Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution

Multiple vulnerabilities affecting several Adobe products (ColdFusion, Commerce, Lightroom, Content Credentials SDK, Campaign Classic) were disclosed, including OS command injection, eval injection, improper authorization, XSS, path traversal, deserialization, buffer overflows, integer overflows/underflows, SSRF and other flaws (numerous CVEs listed). The most severe issues could allow arbitrary code execution in the context of the logged-on user, enabling installation of programs, data access/modification, or account creation depending on user privileges; no evidence of active exploitation is provided in the report.