Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,997 results · page 41 of 60
Sep 4, 2020In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information about an uninitialized object because of dCVE-2020-11493 · Other software · Foxitsoftware · reported by MITREHigh 8.1
In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information about an uninitialized object because of direct transformation from PDF Object to Stream without concern for a crafted XObject.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Sep 3, 2020There is an invalid memory access in the function fprintf located in Error.cc in Xpdf 4.0.2.CVE-2020-24999 · Other software · Xpdfreader · reported by MITREHigh 7.8
There is an invalid memory access in the function fprintf located in Error.cc in Xpdf 4.0.2. It can be triggered by sending a crafted PDF file to the pdftohtml binary, which allows a remote attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
- Product
- Xpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.xpdfreader.comforum.xpdfreader.com
Sep 3, 2020There is an invalid memory access in the function TextString::~TextString() located in Catalog.cc in Xpdf 4.0.2.CVE-2020-24996 · Other software · Xpdfreader · reported by MITREHigh 7.8
There is an invalid memory access in the function TextString::~TextString() located in Catalog.cc in Xpdf 4.0.2. It can be triggered by (for example) sending a crafted pdf file to the pdftohtml binary, which allows a remote attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
- Product
- Xpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.xpdfreader.comforum.xpdfreader.com
Aug 31, 2020OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document.CVE-2020-12646 · Other software · Open-xchange · reported by MITREMedium 5.4
OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document.
- Product
- Open-xchange Appsuite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopen-xchange.comexchange.xforce.ibmcloud.com
Aug 19, 2020This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.2.29539.CVE-2020-15638 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.2.29539. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the NodeProperties::InferReceiverMapsUnsafe method. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10950.
- Product
- PhantomPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comzerodayinitiative.com
Aug 19, 2020This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511.CVE-2020-15637 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comLow 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the SetLocalDescription method. By performing actions in JavaScript, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-10972.
- Product
- PhantomPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comzerodayinitiative.com
Aug 17, 2020A remote code execution vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory.CVE-2020-1568 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
A remote code execution vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit the vulnerability, in a web-based attack scenario, an attacker could host a website that contains malicious PDF content. In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted PDF content that could exploit the vulnerability. However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could trick a user into clicking a link that takes the user to the attacker's site. The securit
- Product
- Microsoft Edge (EdgeHTML-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Aug 12, 2020Documalis Free PDF Editor version 5.7.2.26 and Documalis Free PDF Scanner version 5.7.2.122 do not appropriately validate the contents of JPEG images contained CVE-2020-7374 · Other software · Documalis · reported by cve@rapid7.comMedium 5.3
Documalis Free PDF Editor version 5.7.2.26 and Documalis Free PDF Scanner version 5.7.2.122 do not appropriately validate the contents of JPEG images contained within a PDF. Attackers can exploit this vulnerability to trigger a buffer overflow on the stack and gain remote code execution as the user running the Documalis Free PDF Editor or Documalis Free PDF Scanner software.
- Product
- Free PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2020Heap buffer overflow in PDFium in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.CVE-2020-6513 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Heap buffer overflow in PDFium in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jul 17, 2020DaviewIndy 8.98.9 and earlier has a Heap-based overflow vulnerability, triggered when the user opens a malformed PDF file that is mishandled by Daview.exe.CVE-2020-7818 · Other software · HumanTolk Co.Ltd · reported by vuln@krcert.or.krHigh 7.8
DaviewIndy 8.98.9 and earlier has a Heap-based overflow vulnerability, triggered when the user opens a malformed PDF file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
- Product
- DaviewIndy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhmtalk.comkrcert.or.kr
Jul 14, 2020An information disclosure vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka 'Microsoft Edge PDF Information DisclosuCVE-2020-1433 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
An information disclosure vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka 'Microsoft Edge PDF Information Disclosure Vulnerability'.
- Product
- Microsoft Edge (EdgeHTML-based) on Windows 10 Version 2004 for ARM64-based Systems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jul 6, 2020In all versions of the package jspdf, it is possible to use <<script>script> in order to go over the filtering regex.CVE-2020-7691 · Other software · Parall · reported by report@snyk.ioMedium 6.3
In all versions of the package jspdf, it is possible to use <<script>script> in order to go over the filtering regex.
