Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-17115 State: PUBLISHED Published: 2019-10-17T17:46:09 Last Updated: 2024-08-05T01:33:16.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML that is triggered when Logs.jsp is visited. The rendered_message column is retrieved and displayed, unsanitized, on Logs.jsp. A remote attack can populate the rendered_message column with malicious values via: (1) H parameter to /wikid/servlet/com.wikidsystems.server.GetDomainHash (2) S parameter to: - /wikid/DomainData - /wikid/PreRegisterLookup - /wikid/PreRegis
m.wikidsystems.server.GetDomainHash (2) S parameter to: - /wikid/DomainData - /wikid/PreRegisterLookup - /wikid/PreRegister - /wikid/InitDevice - /wikid/servlet/InitDevice2S - /wikid/servlet/InitDevice3S - /servlet/com.wikidsystems.server.InitDevice2S - /servlet/com.wikidsystems.server.InitDevice3S - /servlet/com.wikidsystems.server.InitDevice4S - /wikid/servlet/com.wikidsystems.server.InitDevice4AES - /wikid/servlet/com.wikidsystems.server.InitDevice5AES (3) a parameter to: - /wikid/PreRegisterLookup - /wikid/InitDevice - /wikid/servlet/InitDevice2S - /wikid/servlet/InitDevice3S - /servlet/com.wikidsystems.server.InitDevice2S - /servlet/com.wikidsystems.server.InitDevice3S - /servlet/com.wi
vice3S - /servlet/com.wikidsystems.server.InitDevice2S - /servlet/com.wikidsystems.server.InitDevice3S - /servlet/com.wikidsystems.server.InitDevice4S - /wikid/servlet/com.wikidsystems.server.InitDevice4AES - /wikid/servlet/com.wikidsystems.server.InitDevice5AES. Additional Analyst Notes: - CVE Program Container: References: - https://www.securitymetrics.com/blog/wikid-2fa-enterprise-server-cross-site-scripting - http://seclists.org/fulldisclosure/2019/Oct/35 - http://packetstormsecurity.com/files/154912/WiKID-Systems-2FA-Enterprise-Server-4.2.0-b2032-SQL-Injection-XSS-CSRF.html
CVE ID: CVE-2019-17116 State: PUBLISHED Published: 2019-10-17T17:47:50 Last Updated: 2024-08-05T01:33:16.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/groups.jsp. The groupName parameter is vulnerable: the reflected cross-site scripting occurs immediately after the group is created. The malicious script is stored and will be executed again whenever /WiKIDAdmin/groups.jsp is visited. Additional Analyst Notes: - CVE Program Container: References: - https://www.securitymetrics.com/blog/w
.jsp is visited. Additional Analyst Notes: - CVE Program Container: References: - https://www.securitymetrics.com/blog/wikid-2fa-enterprise-server-cross-site-scripting - http://seclists.org/fulldisclosure/2019/Oct/35 - http://packetstormsecurity.com/files/154912/WiKID-Systems-2FA-Enterprise-Server-4.2.0-b2032-SQL-Injection-XSS-CSRF.html
CVE ID: CVE-2019-17117 State: PUBLISHED Published: 2019-10-17T17:50:11 Last Updated: 2024-08-05T01:33:16.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in processPref.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows an authenticated user to execute arbitrary SQL commands via the processPref.jsp key parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.securitymetrics.com/blog/wikid-2fa-enterprise-server-sql-injection - http://seclists.org/fulldisclosure/2019/Oct/35 - http://packetstormsecurity.com/files/154912/WiKID-Systems-2FA-Enterprise-Server-4.2.0-b2032-SQL-Injection-XSS-CSRF.html
