CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2018-14280 – Foxit Reader exportAsFDF Arbitrary File Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-14280
19 Jul 2018 — This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exportAsFDF XFA function. The issue results from the lack of proper validation of user-supplied data, which can lead to writing arbitrary files into attacker controlled locations. An attacker can leverage this vulnerabi... • https://www.foxitsoftware.com/support/security-bulletins.php • CWE-20: Improper Input Validation CWE-693: Protection Mechanism Failure •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2018-14290 – Foxit Reader PDF Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-14290
19 Jul 2018 — This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF documents. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code ... • https://www.foxitsoftware.com/support/security-bulletins.php • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2018-14311 – Foxit Reader XFA Event Handling Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-14311
19 Jul 2018 — This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of XFA events. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the ... • https://www.foxitsoftware.com/support/security-bulletins.php • CWE-704: Incorrect Type Conversion or Cast CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2018-14274 – Foxit Reader scroll Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-14274
19 Jul 2018 — This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the scroll method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. • https://www.foxitsoftware.com/support/security-bulletins.php • CWE-704: Incorrect Type Conversion or Cast CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2018-14281 – Foxit Reader exportData Arbitrary File Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-14281
19 Jul 2018 — This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exportData XFA function. The issue results from the lack of proper validation of user-supplied data, which can lead to writing arbitrary files into attacker controlled locations. An attacker can leverage this vulnerabil... • https://www.foxitsoftware.com/support/security-bulletins.php • CWE-20: Improper Input Validation CWE-693: Protection Mechanism Failure •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2018-14278 – Foxit Reader getPageNumWords Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-14278
19 Jul 2018 — This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the getPageNumWords method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. • https://www.foxitsoftware.com/support/security-bulletins.php • CWE-704: Incorrect Type Conversion or Cast CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2018-14265 – Foxit Reader importAnXFDX Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-14265
19 Jul 2018 — This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the importAnXFDX method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. • https://www.foxitsoftware.com/support/security-bulletins.php • CWE-704: Incorrect Type Conversion or Cast CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2018-14243 – Foxit Reader addPageOpenJSMessage Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-14243
19 Jul 2018 — This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the addPageOpenJSMessage method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. The attacker can leverage this vulnerability to execute code under the context of the current process... • https://www.foxitsoftware.com/support/security-bulletins.php • CWE-704: Incorrect Type Conversion or Cast CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2018-14276 – Foxit Reader submitForm Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-14276
19 Jul 2018 — This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the submitForm method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. • https://www.foxitsoftware.com/support/security-bulletins.php • CWE-704: Incorrect Type Conversion or Cast CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 8.8EPSS: 2%CPEs: 3EXPL: 0CVE-2018-14294 – Foxit Reader FileAttachment attachIcon Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-14294
19 Jul 2018 — This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of FileAttachment annotations. By manipulating a document's elements an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the... • https://www.foxitsoftware.com/support/security-bulletins.php • CWE-416: Use After Free •