CVE-2012-0767

MEDIUM

6.1

CVSS Score

Published: February 16, 2012 at 07:00 PM UTC

Updated: June 16, 2026 at 11:38 PM UTC

1 product affected across 1 vendorFlash Player· also runs on 5 platforms

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.1

Exploitation

CISA KEV

Exploit prediction

EPSS 6%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score6.2%

EPSS (Exploit Prediction Scoring System) estimates a 6.2% chance this CVE is exploited in the wild within the next 30 days — higher than 93% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML.

Required Action

The impacted product is end-of-life and should be disconnected if still in use.

Ransomware Use

Unknown

Added to KEV

Jun 8, 2022

Remediation Due

Jun 22, 2022

1588 days overdue

Notes

https://nvd.nist.gov/vuln/detail/CVE-2012-0767

Description

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)," as exploited in the wild in February 2012.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Flash Player · Adobe

95%

v < 10.3.183.15v < 11.1.111.6v < 11.1.115.611.0 ≤ v < 11.1.102.62

Affected range stops below 10.3.183.15, so it looks safe — our inference, not a vendor statement

Affected range stops below 11.1.102.62, so it looks safe — our inference, not a vendor statement

Affected range stops below 11.1.111.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 11.1.115.6, so it looks safe — our inference, not a vendor statement

apple-macos (environment) · google-android (environment) · linux-linux-kernel (environment) · microsoft-windows (environment) · oracle-solaris (environment)