Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,997 results · page 37 of 60
Nov 10, 2021pdf2json v0.71 was discovered to contain a NULL pointer dereference in the component ObjectStream::getObject.CVE-2020-23879 · Other software · Flowpaper · reported by MITREHigh 7.5
pdf2json v0.71 was discovered to contain a NULL pointer dereference in the component ObjectStream::getObject.
- Product
- Pdf2json
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2021pdf2json v0.71 was discovered to contain a stack buffer overflow in the component XRef::fetch.CVE-2020-23878 · Other software · Flowpaper · reported by MITRECritical 9.8
pdf2json v0.71 was discovered to contain a stack buffer overflow in the component XRef::fetch.
- Product
- Pdf2json
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2021pdf2xml v2.0 was discovered to contain a stack buffer overflow in the component getObjectStream.CVE-2020-23877 · Other software · Science-miner · reported by MITRECritical 9.8
pdf2xml v2.0 was discovered to contain a stack buffer overflow in the component getObjectStream.
- Product
- Pdf2xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2021pdf2xml v2.0 was discovered to contain a memory leak in the function TextPage::testLinkedText.CVE-2020-23876 · Other software · Science-miner · reported by MITREHigh 7.5
pdf2xml v2.0 was discovered to contain a memory leak in the function TextPage::testLinkedText.
- Product
- Pdf2xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2021pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::addAttributsNode.CVE-2020-23874 · Other software · Science-miner · reported by MITRECritical 9.8
pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::addAttributsNode.
- Product
- Pdf2xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Nov 10, 2021pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::dump.CVE-2020-23873 · Other software · Science-miner · reported by MITRECritical 9.8
pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::dump.
- Product
- Pdf2xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Nov 10, 2021A NULL pointer dereference in the function TextPage::restoreState of pdf2xml v2.0 allows attackers to cause a denial of service (DoS).CVE-2020-23872 · Other software · Science-miner · reported by MITREHigh 7.5
A NULL pointer dereference in the function TextPage::restoreState of pdf2xml v2.0 allows attackers to cause a denial of service (DoS).
- Product
- Pdf2xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2021An issue was discovered in function StartPage in text2pdf.c in pdfcorner text2pdf 1.1, allows attackers to cause denial of service or possibly other undisclosedCVE-2020-23680 · Other software · Text2pdf Project · reported by MITREHigh 7.8
An issue was discovered in function StartPage in text2pdf.c in pdfcorner text2pdf 1.1, allows attackers to cause denial of service or possibly other undisclosed impacts.
- Product
- Text2pdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2021In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell metacharacters in a collectCVE-2021-43266 · Other software · Mahara · reported by MITREHigh 7.3
In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell metacharacters in a collection name. Additional, in Mahara before 20.10.4, 21.04.3, and 21.10.1, exporting collections via PDF export could cause code execution
- Product
- Mahara
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugs.launchpad.net
Nov 2, 2021Use after free in PDF Accessibility in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pCVE-2021-37993 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in PDF Accessibility in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Nov 2, 2021Heap buffer overflow in PDFium in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2021-37984 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Heap buffer overflow in PDFium in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Oct 22, 2021Aplioxio PDF ShapingUp 5.0.0.139 contains a buffer overflow which allows attackers to cause a denial of service (DoS) via a crafted PDF file.CVE-2020-28969 · Other software · Aplixio · reported by MITREHigh 7.8
Aplioxio PDF ShapingUp 5.0.0.139 contains a buffer overflow which allows attackers to cause a denial of service (DoS) via a crafted PDF file.
- Product
- PDF Shapingup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Oct 18, 2021Gutenberg PDF Viewer Block: Does not sanitise and escape its blockCVE-2021-24760 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Gutenberg PDF Viewer Block WordPress plugin before 1.0.1 does not sanitise and escape its block, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
- Product
- Gutenberg PDF Viewer Block
- Fixed in
- 1.0.1
- What to do
- Update Gutenberg PDF Viewer Block to 1.0.1 or newer.
