Page 15 of 498 results (0.016 seconds)

CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0

An issue was discovered in Foxit Reader and PhantomPDF before 10.1. It allows attackers to execute arbitrary code via a Trojan horse taskkill.exe in the current working directory. Se detectó un problema en Foxit Reader y PhantomPDF versiones anteriores a 10.1. Permite a atacantes ejecutar código arbitrario por medio de un troyano taskkill.exe en el directorio de trabajo actual • https://www.foxitsoftware.com/support/security-bulletins.html • CWE-427: Uncontrolled Search Path Element •

CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0

An issue was discovered in Foxit Reader and PhantomPDF before 10.1. When there is a multiple interpretation error for /V (in the Additional Action and Field dictionaries), a use-after-free can occur with resultant remote code execution (or an information leak). Se detectó un problema en Foxit Reader y PhantomPDF versiones anteriores a 10.1. Cuando se presenta un error de interpretación múltiple para /V (en los diccionarios de Additional Action y Field), puede ocurrir un uso de la memoria previamente liberada con una ejecución de código remoto resultante (o un filtrado de información) • https://www.foxitsoftware.com/support/security-bulletins.html • CWE-416: Use After Free •

CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0.0.35798. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of GIF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. • https://www.foxitsoftware.com/support/security-bulletins.php https://www.zerodayinitiative.com/advisories/ZDI-20-1228 • CWE-416: Use After Free •

CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.0.1.35811. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. • https://www.foxitsoftware.com/support/security-bulletins.php https://www.zerodayinitiative.com/advisories/ZDI-20-1234 • CWE-416: Use After Free •

CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0

This vulnerability allows local attackers to escalate privileges on affected installations of Foxit Reader 10.0.0.35798. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the configuration files used by the Foxit Reader Update Service. The issue results from incorrect permissions set on a resource used by the service. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM. • https://www.foxitsoftware.com/support/security-bulletins.php https://www.zerodayinitiative.com/advisories/ZDI-20-1231 • CWE-732: Incorrect Permission Assignment for Critical Resource •