142","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/2906","label":"www.vupen.com/english/advisories/2010/2906","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Third Party Advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0867.html","label":"www.redhat.com/support/errata/RHSA-2010-0867.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0829.html","label":"www.redhat.com/support/errata/RHSA-2010-0829.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":["RHSA-2010:0829","RHSA-2010:0834","RHSA-2010:0867"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2010-11-07T21:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T03:18:53.106Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T06:44:29.833Z","stale":false,"partial":false}}