Oct 18, 2021PDF Flipbook, 3D Flipbook WordPress – DearFlip: Does not escape the class attribute of its shortcode before outputting it back in an attributeCVE-2021-24732 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PDF Flipbook, 3D Flipbook WordPress – DearFlip WordPress plugin before 1.7.10 does not escape the class attribute of its shortcode before outputting it back in an attribute, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
- Product
- PDF Flipbook, 3D Flipbook WordPress – DearFlip
- Fixed in
- 1.7.10
- What to do
- Update PDF Flipbook, 3D Flipbook WordPress – DearFlip to 1.7.10 or newer.
Oct 18, 2021WordPress PDF Light Viewer: Allows users with Author roles to execute arbitrary OS command on the server via OS Command InjectionCVE-2021-24684 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress PDF Light Viewer Plugin WordPress plugin before 1.4.12 allows users with Author roles to execute arbitrary OS command on the server via OS Command Injection when invoking Ghostscript.
- Product
- WordPress PDF Light Viewer
- Fixed in
- 1.4.12
- What to do
- Update WordPress PDF Light Viewer to 1.4.12 or newer.
Oct 18, 2021An exploitable double-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF.CVE-2021-21797 · Other software · Gonitro · reported by talos-cna@cisco.comHigh 7.8
An exploitable double-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause a reference to a timeout object to be stored in two different places. When closed, the document will result in the reference being released twice. This can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger this vulnerability.
- Product
- Nitro Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 18, 2021An exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF.CVE-2021-21796 · Other software · Gonitro · reported by talos-cna@cisco.comHigh 7.8
An exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause an object containing the path to a document to be destroyed and then later reused, resulting in a use-after-free vulnerability, which can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger this vulnerability.
- Product
- Nitro Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 1, 2021Corel PDF Fusion 2.6.2.0 is affected by a Heap Corruption vulnerability when parsing a crafted file.CVE-2021-38098 · Other software · Corel · reported by MITREHigh 7.8
Corel PDF Fusion 2.6.2.0 is affected by a Heap Corruption vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.
- Product
- PDF Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortinet.com
Oct 1, 2021Coreip.dll in Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file.CVE-2021-38096 · Other software · Corel · reported by MITREHigh 7.8
Coreip.dll in Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.
- Product
- PDF Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortinet.com
Oct 1, 2021Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file.CVE-2021-38097 · Other software · Corel · reported by MITREHigh 7.8
Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.
- Product
- PDF Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortinet.com
Oct 1, 2021Cross-site scripting (XSS) vulnerability in dompdf/dompdf/www/demo.php infaveo-helpdesk v1.11.0 and below allow remote attackers to inject arbitrary web script CVE-2021-40925 · Other software · Faveohelpdesk · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in dompdf/dompdf/www/demo.php infaveo-helpdesk v1.11.0 and below allow remote attackers to inject arbitrary web script or HTML via the $_SERVER["PHP_SELF"] parameter.
- Product
- Faveo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2021A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Image2PDF.CVE-2021-38675 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.4
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Image2PDF. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Image2PDF: Image2PDF 2.1.5 ( 2021/08/17 ) and later
- Product
- Image2PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2021An issue was discovered in pdftools through 20200714.CVE-2021-39543 · Other software · Pdftools Project · reported by MITREMedium 5.5
An issue was discovered in pdftools through 20200714. A NULL pointer dereference exists in the function Analyze::AnalyzeRoot() located in analyze.cpp. It allows an attacker to cause Denial of Service.
- Product
- Pdftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2021An issue was discovered in pdftools through 20200714.CVE-2021-39542 · Other software · Pdftools Project · reported by MITREMedium 5.5
An issue was discovered in pdftools through 20200714. A NULL pointer dereference exists in the function Font::Size() located in font.cpp. It allows an attacker to cause Denial of Service.