- Product
- Jspdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2020All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS).CVE-2020-7690 · Other software · Parall · reported by report@snyk.ioMedium 6.1
All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via the html method.
- Product
- Jspdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2020An issue was discovered in Foxit Reader and PhantomPDF before 9.5.CVE-2019-20837 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It allows signature validation bypass via a modified file or a file with non-standard signatures.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit Reader and PhantomPDF before 9.5.CVE-2019-20836 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It has mishandling of cloud credentials, as demonstrated by Google Drive.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit Reader and PhantomPDF before 9.5.CVE-2019-20835 · Other software · Foxitsoftware · reported by MITREMedium 4.3
An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It has homograph mishandling.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit PhantomPDF before 8.3.10.CVE-2019-20834 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit PhantomPDF before 8.3.10. It allows signature validation bypass via a modified file or a file with non-standard signatures.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit PhantomPDF before 8.3.10.CVE-2019-20833 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit PhantomPDF before 8.3.10. It has mishandling of cloud credentials, as demonstrated by Google Drive.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit PhantomPDF before 8.3.10.CVE-2019-20832 · Other software · Foxitsoftware · reported by MITREMedium 4.3
An issue was discovered in Foxit PhantomPDF before 8.3.10. It has homograph mishandling.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in the 3D Plugin Beta for Foxit Reader and PhantomPDF before 9.5.0.20733.CVE-2019-20831 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in the 3D Plugin Beta for Foxit Reader and PhantomPDF before 9.5.0.20733. It has void data mishandling, causing a crash.
- Product
- 3d
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit Reader and PhantomPDF before 9.6.CVE-2019-20830 · Other software · Foxitsoftware · reported by MITRECritical 9.8
An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has an out-of-bounds write when Internet Explorer is used.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit Reader and PhantomPDF before 9.6.CVE-2019-20829 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has a NULL pointer dereference via FXSYS_wcslen in an Epub file.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit Reader and PhantomPDF before 9.6.CVE-2019-20828 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has a buffer overflow because a looping correction does not occur after JavaScript updates Field APs.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit PhantomPDF Mac 3.3 and Foxit Reader for Mac before 3.3.CVE-2019-20827 · Other software · Foxitsoftware · reported by MITRECritical 9.8
An issue was discovered in Foxit PhantomPDF Mac 3.3 and Foxit Reader for Mac before 3.3. It allows stack consumption because of interaction between ICC-Based color space and Alternate color space.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit PhantomPDF Mac 3.3 and Foxit Reader for Mac before 3.3.CVE-2019-20826 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit PhantomPDF Mac 3.3 and Foxit Reader for Mac before 3.3. It has a NULL pointer dereference.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit PhantomPDF before 8.3.11.CVE-2019-20825 · Other software · Foxitsoftware · reported by MITRECritical 9.8
An issue was discovered in Foxit PhantomPDF before 8.3.11. It has an out-of-bounds write when Internet Explorer is used.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit PhantomPDF before 8.3.11.CVE-2019-20824 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit PhantomPDF before 8.3.11. It has a NULL pointer dereference via FXSYS_wcslen in an Epub file.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit PhantomPDF before 8.3.11.CVE-2019-20823 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit PhantomPDF before 8.3.11. It has a buffer overflow because a looping correction does not occur after JavaScript updates Field APs.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit PhantomPDF before 8.3.6.CVE-2018-21244 · Other software · Foxitsoftware · reported by MITRECritical 9.8
An issue was discovered in Foxit PhantomPDF before 8.3.6. It allows arbitrary application execution via an embedded executable file in a PDF portfolio, aka FG-VD-18-029.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit PhantomPDF before 8.3.6.CVE-2018-21243 · Other software · Foxitsoftware · reported by MITREMedium 6.5
An issue was discovered in Foxit PhantomPDF before 8.3.6. It has COM object mishandling when Microsoft Word is used.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit PhantomPDF before 8.3.6.CVE-2018-21242 · Other software · Foxitsoftware · reported by MITRECritical 9.8
