Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,997 results · page 25 of 60
May 2, 2024Kofax Power PDF U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-37348 · Other software · Kofax · reported by zdi-disclosures@trendmicro.comHigh 7.8
Kofax Power PDF U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20445.
- Product
- Power PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Kofax Power PDF U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2023-37347 · Other software · Kofax · reported by zdi-disclosures@trendmicro.comHigh 7.8
Kofax Power PDF U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20444.
- Product
- Power PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Kofax Power PDF TIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-37346 · Other software · Kofax · reported by zdi-disclosures@trendmicro.comHigh 7.8
Kofax Power PDF TIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20443.
- Product
- Power PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Kofax Power PDF J2K File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-37345 · Other software · Kofax · reported by zdi-disclosures@trendmicro.comHigh 7.8
Kofax Power PDF J2K File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20442.
- Product
- Power PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Kofax Power PDF BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2023-37344 · Other software · Kofax · reported by zdi-disclosures@trendmicro.comHigh 7.8
Kofax Power PDF BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BMP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20441.
- Product
- Power PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Kofax Power PDF JP2 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-37343 · Other software · Kofax · reported by zdi-disclosures@trendmicro.comHigh 7.8
Kofax Power PDF JP2 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20440.
- Product
- Power PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Kofax Power PDF PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2023-37342 · Other software · Kofax · reported by zdi-disclosures@trendmicro.comHigh 7.8
Kofax Power PDF PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20439.
- Product
- Power PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Kofax Power PDF PNG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-37341 · Other software · Kofax · reported by zdi-disclosures@trendmicro.comHigh 7.8
Kofax Power PDF PNG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20397.
- Product
- Power PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Kofax Power PDF PNG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-37340 · Other software · Kofax · reported by zdi-disclosures@trendmicro.comHigh 7.8
Kofax Power PDF PNG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20396.
- Product
- Power PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Kofax Power PDF PCX File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-37339 · Other software · Kofax · reported by zdi-disclosures@trendmicro.comHigh 7.8
Kofax Power PDF PCX File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PCX files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20395.
- Product
- Power PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Kofax Power PDF GIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-37338 · Other software · Kofax · reported by zdi-disclosures@trendmicro.comHigh 7.8
Kofax Power PDF GIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of GIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20394.
- Product
- Power PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Kofax Power PDF JP2 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-37337 · Other software · Kofax · reported by zdi-disclosures@trendmicro.comHigh 7.8
Kofax Power PDF JP2 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20393.
- Product
- Power PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Kofax Power PDF TIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-37336 · Other software · Kofax · reported by zdi-disclosures@trendmicro.comHigh 7.8
Kofax Power PDF TIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20392.
- Product
- Power PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Kofax Power PDF BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2023-37335 · Other software · Kofax · reported by zdi-disclosures@trendmicro.comHigh 7.8
Kofax Power PDF BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BMP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20391.
- Product
- Power PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-37334 · Other software · Kofax · reported by zdi-disclosures@trendmicro.comHigh 7.8
Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20390.
- Product
- Power PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Kofax Power PDF PCX File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2023-37333 · Other software · Kofax · reported by zdi-disclosures@trendmicro.comHigh 7.8
Kofax Power PDF PCX File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PCX files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20389.
- Product
- Power PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Kofax Power PDF PNG File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2023-37332 · Other software · Kofax · reported by zdi-disclosures@trendmicro.comHigh 7.8
Kofax Power PDF PNG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20388.
- Product
- Power PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Kofax Power PDF GIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2023-37331 · Other software · Kofax · reported by zdi-disclosures@trendmicro.comHigh 7.8
Kofax Power PDF GIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of GIF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20373.
- Product
- Power PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Kofax Power PDF exportAsText Exposed Dangerous Method Remote Code Execution Vulnerability.CVE-2023-37330 · Other software · Kofax · reported by zdi-disclosures@trendmicro.comHigh 7.8
Kofax Power PDF exportAsText Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exportAsText method. The application exposes a JavaScript interface that allows the attacker to write arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-20230.
- Product
- Power PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-32161 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17778.
- Product
- PDF-XChange Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtracker-software.comzerodayinitiative.com
May 2, 2024PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-32160 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17767.
- Product
- PDF-XChange Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtracker-software.comzerodayinitiative.com
May 2, 2024PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-32159 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17765.
- Product
- PDF-XChange Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtracker-software.comzerodayinitiative.com
May 2, 2024PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-32158 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17764.
- Product
- PDF-XChange Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtracker-software.comzerodayinitiative.com
May 2, 2024Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability.CVE-2023-27366 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20225.
- Product
- PDF Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxit.comzerodayinitiative.com
May 2, 2024Foxit PDF Editor DOC File Parsing Exposed Dangerous Method Remote Code Execution Vulnerability.CVE-2023-27365 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
Foxit PDF Editor DOC File Parsing Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DOC files. The issue results from the lack of proper restrictions on macro-enabled documents. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-19739.
- Product
- PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxit.comzerodayinitiative.com
May 2, 2024Foxit PDF Editor XLS File Parsing Exposed Dangerous Method Remote Code Execution Vulnerability.CVE-2023-27364 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
Foxit PDF Editor XLS File Parsing Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XLS files. The issue results from the lack of proper restrictions on macro-enabled documents. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-19738.
- Product
- PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxit.comzerodayinitiative.com
May 2, 2024Foxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution Vulnerability.CVE-2023-27363 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
Foxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exportXFAData method. The application exposes a JavaScript interface that allows writing arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-19697.
- Product
- PDF Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxit.comzerodayinitiative.com
May 2, 2024PDF-XChange Editor TIF File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2023-27348 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor TIF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19108.
