Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ge-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/ - https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html - https://www.debian.org/security/2021/dsa-4982 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.tenable.com/security/tns-2021-17 - https://security.netapp.com/advisory/ntap-20211008-0004/ - https://kc.mcafee.com/corporate/index?page=content&id=SB10379 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf - https://security.gentoo.org/glsa/202208-20
CVE ID: CVE-2021-34800 State: PUBLISHED Published: 2021-11-29T19:16:14.115409Z Last Updated: 2024-09-16T19:30:26.012Z Vendors: Acronis Products: Acronis Agent Problem Types: CWE-532 Description: Sensitive information could be logged. The following products are affected: Acronis Agent (Windows, Linux, macOS) before build 27147 Additional Analyst Notes: - CVE Program Container: References: - https://security-advisory.acronis.com/advisories/SEC-3145
CVE ID: CVE-2021-34801 State: PUBLISHED Published: 2021-06-16T14:12:05 Last Updated: 2024-08-04T00:26:54.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only specifies the product and version. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xCss/Valine/issues/366
CVE ID: CVE-2021-34802 State: PUBLISHED Published: 2021-07-27T11:25:18 Last Updated: 2024-08-04T00:26:54.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: A failure in resetting the security context in some transaction actions in Neo4j Graph Database 4.2 and 4.3 could allow authenticated users to execute commands with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://neo4j.com - https://neo4j.com/developer/kb/neo4j-4-2-x-sec-vuln-fix/
CVE ID: CVE-2021-34803 State: PUBLISHED Published: 2021-06-16T14:46:39 Last Updated: 2024-08-04T00:26:53.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: TeamViewer before 14.7.48644 on Windows loads untrusted DLLs in certain situations. Additional Analyst Notes: - CVE Program Container: References: - https://community.teamviewer.com/English/discussion/111154/windows-v14-7-48644 - https://community.teamviewer.com/English/discussion/111153/windows-v14-2-56678 - https://community.teamviewer.com/English/discussion/111152/windows-v13-2-36222 - https://community.teamviewer.com/English/discussion/111151/windows-v12-0-259142 - https://community.teamviewer.com/English/discussion/11115
eamviewer.com/English/discussion/111151/windows-v12-0-259142 - https://community.teamviewer.com/English/discussion/111150/windows-v11-0-259143 - https://community.teamviewer.com/English/discussion/111149/windows-v10-0-259144 - https://community.teamviewer.com/English/discussion/111147/windows-v9-0-259145
CVE ID: CVE-2021-34805 State: PUBLISHED Published: 2022-01-31T07:10:27 Last Updated: 2024-08-04T00:26:54.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FAUST iServer before 9.0.019.019.7. For each URL request, it accesses the corresponding .fau file on the operating system without preventing %2e%2e%5c directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://sec-consult.com/vulnerability-lab/ - http://www.land-software.de/lfs.fau?prj=iweb&dn=faust+iserver - http://packetstormsecurity.com/files/165701/FAUST-iServer-9.0.018.018.4-Local-File-Inclusion.html
CVE ID: CVE-2021-34807 State: PUBLISHED Published: 2021-07-02T18:54:37 Last Updated: 2024-08-04T00:26:53.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an attacker could redirect a user to any URL via isredirect=1&redirectURL= in conjunction with the token data (e.g., a valid authtoken= value). Additional Analyst Notes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://w
nalyst Notes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16 - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23
CVE ID: CVE-2021-34808 State: PUBLISHED Published: 2021-06-18T03:00:32.942156Z Last Updated: 2024-09-17T03:47:41.516Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Synology Products: Media Server Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_21_10
CVE ID: CVE-2021-34809 State: PUBLISHED Published: 2021-06-18T03:00:27.054271Z Last Updated: 2024-09-16T19:56:48.051Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Synology Products: Download Station Problem Types: CWE-77 Description: Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_21_11
CVE ID: CVE-2021-34810 State: PUBLISHED Published: 2021-06-18T03:00:22.755278Z Last Updated: 2024-09-16T16:14:21.210Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Synology Products: Download Station Problem Types: CWE-269 Description: Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_21_11
CVE ID: CVE-2021-34811 State: PUBLISHED Published: 2021-06-18T03:00:18.181966Z Last Updated: 2024-09-16T17:48:15.120Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Synology Products: Download Station Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to access intranet resources via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_21_11
