{"history":[{"alert":0,"cve":"CVE-2009-3960","id":21415,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.90118, \"percentile\": 0.99799}"},{"alert":0,"cve":"CVE-2009-3960","id":19031,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.90118, \"percentile\": 0.99798}"},{"alert":0,"cve":"CVE-2009-3960","id":16997,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.90118, \"percentile\": 0.99798}"},{"alert":0,"cve":"CVE-2009-3960","id":15060,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.90118, \"percentile\": 0.99797}"},{"alert":1,"cve":"CVE-2009-3960","id":14977,"kind":"cna","observed_at":1794090000,"payload":"{\"containers\": {\"adp\": [{\"providerMetadata\": {\"dateUpdated\": \"2024-08-07T06:45:50.647Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"name\": \"38197\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\", \"x_transferred\"], \"url\": \"http://www.securityfocus.com/bid/38197\"}, {\"name\": \"1023584\", \"tags\": [\"vdb-entry\", \"x_refsource_SECTRACK\", \"x_transferred\"], \"url\": \"http://securitytracker.com/id?1023584\"}, {\"name\": \"62292\", \"tags\": [\"vdb-entry\", \"x_refsource_OSVDB\", \"x_transferred\"], \"url\": \"http://www.osvdb.org/62292\"}, {\"name\": \"38543\", \"tags\": [\"third-party-advisory\", \"x_refsource_SECUNIA\", \"x_transferred\"], \"url\": \"http://secunia.com/advisories/38543\"}, {\"name\": \"41855\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\", \"x_transferred\"], \"url\": \"https://www.exploit-db.com/exploits/41855/\"}, {\"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"], \"url\": \"http://www.adobe.com/support/security/bulletins/apsb10-05.html\"}], \"title\": \"CVE Program Container\"}, {\"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"REQUIRED\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\", \"version\": \"3.1\"}}, {\"other\": {\"content\": {\"id\": \"CVE-2009-3960\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2022-03-11T00:00:00+00:00\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2022-03-07\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3960\"}, \"type\": \"kev\"}}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"CWE-noinfo Not enough information\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-08-06T03:55:29.278Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3960\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \"n/a\", \"vendor\": \"n/a\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"datePublic\": \"2010-02-11T00:00:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.\"}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"n/a\", \"lang\": \"en\", \"type\": \"text\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2017-08-15T09:57:01.000Z\", \"orgId\": \"078d4453-3bcd-4900-85e6-15281da43538\", \"shortName\": \"adobe\"}, \"references\": [{\"name\": \"38197\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\"], \"url\": \"http://www.securityfocus.com/bid/38197\"}, {\"name\": \"1023584\", \"tags\": [\"vdb-entry\", \"x_refsource_SECTRACK\"], \"url\": \"http://securitytracker.com/id?1023584\"}, {\"name\": \"62292\", \"tags\": [\"vdb-entry\", \"x_refsource_OSVDB\"], \"url\": \"http://www.osvdb.org/62292\"}, {\"name\": \"38543\", \"tags\": [\"third-party-advisory\", \"x_refsource_SECUNIA\"], \"url\": \"http://secunia.com/advisories/38543\"}, {\"name\": \"41855\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\"], \"url\": \"https://www.exploit-db.com/exploits/41855/\"}, {\"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"http://www.adobe.com/support/security/bulletins/apsb10-05.html\"}], \"x_legacyV4Record\": {\"CVE_data_meta\": {\"ASSIGNER\": \"psirt@adobe.com\", \"ID\": \"CVE-2009-3960\", \"STATE\": \"PUBLIC\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"n/a\", \"version\": {\"version_data\": [{\"version_value\": \"n/a\"}]}}]}, \"vendor_name\": \"n/a\"}]}}, \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"n/a\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"38197\", \"refsource\": \"BID\", \"url\": \"http://www.securityfocus.com/bid/38197\"}, {\"name\": \"1023584\", \"refsource\": \"SECTRACK\", \"url\": \"http://securitytracker.com/id?1023584\"}, {\"name\": \"62292\", \"refsource\": \"OSVDB\", \"url\": \"http://www.osvdb.org/62292\"}, {\"name\": \"38543\", \"refsource\": \"SECUNIA\", \"url\": \"http://secunia.com/advisories/38543\"}, {\"name\": \"41855\", \"refsource\": \"EXPLOIT-DB\", \"url\": \"https://www.exploit-db.com/exploits/41855/\"}, {\"name\": \"http://www.adobe.com/support/security/bulletins/apsb10-05.html\", \"refsource\": \"CONFIRM\", \"url\": \"http://www.adobe.com/support/security/bulletins/apsb10-05.html\"}]}}}}, \"cveMetadata\": {\"assignerOrgId\": \"078d4453-3bcd-4900-85e6-15281da43538\", \"assignerShortName\": \"adobe\", \"cveId\": \"CVE-2009-3960\", \"datePublished\": \"2010-02-15T18:00:00.000Z\", \"dateReserved\": \"2009-11-16T00:00:00.000Z\", \"dateUpdated\": \"2026-08-06T03:55:29.278Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":0,"cve":"CVE-2009-3960","id":13038,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.90118, \"percentile\": 0.99798}"},{"alert":0,"cve":"CVE-2009-3960","id":10820,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.90118, \"percentile\": 