- Product
- Pdftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2021An issue was discovered in pdftools through 20200714.CVE-2021-39541 · Other software · Pdftools Project · reported by MITREMedium 5.5
An issue was discovered in pdftools through 20200714. A NULL pointer dereference exists in the function Analyze::AnalyzeXref() located in analyze.cpp. It allows an attacker to cause Denial of Service.
- Product
- Pdftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2021An issue was discovered in pdftools through 20200714.CVE-2021-39540 · Other software · Pdftools Project · reported by MITREHigh 7.8
An issue was discovered in pdftools through 20200714. A stack-buffer-overflow exists in the function Analyze::AnalyzePages() located in analyze.cpp. It allows an attacker to cause code Execution.
- Product
- Pdftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2021An issue was discovered in pdftools through 20200714.CVE-2021-39539 · Other software · Pdftools Project · reported by MITREMedium 5.5
An issue was discovered in pdftools through 20200714. A NULL pointer dereference exists in the function node::BDCNode::~BDCNode() located in bdcnode.cpp. It allows an attacker to cause Denial of Service.
- Product
- Pdftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2021An issue was discovered in pdftools through 20200714.CVE-2021-39538 · Other software · Pdftools Project · reported by MITREMedium 5.5
An issue was discovered in pdftools through 20200714. A NULL pointer dereference exists in the function node::ObjNode::Value() located in objnode.cpp. It allows an attacker to cause Denial of Service.
- Product
- Pdftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021A Memory Corruption vulnerability for PDF files in Autodesk Navisworks 2019, 2020, 2021, 2022 may lead to code execution through maliciously crafted DLL files.CVE-2021-27046 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A Memory Corruption vulnerability for PDF files in Autodesk Navisworks 2019, 2020, 2021, 2022 may lead to code execution through maliciously crafted DLL files.
- Product
- Navisworks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Sep 15, 2021A maliciously crafted PDF file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boundaries when parsing the PDF file.CVE-2021-27045 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PDF file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boundaries when parsing the PDF file. This vulnerability can be exploited to execute arbitrary code.
- Product
- Navisworks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Sep 15, 2021An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF.CVE-2021-21798 · Other software · Gonitro · reported by talos-cna@cisco.comHigh 7.8
An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause a stack variable to go out of scope, resulting in the application dereferencing a stale pointer. This can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger the vulnerability.
- Product
- Nitro Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 15, 2021PDFTron's WebViewer UI 8.0 or below renders dangerous URLs as hyperlinks in supported documents, including JavaScript URLs, allowing the execution of arbitrary CVE-2021-39307 · Other software · Pdftron · reported by MITREMedium 6.1
PDFTron's WebViewer UI 8.0 or below renders dangerous URLs as hyperlinks in supported documents, including JavaScript URLs, allowing the execution of arbitrary JavaScript code.
- Product
- Webviewer UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.nccgroup.compdftron.com
Sep 15, 2021A local file inclusion vulnerability in ExpertPDF 9.5.0 through 14.1.0 allows attackers to read the file contents from files that the running ExpertPDF process CVE-2020-35340 · Other software · Expertpdf · reported by MITREHigh 7.5
A local file inclusion vulnerability in ExpertPDF 9.5.0 through 14.1.0 allows attackers to read the file contents from files that the running ExpertPDF process has access to read.
- Product
- Expertpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoptionalctf.comoptionalctf.com
Aug 31, 2021ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page.CVE-2021-35219 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 6
ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page.
- Product
- Orion Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsupport.solarwinds.com
Aug 30, 2021OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution (RCE) via XML tag injection because reportlab\platypus\paraparser.py (reCVE-2021-36359 · Other software · Bscw · reported by MITREHigh 8.8
OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution (RCE) via XML tag injection because reportlab\platypus\paraparser.py (reached via bscw.cgi op=_editfolder.EditFolder) calls eval on attacker-supplied Python code. This is fixed in 5.0.12, 5.1.10, 5.2.4, 7.3.3, and 7.4.3.