- Product
- PDF-XChange Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtracker-software.comzerodayinitiative.com
May 2, 2024PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-27345 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19303.
- Product
- PDF-XChange Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtracker-software.comzerodayinitiative.com
May 2, 2024PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-27344 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19302.
- Product
- PDF-XChange Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtracker-software.comzerodayinitiative.com
May 2, 2024PDF-XChange Editor EMF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-27343 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor EMF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in a EMF can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18790.
- Product
- PDF-XChange Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtracker-software.comzerodayinitiative.com
May 2, 2024PDF-XChange Editor EMF File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability.CVE-2023-27342 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor EMF File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18766.
- Product
- PDF-XChange Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtracker-software.comzerodayinitiative.com
May 2, 2024PDF-XChange Editor TIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-27341 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor TIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18729.
- Product
- PDF-XChange Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtracker-software.comzerodayinitiative.com
May 2, 2024PDF-XChange Editor PNG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-27340 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor PNG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. Crafted data in a PNG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18665.
- Product
- PDF-XChange Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtracker-software.comzerodayinitiative.com
May 2, 2024PDF-XChange Editor PNG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-27339 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor PNG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. Crafted data in a PNG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18663.
- Product
- PDF-XChange Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtracker-software.comzerodayinitiative.com
May 2, 2024PDF-XChange Editor TIF File Parsing Use-After-Free Information Disclosure Vulnerability.CVE-2023-27338 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comMedium 5.5
PDF-XChange Editor TIF File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18612.
- Product
- PDF-XChange Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtracker-software.comzerodayinitiative.com
May 2, 2024PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2023-27337 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18494.
- Product
- PDF-XChange Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtracker-software.comzerodayinitiative.com
May 2, 2024Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability.CVE-2023-27331 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19475.
- Product
- PDF Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxit.comzerodayinitiative.com
May 2, 2024Foxit PDF Reader XFA Annotation Use-After-Free Remote Code Execution Vulnerability.CVE-2023-27330 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
Foxit PDF Reader XFA Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19476.
- Product
- PDF Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxit.comzerodayinitiative.com
May 2, 2024Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability.CVE-2023-27329 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19477.
- Product
- PDF Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxit.comzerodayinitiative.com
May 2, 2024Send PDF for Contact Form 7: Unauthorized access of form submissionsCVE-2024-3585 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Send PDF for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of form submissions due to a missing capability check on the hooks function in all versions up to, and including, 1.0.2.3. This makes it possible for unauthenticated attackers to download information about contact form entries with PDFs.
- Product
- Send PDF for Contact Form 7
- Affected
- up to 1.0.2.3
- What to do
- Affects up to 1.0.2.3. Update Send PDF for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 2, 2024PDF Invoices & Packing Slips for WooCommerce: Server-Side Request ForgeryCVE-2024-3047 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.8.0 via the transform() function. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- PDF Invoices & Packing Slips for WooCommerce
- Affected
- up to 3.8.0
- What to do
- Affects up to 3.8.0. Update PDF Invoices & Packing Slips for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 2, 2024PDF Invoices & Packing Slips for WooCommerce: Stored Cross-Site ScriptingCVE-2024-3045 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- PDF Invoices & Packing Slips for WooCommerce
- Affected
- up to 3.8.0
- What to do
- Affects up to 3.8.0. Update PDF Invoices & Packing Slips for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 29, 2024An SSRF issue in the PDFMyURL service allows a remote attacker to obtain sensitive information and execute arbitrary code via a POST request in the url parameteCVE-2024-33449 · Other software · pdfmyurl · reported by MITRECritical 9.8
An SSRF issue in the PDFMyURL service allows a remote attacker to obtain sensitive information and execute arbitrary code via a POST request in the url parameter
- Product
- pdfmyurl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrumpz.netpdfmyurl.com
Apr 29, 2024Save as PDF plugin by Pdfcrowd: Missing AuthorizationCVE-2024-33684 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd allows Stored XSS.This issue affects Save as PDF plugin by Pdfcrowd: from n/a through 3.2.0.
- Product
- Save as PDF plugin by Pdfcrowd
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update Save as PDF plugin by Pdfcrowd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2024Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by an invalid character code in a Type 1 font.CVE-2024-4141 · Other software · Xpdf · reported by xpdf@xpdfreader.comLow 2.9
Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by an invalid character code in a Type 1 font. The root problem was a bounds check that was being optimized away by modern compilers.
- Product
- Xpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxpdfreader.comxpdfreader.com
Apr 22, 2024A buffer overflow vulnerability in pdf2json v0.70 allows a local attacker to execute arbitrary code via the GString::copy() and ImgOutputDev::ImgOutputDev functCVE-2024-28699 · Other software · json · reported by MITREHigh 7.8
A buffer overflow vulnerability in pdf2json v0.70 allows a local attacker to execute arbitrary code via the GString::copy() and ImgOutputDev::ImgOutputDev function.
- Product
- pdf2json
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 20243D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32694 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative interactive media 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin allows Reflected XSS.This issue affects 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin: from n/a through 3.62.
- Product
- 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook
- Affected
- up to 3.62
- What to do
- Affects up to 3.62. Update 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 19, 2024TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.CVE-2024-22640 · Other software · tcpdf_project · reported by MITREHigh 7.5
TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.
- Product
- tcpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by long Unicode sequence in ActualText.CVE-2024-3900 · Other software · Xpdf · reported by xpdf@xpdfreader.comLow 2.9
Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by long Unicode sequence in ActualText.
- Product
- Xpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxpdfreader.comxpdfreader.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.