Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

2,997 results · page 33 of 60

Jan 26, 2023This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor.CVE-2022-42372 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18347.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tracker-software.com zerodayinitiative.com
Jan 26, 2023This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor.CVE-2022-42371 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18346.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tracker-software.com zerodayinitiative.com
Jan 26, 2023This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor.CVE-2022-42370 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18345.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tracker-software.com zerodayinitiative.com
Jan 26, 2023This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor.CVE-2022-42369 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comMedium 5.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18344.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tracker-software.com zerodayinitiative.com
Jan 26, 2023This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor.CVE-2022-41153 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comMedium 5.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18343.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tracker-software.com zerodayinitiative.com
Jan 26, 2023This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor.CVE-2022-41152 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18342.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tracker-software.com zerodayinitiative.com
Jan 26, 2023This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor.CVE-2022-41151 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18341.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tracker-software.com zerodayinitiative.com
Jan 26, 2023This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor.CVE-2022-41150 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18340.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tracker-software.com zerodayinitiative.com
Jan 26, 2023This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor.CVE-2022-41149 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18339.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tracker-software.com zerodayinitiative.com
Jan 26, 2023This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor.CVE-2022-41148 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18338.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tracker-software.com zerodayinitiative.com
Jan 26, 2023This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor.CVE-2022-41147 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18286.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tracker-software.com zerodayinitiative.com
Jan 26, 2023This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor.CVE-2022-41146 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comMedium 5.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18284.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tracker-software.com zerodayinitiative.com
Jan 26, 2023This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor.CVE-2022-41145 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comMedium 5.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18283.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tracker-software.com zerodayinitiative.com
Jan 26, 2023This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor.CVE-2022-41144 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18282.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tracker-software.com zerodayinitiative.com
Jan 26, 2023This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor.CVE-2022-41143 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18225.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tracker-software.com zerodayinitiative.com
Jan 18, 2023Foxit PDF Reader and PDF Editor 11.2.1.53537 and earlier has an Out-of-Bounds Read vulnerability.CVE-2022-47881 · Other software · Foxit · reported by MITREMedium 6.5
Foxit PDF Reader and PDF Editor 11.2.1.53537 and earlier has an Out-of-Bounds Read vulnerability.
Product
PDF Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hacksys.io foxit.com
Jan 12, 2023 The APDFL.dll contains a memory corruption vulnerability while parsing specially crafted PDF files.CVE-2022-3161 · Other software · Siemens · reported by ics-cert@hq.dhs.govHigh 7.8
The APDFL.dll contains a memory corruption vulnerability while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process.
Product
JT2Go
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Jan 12, 2023 The APDFL.dll contains an out-of-bounds write past the fixed-length heap-based buffer while parsing specially crafted PDF files.CVE-2022-3160 · Other software · Siemens · reported by ics-cert@hq.dhs.govHigh 7.8
The APDFL.dll contains an out-of-bounds write past the fixed-length heap-based buffer while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process.
Product
JT2Go
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Jan 12, 2023The APDFL.dll contains a stack-based buffer overflow vulnerability that could be triggered while parsing specially crafted PDF files.CVE-2022-3159 · Other software · Siemens · reported by ics-cert@hq.dhs.govHigh 7.8
The APDFL.dll contains a stack-based buffer overflow vulnerability that could be triggered while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process.
Product
JT2Go
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Dec 19, 2022pdftojson commit 94204bb was discovered to contain a stack overflow via the component Stream::makeFilter(char*, Stream*, Object*, int).CVE-2022-44109 · Other software · Pdftojson Project · reported by MITRECritical 9.8
pdftojson commit 94204bb was discovered to contain a stack overflow via the component Stream::makeFilter(char*, Stream*, Object*, int).
Product
Pdftojson
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 19, 2022pdftojson commit 94204bb was discovered to contain a stack overflow via the component Object::copy(Object*):Object.cc.CVE-2022-44108 · Other software · Pdftojson Project · reported by MITRECritical 9.8
pdftojson commit 94204bb was discovered to contain a stack overflow via the component Object::copy(Object*):Object.cc.
Product
Pdftojson
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 6, 2022Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerability via the PDF file import function.CVE-2022-45025 · Other software · Markdown Preview Enhanced Project · reported by MITRECritical 9.8
Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerability via the PDF file import function.