- Product
- Bscw Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 26, 2021It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint.CVE-2020-14161 · Other software · Thecodingmachine · reported by MITREMedium 6.1
It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint.
- Product
- Gotenberg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2021An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion, which results in a remote attacker being able to read local files oCVE-2020-14160 · Other software · Thecodingmachine · reported by MITREHigh 7.5
An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion, which results in a remote attacker being able to read local files or fetch intranet resources.
- Product
- Gotenberg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021Stack-based Buffer Overflow in PoDoFo v0.9.6 allows attackers to cause a denial of service via the component 'src/base/PdfDictionary.cpp:65'.CVE-2020-18971 · Other software · Podofo Project · reported by MITREMedium 5.5
Stack-based Buffer Overflow in PoDoFo v0.9.6 allows attackers to cause a denial of service via the component 'src/base/PdfDictionary.cpp:65'.
- Product
- Podofo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netsourceforge.net
Aug 16, 2021Wonder PDF Embed: Does not escape parameters of its wonderplugin_pdf shortcodeCVE-2021-24541 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Wonder PDF Embed WordPress plugin before 1.7 does not escape parameters of its wonderplugin_pdf shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.
- Product
- Wonder PDF Embed
- Fixed in
- 1.7
- What to do
- Update Wonder PDF Embed to 1.7 or newer.
Aug 11, 2021An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4.CVE-2021-38574 · Other software · Foxitsoftware · reported by MITRECritical 9.8
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows SQL Injection via crafted data at the end of a string.
- Product
- Foxit Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Aug 11, 2021An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4.CVE-2021-38573 · Other software · Foxitsoftware · reported by MITRECritical 9.8
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because a CombineFiles pathname is not validated.
- Product
- Foxit Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Aug 11, 2021An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4.CVE-2021-38572 · Other software · Foxitsoftware · reported by MITRECritical 9.8
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because the extractPages pathname is not validated.
- Product
- Foxit Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Aug 11, 2021An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4.CVE-2021-38571 · Other software · Foxitsoftware · reported by MITREHigh 7.8
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows DLL hijacking, aka CNVD-C-2021-68000 and CNVD-C-2021-68502.
- Product
- Foxit Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Aug 11, 2021An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4.CVE-2021-38570 · Other software · Foxitsoftware · reported by MITRECritical 9.1
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows attackers to delete arbitrary files (during uninstallation) via a symlink.
- Product
- Foxit Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Aug 11, 2021An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4.CVE-2021-38569 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows stack consumption via recursive function calls during the handling of XFA forms or link objects.
- Product
- Foxit Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Aug 11, 2021An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4.CVE-2021-38568 · Other software · Foxitsoftware · reported by MITRECritical 9.8
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows memory corruption during conversion of a PDF document to a different document format.
- Product
- Foxit Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Aug 11, 2021An issue was discovered in Foxit PDF Editor before 11.0.1 and PDF Reader before 11.0.1 on macOS.CVE-2021-38567 · Other software · Foxit · reported by MITREHigh 7.5
An issue was discovered in Foxit PDF Editor before 11.0.1 and PDF Reader before 11.0.1 on macOS. It mishandles missing dictionary entries, leading to a NULL pointer dereference, aka CNVD-C-2021-95204.
- Product
- PDF Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Aug 11, 2021An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1.CVE-2021-38566 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows stack consumption during recursive processing of embedded XML nodes.
- Product
- PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Aug 11, 2021An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1.CVE-2021-38565 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows writing to arbitrary files via submitForm.
- Product
- PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Aug 11, 2021An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1.CVE-2021-38564 · Other software · Foxitsoftware · reported by MITRECritical 9.1
An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows an out-of-bounds read via util.scand.
- Product
- PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.