CVE ID: CVE-2019-17118 State: PUBLISHED Published: 2019-10-17T17:59:50 Last Updated: 2024-08-05T01:33:17.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF issue in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows a remote attacker to trick an authenticated user into performing unintended actions such as (1) create or delete admin users; (2) create or delete groups; or (3) create, delete, enable, or disable normal users or devices. Additional Analyst Notes: - CVE Program Container: References: - https://www.securitymetrics.com/blog/ - https://www.securitymetrics.com/blog/wikid-2fa-enterprise-server-csrf - http://seclists.org/fulldisclosure/2019/Oct/35 - http://packe
ecuritymetrics.com/blog/wikid-2fa-enterprise-server-csrf - http://seclists.org/fulldisclosure/2019/Oct/35 - http://packetstormsecurity.com/files/154912/WiKID-Systems-2FA-Enterprise-Server-4.2.0-b2032-SQL-Injection-XSS-CSRF.html
CVE ID: CVE-2019-17119 State: PUBLISHED Published: 2019-10-17T18:08:05 Last Updated: 2024-08-05T01:33:16.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Logs.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allow authenticated users to execute arbitrary SQL commands via the source or subString parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.securitymetrics.com/blog/wikid-2fa-enterprise-server-sql-injection - http://seclists.org/fulldisclosure/2019/Oct/35 - http://packetstormsecurity.com/files/154912/WiKID-Systems-2FA-Enterprise-Server-4.2.0-b2032-SQL-Injection-XSS-CSRF.html
CVE ID: CVE-2019-17120 State: PUBLISHED Published: 2019-10-17T18:10:16 Last Updated: 2024-08-05T01:33:16.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/adm_usrs.jsp. The usr parameter is vulnerable: the reflected cross-site scripting occurs immediately after the user is created. The malicious script is stored and will be executed whenever /WiKIDAdmin/adm_usrs.jsp is visited. Additional Analyst Notes: - CVE Program Container: References: - https://www.securitymetrics.com/blog/wikid-2fa-
isited. Additional Analyst Notes: - CVE Program Container: References: - https://www.securitymetrics.com/blog/wikid-2fa-enterprise-server-cross-site-scripting - http://seclists.org/fulldisclosure/2019/Oct/35 - http://packetstormsecurity.com/files/154912/WiKID-Systems-2FA-Enterprise-Server-4.2.0-b2032-SQL-Injection-XSS-CSRF.html
CVE ID: CVE-2019-17121 State: PUBLISHED Published: 2019-10-04T02:29:27 Last Updated: 2024-08-05T01:33:17.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values. Additional Analyst Notes: - CVE Program Container: References: - https://www.evms.edu/research/resources_services/redcap/redcap_change_log/
CVE ID: CVE-2019-17123 State: PUBLISHED Published: 2019-12-13T17:54:27 Last Updated: 2024-08-05T01:33:16.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: The eGain Web Email API 11+ allows spoofed messages because the fromName and message fields (to /system/ws/v11/ss/email) are mishandled, as demonstrated by fromName header injection with a %0a or %0d character. (Also, the message parameter can have initial HTML comment characters.) Additional Analyst Notes: - CVE Program Container: References: - http://www.egain.com/products/email-management-software/ - https://medium.com/maverislabs/cve-2019-17123-cbc946c99f8
CVE ID: CVE-2019-17124 State: PUBLISHED Published: 2019-10-09T15:44:55 Last Updated: 2024-08-05T01:33:16.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kramer VIAware 2.5.0719.1034 has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hessandrew/CVE-2019-17124 - http://packetstormsecurity.com/files/166541/Kramer-VIAware-2.5.0719.1034-Remote-Code-Execution.html