An issue was discovered in Foxit PhantomPDF before 8.3.6. It allows Remote Code Execution via a GoToE or GoToR action.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit PhantomPDF before 8.3.6.CVE-2018-21241 · Other software · Foxitsoftware · reported by MITREHigh 7.8
An issue was discovered in Foxit PhantomPDF before 8.3.6. It has an untrusted search path that allows a DLL to execute remote code.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit Reader and PhantomPDF before 9.2.CVE-2018-21240 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit Reader and PhantomPDF before 9.2. It allows memory consumption via an ArrayBuffer(0xfffffffe) call.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit Reader and PhantomPDF before 9.2.CVE-2018-21239 · Other software · Foxitsoftware · reported by MITREMedium 5.3
An issue was discovered in Foxit Reader and PhantomPDF before 9.2. It allows NTLM credential theft via a GoToE or GoToR action.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit PhantomPDF before 8.3.7.CVE-2018-21238 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit PhantomPDF before 8.3.7. It allows memory consumption via an ArrayBuffer(0xfffffffe) call.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit PhantomPDF before 8.3.7.CVE-2018-21237 · Other software · Foxitsoftware · reported by MITREMedium 5.3
An issue was discovered in Foxit PhantomPDF before 8.3.7. It allows NTLM credential theft via a GoToE or GoToR action.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit Reader and PhantomPDF before 9.7.1.CVE-2020-13815 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.1. It allows stack consumption via a loop of an indirect object reference.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit Reader and PhantomPDF before 9.7.1.CVE-2020-13814 · Other software · Foxitsoftware · reported by MITRECritical 9.8
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.1. It has a use-after-free via a document that lacks a dictionary.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in the 3D Plugin Beta for Foxit Reader and PhantomPDF before 9.7.0.29430.CVE-2019-20822 · Other software · Foxitsoftware · reported by MITRECritical 9.8
An issue was discovered in the 3D Plugin Beta for Foxit Reader and PhantomPDF before 9.7.0.29430. It has an out-of-bounds write via incorrect image data.
- Product
- 3d
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit PhantomPDF Mac before 3.4.CVE-2019-20821 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit PhantomPDF Mac before 3.4. It has a NULL pointer dereference.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit Reader and PhantomPDF before 9.7.CVE-2019-20820 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It has a NULL pointer dereference during the parsing of file data.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit Reader and PhantomPDF before 9.7.CVE-2019-20819 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It allows stack consumption via nested function calls for XML parsing.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit Reader and PhantomPDF before 9.7.CVE-2019-20818 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It allows memory consumption because data is created for each page of an application level.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit Reader and PhantomPDF before 9.7.CVE-2019-20817 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It has a NULL pointer dereference.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit PhantomPDF before 8.3.12.CVE-2019-20816 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit PhantomPDF before 8.3.12. It has a NULL pointer dereference during the parsing of file data.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit PhantomPDF before 8.3.12.CVE-2019-20815 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit PhantomPDF before 8.3.12. It allows stack consumption via nested function calls for XML parsing.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit PhantomPDF before 8.3.12.CVE-2019-20814 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit PhantomPDF before 8.3.12. It allows memory consumption because data is created for each page of an application level.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020An issue was discovered in Foxit PhantomPDF before 8.3.12.CVE-2019-20813 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit PhantomPDF before 8.3.12. It has a NULL pointer dereference.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Jun 4, 2020Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer request, as demonstrated by an example.pdf?miCVE-2019-16385 · Other software · Cybelesoft · reported by MITREMedium 6.1
Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer request, as demonstrated by an example.pdf?mimetype= substring. The victim user must load an application request to view a PDF, containing the malicious payload. This results in a reflected XSS payload being executed.
- Product
- Thinfinity Virtualui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.nettitude.comlabs.nettitude.com
Jun 4, 2020An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2.CVE-2020-13810 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows signature validation bypass via a modified file or a file with non-standard signatures.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.