0.99797}"},{"alert":0,"cve":"CVE-2009-3960","id":8566,"kind":"epss","observed_at":1793895600,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.90118, \"percentile\": 0.99797}"},{"alert":0,"cve":"CVE-2009-3960","id":6354,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.90118, \"percentile\": 0.99797}"},{"alert":0,"cve":"CVE-2009-3960","id":4131,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.90118, \"percentile\": 0.99796}"},{"alert":0,"cve":"CVE-2009-3960","id":1913,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.90118, \"percentile\": 0.99796}"},{"alert":1,"cve":"CVE-2009-3960","id":1288,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2009-3960\", \"cwes\": [], \"dateAdded\": \"2022-03-07\", \"dueDate\": \"2022-09-07\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Known\", \"notes\": \"https://nvd.nist.gov/vuln/detail/CVE-2009-3960\", \"product\": \"BlazeDS\", \"requiredAction\": \"Apply updates per vendor instructions.\", \"shortDescription\": \"Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.\", \"vendorProject\": \"Adobe\", \"vulnerabilityName\": \"Adobe BlazeDS Information Disclosure Vulnerability\"}"}],"record":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T06:45:50.647Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"38197","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/38197"},{"name":"1023584","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1023584"},{"name":"62292","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/62292"},{"name":"38543","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/38543"},{"name":"41855","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/41855/"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.adobe.com/support/security/bulletins/apsb10-05.html"}],"title":"CVE Program Container"},{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"}},{"other":{"content":{"id":"CVE-2009-3960","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2022-03-11T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2022-03-07","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3960"},"type":"kev"}}],"problemTypes":[{"descriptions":[{"description":"CWE-noinfo Not enough information","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-06T03:55:29.278Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3960"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2010-02-11T00:00:00.000Z","descriptions":[{"lang":"en","value":"Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-15T09:57:01.000Z","orgId":"078d4453-3bcd-4900-85e6-15281da43538","shortName":"adobe"},"references":[{"name":"38197","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/38197"},{"name":"1023584","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1023584"},{"name":"62292","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/62292"},{"name":"38543","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/38543"},{"name":"41855","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/41855/"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.adobe.com/support/security/bulletins/apsb10-05.html"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@adobe.com","ID":"CVE-2009-3960","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"38197","refsource":"BID","url":"http://www.securityfocus.com/bid/38197"},{"name":"1023584","refsource":"SECTRACK","url":"http://securitytracker.com/id?1023584"},{"name":"62292","refsource":"OSVDB","url":"http://www.osvdb.org/62292"},{"name":"38543","refsource":"SECUNIA","url":"http://secunia.com/advisories/38543"},{"name":"41855","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/41855/"},{"name":"http://www.adobe.com/support/security/bulletins/apsb10-05.html","refsource":"CONFIRM","url":"http://www.adobe.com/support/security/bulletins/apsb10-05.html"}]}}}},"cveMetadata":{"assignerOrgId":"078d4453-3bcd-4900-85e6-15281da43538","assignerShortName":"adobe","cveId":"CVE-2009-3960","datePublished":"2010-02-15T18:00:00.000Z","dateReserved":"2009-11-16T00:00:00.000Z","dateUpdated":"2026-08-06T03:55:29.278Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794090000,"cve":"CVE-2009-3960","description":"Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.","epss":{"date":"2026-11-12","epss":0.90118,"percentile":0.99799},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2009-3960","cwes":[],"dateAdded":"2022-03-07","dueDate":"2022-09-07","forensicTriage":"No","knownRansomwareCampaignUse":"Known","notes":"https://nvd.nist.gov/vuln/detail/CVE-2009-3960","product":"BlazeDS","requiredAction":"Apply updates per vendor instructions.","shortDescription":"Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.","vendorProject":"Adobe","vulnerabilityName":"Adobe BlazeDS Information Disclosure Vulnerability"},"kev_checked":1794522003,"products":"n/a n/a","references":["http://www.securityfocus.com/bid/38197","http://securitytracker.com/id?1023584","http://www.osvdb.org/62292","http://secunia.com/advisories/38543","https://www.exploit-db.com/exploits/41855/","http://www.adobe.com/support/security/bulletins/apsb10-05.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3960"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","provider":"CISA-ADP","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Adobe BlazeDS Information Disclosure Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[]}