CVE ID: CVE-2019-17125 State: PUBLISHED Published: 2020-01-17T17:42:17 Last Updated: 2024-08-05T01:33:16.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://support.solarwinds.com/SuccessCenter/s/orion-platform - https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2019-4-Hotfix-3?ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1&
/article/Orion-Platform-2019-4-Hotfix-3?ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1&r=116&ui-knowledge-components-aura-actions.KnowledgeArticleVersionCreateDraftFromOnlineAction.createDraftFromOnlineArticle=1
CVE ID: CVE-2019-17127 State: PUBLISHED Published: 2020-01-17T17:44:02 Last Updated: 2024-08-05T01:33:17.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://support.solarwinds.com/SuccessCenter/s/orion-platform - https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2019-4-Hotfix-3?ui-force-components-controllers-
- https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2019-4-Hotfix-3?ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1&r=116&ui-knowledge-components-aura-actions.KnowledgeArticleVersionCreateDraftFromOnlineAction.createDraftFromOnlineArticle=1
CVE ID: CVE-2019-17128 State: PUBLISHED Published: 2019-10-09T15:07:08 Last Updated: 2024-08-05T01:33:17.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netreo OmniCenter through 12.1.1 allows unauthenticated SQL Injection (Boolean Based Blind) in the redirect parameters and parameter name of the login page through a GET request. The injection allows an attacker to read sensitive information from the database used by the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.netreo.com/blog/omnicenter-12-now-available-extensible-integration-unlimited-scalability-device-grouping/ - http://packetstormsecurity.com/files/154763/OmniCenter-12.1.1
sible-integration-unlimited-scalability-device-grouping/ - http://packetstormsecurity.com/files/154763/OmniCenter-12.1.1-SQL-Injection.html
CVE ID: CVE-2019-17130 State: PUBLISHED Published: 2019-10-04T11:36:23 Last Updated: 2024-08-05T01:33:17.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories. Additional Analyst Notes: - CVE Program Container: References: - https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4423391-vbulletin-5-5-5-alpha-4-available-for-download
CVE ID: CVE-2019-17131 State: PUBLISHED Published: 2019-10-04T11:36:34 Last Updated: 2024-08-05T01:33:16.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: vBulletin before 5.5.4 allows clickjacking. Additional Analyst Notes: - CVE Program Container: References: - https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4421373-vbulletin-connect-5-5-4-is-now-available-for-download
CVE ID: CVE-2019-17132 State: PUBLISHED Published: 2019-10-04T11:36:46 Last Updated: 2024-08-05T01:33:17.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: vBulletin through 5.5.4 mishandles custom avatars. Additional Analyst Notes: - CVE Program Container: References: - https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4423646-vbulletin-5-5-x-5-5-2-5-5-3-and-5-5-4-security-patch-level-2 - http://seclists.org/fulldisclosure/2019/Oct/9 - http://packetstormsecurity.com/files/154759/vBulletin-5.5.4-Remote-Code-Execution.html
CVE ID: CVE-2019-17133 State: PUBLISHED Published: 2019-10-04T11:57:47 Last Updated: 2024-08-05T01:33:17.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00064.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00010.html - https://seclists.org/bugtraq/2019/Nov/11 - https://usn.ubuntu.com/4211-2/ - https://usn.ubuntu.com/4208-1/ - https://usn.ubuntu.com/4210-1/ - https://usn.ubuntu.