Product
Markdown Preview Enhanced
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 6, 2022pdfmake is an open source client/server side PDF printing in pure JavaScript.CVE-2022-46161 · Other software · bpampuch · reported by GitHubCritical 10
pdfmake is an open source client/server side PDF printing in pure JavaScript. In versions up to and including 0.2.5 pdfmake contains an unsafe evaluation of user controlled input. Users of pdfmake are thus subject to arbitrary code execution in the context of the process running the pdfmake code. There are no known fixes for this issue. Users are advised to restrict access to trusted user input.
Product
pdfmake
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com securitylab.github.com
Nov 28, 2022Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron.CVE-2022-41957 · Other software · julianhille · reported by GitHubHigh 7.5
Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. The package muhammara before 2.6.2 and from 3.0.0 and before 3.3.0, as well as all versions of muhammara's predecessor package hummus, are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed. The issue has been patched in muhammara version 3.4.0 and the fix has been backported to version 2.6.2. As a workaround, do not process files from untrusted sources. If using hummus, replace the package with muhammara.
Product
MuhammaraJS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 21, 2022A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430.CVE-2022-40129 · Other software · Foxit · reported by talos-cna@cisco.comHigh 7.8
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. A specially-crafted PDF document can trigger the reuse of previously freed memory via misusing Optional Content Group API, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled.
Product
Foxit Reader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Nov 21, 2022A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430.CVE-2022-38097 · Other software · Foxit · reported by talos-cna@cisco.comHigh 7.8
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. By prematurely destroying annotation objects, a specially-crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled.
Product
Foxit Reader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Nov 21, 2022A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430.CVE-2022-37332 · Other software · Foxit · reported by talos-cna@cisco.comHigh 7.8
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. A specially-crafted PDF document can trigger the reuse of previously freed memory via misusing media player API, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled.
Product
Foxit Reader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Nov 21, 2022A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430.CVE-2022-32774 · Other software · Foxit · reported by talos-cna@cisco.comHigh 7.8
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. By prematurely deleting objects associated with pages, a specially-crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled.
Product
Foxit Reader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Nov 15, 2022A stack overflow in the Catalog::readPageLabelTree2(Object*) function of XPDF v4.04 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.CVE-2022-43071 · Other software · Xpdfreader · reported by MITREMedium 5.5
A stack overflow in the Catalog::readPageLabelTree2(Object*) function of XPDF v4.04 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Nov 14, 2022XPDF v4.04 was discovered to contain a stack overflow via the function FileStream::copy() at xpdf/Stream.cc:795.CVE-2022-43295 · Other software · Xpdfreader · reported by MITREMedium 5.5
XPDF v4.04 was discovered to contain a stack overflow via the function FileStream::copy() at xpdf/Stream.cc:795.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Nov 10, 2022xpdfreader 4.03 is vulnerable to Buffer Overflow.CVE-2021-40226 · Other software · Glyphandcog · reported by MITREHigh 7.5
xpdfreader 4.03 is vulnerable to Buffer Overflow.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Nov 6, 2022Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a PDF export to trigger a remote shell if thCVE-2022-44544 · Other software · Mahara · reported by MITRECritical 9.8
Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a PDF export to trigger a remote shell if the site is running on Ubuntu and the flag -dSAFER is not set with Ghostscript.
Product
Mahara
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.launchpad.net mahara.org
Nov 3, 2022In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component.CVE-2022-43571 · Other software · Splunk · reported by prodsec@splunk.comHigh 8.8
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component.
Product
Splunk Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record research.splunk.com splunk.com
Nov 2, 2022Muhammara is a node module with c/cpp bindings to modify PDF with js for node or electron (based/replacement on/of galkhana/hummusjs).CVE-2022-39381 · Other software · julianhille · reported by GitHubHigh 7.5
Muhammara is a node module with c/cpp bindings to modify PDF with js for node or electron (based/replacement on/of galkhana/hummusjs). The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be appended to another. This issue has been patched in 2.6.0 for muhammara and not at all for hummus. As a workaround, do not process files from untrusted sources.
Product
MuhammaraJS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 2, 2022ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Cross Site Scripting (XSS) via createPdf.php.CVE-2022-40840 · Other software · Ndk-design · reported by MITREMedium 6.1
ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Cross Site Scripting (XSS) via createPdf.php.
Product
Ndkadvancedcustomizationfields
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 1, 2022The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid daCVE-2022-25885 · Other software · Muhammara Project · reported by report@snyk.ioHigh 7.5
The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.
Product
Muhammara
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 31, 2022 Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the applicationCVE-2022-39019 · Other software · M-Files · reported by vdp@themissinglink.com.auMedium 6.3
Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the application server.
