CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-13805
https://notcve.org/view.php?id=CVE-2020-13805
04 Jun 2020 — An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has brute-force attack mishandling because the CAS service lacks a limit on login failures. Se detectó un problema en Foxit Reader y PhantomPDF versiones anteriores a 9.7.2. Presenta un manejo inapropiado de un ataque de fuerza bruta porque el servicio CAS carece de un límite de fallos de inicio de sesión • https://www.foxitsoftware.com/support/security-bulletins.php • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-13804
https://notcve.org/view.php?id=CVE-2020-13804
04 Jun 2020 — An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows information disclosure of a hardcoded username and password in the DocuSign plugin. Se detectó un problema en Foxit Reader y PhantomPDF versiones anteriores a 9.7.2. Permite una divulgación de información de un nombre de usuario y contraseña embebidos en el plugin DocuSign • https://www.foxitsoftware.com/support/security-bulletins.php • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-13803
https://notcve.org/view.php?id=CVE-2020-13803
04 Jun 2020 — An issue was discovered in Foxit PhantomPDF Mac and Foxit Reader for Mac before 4.0. It allows signature validation bypass via a modified file or a file with non-standard signatures. Se detectó un problema en Foxit PhantomPDF Mac y Foxit Reader para Mac versiones anteriores a 4.0. Permite omitir la comprobación de firma mediante un archivo modificado o un archivo con firmas no estándar • https://www.foxitsoftware.com/support/security-bulletins.php • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-10889 – Foxit PhantomPDF DuplicatePages Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-10889
16 Apr 2020 — This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the DuplicatePages command of the communication API. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage th... • https://www.foxitsoftware.com/support/security-bulletins.php • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2020-10890 – Foxit PhantomPDF ConvertToPDF Arbitrary File Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-10890
16 Apr 2020 — This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the communication API. The issue lies in the handling of the ConvertToPDF command, which allows an arbitrary file write with attacker controlled data. An attacker can leverage this vulnerability to execute code in the co... • https://www.foxitsoftware.com/support/security-bulletins.php • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-10891 – Foxit PhantomPDF Save Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-10891
16 Apr 2020 — This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the Save command of the communication API. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnera... • https://www.foxitsoftware.com/support/security-bulletins.php • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2020-10892 – Foxit PhantomPDF CombineFiles Arbitrary File Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-10892
16 Apr 2020 — This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the communication API. The issue lies in the handling of the CombineFiles command, which allows an arbitrary file write with attacker controlled data. An attacker can leverage this vulnerability to execute code in the co... • https://www.foxitsoftware.com/support/security-bulletins.php • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.8EPSS: 2%CPEs: 3EXPL: 0CVE-2020-10893 – Foxit PhantomPDF U3DBrowser U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-10893
16 Apr 2020 — This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in a PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this... • https://www.foxitsoftware.com/support/security-bulletins.php • CWE-787: Out-of-bounds Write •
CVSS: 4.3EPSS: 11%CPEs: 3EXPL: 0CVE-2020-10894 – Foxit PhantomPDF U3DBrowser U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-10894
16 Apr 2020 — This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in a PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage ... • https://www.foxitsoftware.com/support/security-bulletins.php • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 2%CPEs: 3EXPL: 0CVE-2020-10895 – Foxit PhantomPDF U3DBrowser U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-10895
16 Apr 2020 — This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this vulne... • https://www.foxitsoftware.com/support/security-bulletins.php • CWE-125: Out-of-bounds Read •