CVE ID: CVE-2021-34812 State: PUBLISHED Published: 2021-06-18T03:00:12.747008Z Last Updated: 2024-09-17T01:31:29.491Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Synology Products: Synology Calendar Problem Types: CWE-798 Description: Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_21_12
CVE ID: CVE-2021-34813 State: PUBLISHED Published: 2021-06-16T17:11:53 Last Updated: 2024-08-04T00:26:54.020Z Vendors: n/a Products: n/a Problem Types: n/a Description: Matrix libolm before 3.2.3 allows a malicious Matrix homeserver to crash a client (while it is attempting to retrieve an Olm encrypted room key backup from the homeserver) because olm_pk_decrypt has a stack-based buffer overflow. Remote code execution might be possible for some nonstandard build configurations. Additional Analyst Notes: - CVE Program Container: References: - https://matrix.org/blog/2021/06/14/adventures-in-fuzzing-libolm - https://gitlab.matrix.org/matrix-org/olm/-/releases/3.2.3 - https://gitlab.matrix.org/m
4/adventures-in-fuzzing-libolm - https://gitlab.matrix.org/matrix-org/olm/-/releases/3.2.3 - https://gitlab.matrix.org/matrix-org/olm/-/commit/ccc0d122ee1b4d5e5ca4ec1432086be17d5f901b
CVE ID: CVE-2021-34814 State: PUBLISHED Published: 2021-10-13T14:27:17 Last Updated: 2024-08-04T00:26:54.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: Proofpoint Spam Engine before 8.12.0-2106240000 has a Security Control Bypass. Additional Analyst Notes: - CVE Program Container: References: - https://www.proofpoint.com/us/security/security-advisories - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0010
CVE ID: CVE-2021-34815 State: PUBLISHED Published: 2021-06-18T11:01:55 Last Updated: 2024-08-04T00:26:54.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: CheckSec Canopy before 3.5.2 allows XSS attacks against the login page via the LOGIN_PAGE_DISCLAIMER parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.checksec.com/canopy.html - https://www.compass-security.com/en/research/advisories - https://www.compass-security.com/fileadmin/Research/Advisories/2021-10_CSNC-2021-015-Checksec_Canopy_HTLM_Injection.txt
CVE ID: CVE-2021-34816 State: PUBLISHED Published: 2021-07-21T18:02:01 Last Updated: 2024-08-04T00:26:54.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Argument Injection issue in the plugin management of Etherpad 1.8.13 allows privileged users to execute arbitrary code on the server by installing plugins from an attacker-controlled source. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ether/etherpad-lite/releases - https://blog.sonarsource.com/etherpad-code-execution-vulnerabilities
CVE ID: CVE-2021-34817 State: PUBLISHED Published: 2021-07-19T13:38:11 Last Updated: 2024-08-04T00:26:53.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary JavaScript or HTML by importing a crafted pad. Additional Analyst Notes: - CVE Program Container: References: - https://etherpad.org/#download - https://github.com/ether/etherpad-lite/releases/tag/1.8.14 - https://blog.sonarsource.com/etherpad-code-execution-vulnerabilities - https://github.com/ether/etherpad-lite/commit/a7968115581e20ef47a533e030f59f830486bdfa
CVE ID: CVE-2021-34820 State: PUBLISHED Published: 2021-07-19T17:04:20 Last Updated: 2024-08-04T00:26:54.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: Web Path Directory Traversal in the Novus HTTP Server. The Novus HTTP Server is affected by the Directory Traversal for Arbitrary File Access vulnerability. A remote, unauthenticated attacker using an HTTP GET request may be able to exploit this issue to access sensitive data. The issue was discovered in the NMS (Novus Management System) software through 1.51.2 Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2021/Jul/20 - http://packetstormsecurity.com/files/163453/Novus-Man
er: References: - http://seclists.org/fulldisclosure/2021/Jul/20 - http://packetstormsecurity.com/files/163453/Novus-Management-System-Directory-Traversal-Cross-Site-Scripting.html
CVE ID: CVE-2021-34821 State: PUBLISHED Published: 2021-07-19T17:21:28 Last Updated: 2024-08-04T00:26:54.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exists in AAT Novus Management System through 1.51.2. The WebUI has wrong HTTP 404 error handling implemented. A remote, unauthenticated attacker may be able to exploit the issue by sending malicious HTTP requests to non-existing URIs. The value of the URL path filename is copied into the HTML document as plain text tags. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2021/Jul/20