- https://usn.ubuntu.com/4211-2/ - https://usn.ubuntu.com/4208-1/ - https://usn.ubuntu.com/4210-1/ - https://usn.ubuntu.com/4211-1/ - https://usn.ubuntu.com/4226-1/ - https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html - https://access.redhat.com/errata/RHSA-2020:0174 - https://access.redhat.com/errata/RHSA-2020:0374 - https://access.redhat.com/errata/RHSA-2020:0375 - https://access.redhat.com/errata/RHSA-2020:0543 - https://access.redhat.com/errata/RHSA-2020:0592 - https://access.redhat.com/errata/RHSA-2020:0609 - https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html - https://access.redhat.com/errata/RHSA-2020:0653 - https://access.redhat.com/errata/RHSA-2020:06
/2020/03/msg00001.html - https://access.redhat.com/errata/RHSA-2020:0653 - https://access.redhat.com/errata/RHSA-2020:0661 - https://access.redhat.com/errata/RHSA-2020:0664 - https://access.redhat.com/errata/RHSA-2020:0790 - https://www.oracle.com/security-alerts/cpuApr2021.html - http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html - https://security.netapp.com/advisory/ntap-20191031-0005/ - https://marc.info/?l=linux-wireless&m=157018270915487&w=2
CVE ID: CVE-2019-17134 State: PUBLISHED Published: 2019-10-08T17:14:37 Last Updated: 2024-08-05T01:33:17.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the cmd/agent.py gunicorn cert_reqs option is True but is supposed to be ssl.CERT_REQUIRED. Additional Analyst Notes: - CVE Program Container: References: - https://storyboard.openstack.org/#%21/story/2006660 - https://rev
Analyst Notes: - CVE Program Container: References: - https://storyboard.openstack.org/#%21/story/2006660 - https://review.opendev.org/686547 - https://review.opendev.org/686546 - https://review.opendev.org/686545 - https://review.opendev.org/686544 - https://review.opendev.org/686543 - https://review.opendev.org/686541 - https://security.openstack.org/ossa/OSSA-2019-005.html - https://usn.ubuntu.com/4153-1/ - https://access.redhat.com/errata/RHSA-2019:3743 - https://access.redhat.com/errata/RHSA-2019:3788 - https://access.redhat.com/errata/RHSA-2020:0721
CVE ID: CVE-2019-17135 State: PUBLISHED Published: 2020-02-07T23:35:16 Last Updated: 2024-08-05T01:33:17.054Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-119 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An
results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8775. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-19-860/
CVE ID: CVE-2019-17136 State: PUBLISHED Published: 2020-02-07T23:35:17 Last Updated: 2024-08-05T01:33:17.282Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-125 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of DXF files to PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of
The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8776. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-19-861/
CVE ID: CVE-2019-17137 State: PUBLISHED Published: 2020-02-10T19:15:38 Last Updated: 2024-08-05T01:33:17.242Z Severity: CRITICAL (CVSS 9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: NETGEAR Products: AC1200 Problem Types: CWE-626 Description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR AC1200 R6220 Firmware version 1.1.0.86 Smart WiFi Router. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of path strings. By inserting a null byte into the path, the user can skip most authentication checks. An attacker can leverage this vulnerability to bypass authen
nto the path, the user can skip most authentication checks. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-8616. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-19-866/
CVE ID: CVE-2019-17138 State: PUBLISHED Published: 2019-10-25T18:14:18 Last Updated: 2024-08-05T01:33:17.294Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Foxit Products: Studio Photo Problem Types: CWE-125 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.909. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion from JPEG to EPS. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the e
o EPS. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-8809. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-19-908/
CVE ID: CVE-2019-17139 State: PUBLISHED Published: 2019-10-25T18:14:18 Last Updated: 2024-08-05T01:33:17.099Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of Javascript in the HTML2PDF plugin. The issue results from the lack of proper validation of user-supplied data, which can result in a writ
HTML2PDF plugin. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8692. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-19-909/
CVE ID: CVE-2019-17140 State: PUBLISHED Published: 2019-10-25T18:14:18 Last Updated: 2024-08-05T01:33:17.331Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the OnFocus event. The issue results from the lack of validating the existence of an object prior to performing operations on the object. A
The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9091. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-19-910/
CVE ID: CVE-2019-17141 State: PUBLISHED Published: 2019-10-25T18:14:18 Last Updated: 2024-08-05T01:33:17.355Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of script within a Calculate action of a text field. The issue results from the lack of validating the existence of an object prior to perfo
alculate action of a text field. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9044. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-19-911/
CVE ID: CVE-2019-17142 State: PUBLISHED Published: 2019-10-25T18:14:18 Last Updated: 2024-08-05T01:33:17.260Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of script within a Keystroke action of a listbox field. The issue results from the lack of validating the existence of an object prior to pe
eystroke action of a listbox field. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9081. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-19-912/