Product
Hubshare
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record themissinglink.com.au themissinglink.com.au
Oct 31, 2022 Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access restricted PDF files via a known URL.CVE-2022-39018 · Other software · M-Files · reported by vdp@themissinglink.com.auHigh 8.2
Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access restricted PDF files via a known URL.
Product
Hubshare
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record themissinglink.com.au themissinglink.com.au
Oct 31, 2022 Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account takeover via a crafted PDF upload.CVE-2022-39016 · Other software · M-Files · reported by vdp@themissinglink.com.auHigh 8.2
Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account takeover via a crafted PDF upload.
Product
Hubshare
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record themissinglink.com.au themissinglink.com.au
Oct 20, 2022The APDFL.dll in Siemens JT2Go prior to V13.3.0.5 and Siemens Teamcenter Visualization prior to V14.0.0.2 contains an out of bounds write past the fixed-length CVE-2022-2069 · Other software · Siemens · reported by ics-cert@hq.dhs.govHigh 7.8
The APDFL.dll in Siemens JT2Go prior to V13.3.0.5 and Siemens Teamcenter Visualization prior to V14.0.0.2 contains an out of bounds write past the fixed-length heap-based buffer while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process.
Product
JT2Go
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cisa.gov
Oct 11, 2022The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-41387 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0.
Product
D8s-pdfs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com pypi.org
Oct 11, 2022Due to lack of proper memory management, when a victim opens manipulated Portable Document Format (.pdf, PDFPublishing.dll) file received from untrusted sourcesCVE-2022-41181 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.5
Due to lack of proper memory management, when a victim opens manipulated Portable Document Format (.pdf, PDFPublishing.dll) file received from untrusted sources in SAP 3D Visual Enterprise Author - version 9, it is possible for the application to crash and becomes temporarily unavailable to the user until restart of the application.
Product
SAP 3D Visual Enterprise Author
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Oct 11, 2022Due to lack of proper memory management, when a victim opens a manipulated Portable Document Format (.pdf, PDFPublishing.dll) file received from untrusted sourcCVE-2022-41180 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
Due to lack of proper memory management, when a victim opens a manipulated Portable Document Format (.pdf, PDFPublishing.dll) file received from untrusted sources in SAP 3D Visual Enterprise Author - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
Product
SAP 3D Visual Enterprise Author
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Oct 3, 2022A maliciously crafted PDF file when parsed through Autodesk AutoCAD 2023 causes an unhandled exception.CVE-2022-33887 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PDF file when parsed through Autodesk AutoCAD 2023 causes an unhandled exception. An attacker can leverage this vulnerability to cause a crash or read sensitive data or execute arbitrary code in the context of the current process.
Product
Autocad
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record autodesk.com autodesk.com
Oct 3, 2022A maliciously crafted X_B, CATIA, and PDF file when parsed through Autodesk AutoCAD 2023 and 2022 can be used to write beyond the allocated buffer.CVE-2022-33885 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted X_B, CATIA, and PDF file when parsed through Autodesk AutoCAD 2023 and 2022 can be used to write beyond the allocated buffer. This vulnerability can lead to arbitrary code execution.
Product
Autocad
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record autodesk.com autodesk.com
Sep 30, 2022An issue was discovered in Xpdf 4.04.CVE-2022-41844 · Other software · Xpdfreader · reported by MITREMedium 5.5
An issue was discovered in Xpdf 4.04. There is a crash in XRef::fetch(int, int, Object*, int) in xpdf/XRef.cc, a different vulnerability than CVE-2018-16369 and CVE-2019-16088.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record xpdfreader.com forum.xpdfreader.com
Sep 30, 2022An issue was discovered in Xpdf 4.04.CVE-2022-41843 · Other software · Xpdfreader · reported by MITREMedium 5.5
An issue was discovered in Xpdf 4.04. There is a crash in convertToType0 in fofi/FoFiType1C.cc, a different vulnerability than CVE-2022-38928.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Sep 30, 2022An issue was discovered in Xpdf 4.04.CVE-2022-41842 · Other software · Xpdfreader · reported by MITREMedium 5.5
An issue was discovered in Xpdf 4.04. There is a crash in gfseek(_IO_FILE*, long, int) in goo/gfile.cc.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record xpdfreader.com forum.xpdfreader.com
Sep 28, 2022There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04.CVE-2022-38222 · Other software · Xpdfreader · reported by MITREHigh 7.8
There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04. It can be triggered by sending a crafted PDF file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service or possibly have unspecified other impact.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Sep 26, 2022Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.CVE-2022-3198 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com crbug.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.