CVE ID: CVE-2021-34823 State: PUBLISHED Published: 2021-08-13T16:48:09 Last Updated: 2024-08-04T00:26:54.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ON24 ScreenShare (aka DesktopScreenShare.app) plugin before 2.0 for macOS allows remote file access via its built-in HTTP server. This allows unauthenticated remote users to retrieve files accessible to the logged-on macOS user. When a remote user sends a crafted HTTP request to the server, it triggers a code path that will download a configuration file from a specified remote machine over HTTP. There is an XXE flaw in processing of this configuration file that allows reading local (to macOS) files and uploading them to r
an XXE flaw in processing of this configuration file that allows reading local (to macOS) files and uploading them to remote machines. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/ - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29105
CVE ID: CVE-2021-34824 State: PUBLISHED Published: 2021-06-29T13:30:01 Last Updated: 2024-08-04T00:26:54.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/istio/istio/releases - https://istio.io/latest/news/security/istio-security-2021-007
CVE ID: CVE-2021-34825 State: PUBLISHED Published: 2021-06-17T13:25:39 Last Updated: 2024-08-04T00:26:53.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 certificate is not found on the local system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/quassel/quassel/pull/581 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JOFTSGJUJHCA3KGQBO6OZXWU7JFKVHMJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZFWRN5P2WG23MWMVAEVV3YBHGFJHDSW/
CVE ID: CVE-2021-34827 State: PUBLISHED Published: 2021-07-15T17:35:18 Last Updated: 2024-08-04T00:26:54.090Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-1330 Problem Types: CWE-121 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the SOAPAction HTTP header. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can l
lidation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-12029. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-21-679/
CVE ID: CVE-2021-34828 State: PUBLISHED Published: 2021-07-15T17:35:20 Last Updated: 2024-08-04T00:26:54.047Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-1330 Problem Types: CWE-120 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the SOAPAction HTTP header. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this
lidation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-12066. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-21-680/
CVE ID: CVE-2021-34829 State: PUBLISHED Published: 2021-07-15T17:35:21 Last Updated: 2024-08-04T00:26:54.060Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-1330 Problem Types: CWE-120 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the HNAP_AUTH HTTP header. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this
idation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-12065. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-21-681/
CVE ID: CVE-2021-34830 State: PUBLISHED Published: 2021-07-15T17:35:23 Last Updated: 2024-08-04T00:26:54.067Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-1330 Problem Types: CWE-121 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the Cookie HTTP header. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can lever
tion of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-12028. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-21-682/
CVE ID: CVE-2021-34831 State: PUBLISHED Published: 2021-08-04T15:16:13 Last Updated: 2024-08-04T00:26:54.185Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.4.37651. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Document objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attack
e results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13741. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-21-913/
CVE ID: CVE-2021-34832 State: PUBLISHED Published: 2021-08-04T15:16:14 Last Updated: 2024-08-04T00:26:54.056Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the delay property. The issue results from the lack of validating the existence of an object prior to performing operations on the object.
. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13928. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-21-914/
CVE ID: CVE-2021-34833 State: PUBLISHED Published: 2021-08-04T15:16:16 Last Updated: 2024-08-04T00:26:54.061Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object.
. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14023. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-21-915/
CVE ID: CVE-2021-34834 State: PUBLISHED Published: 2021-08-04T15:16:17 Last Updated: 2024-08-04T00:26:54.111Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object.
. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14014. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-21-916/
CVE ID: CVE-2021-34835 State: PUBLISHED Published: 2021-08-04T15:16:19 Last Updated: 2024-08-04T00:26:54.238Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object.
. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14015. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-21-917/