Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-10863 State: PUBLISHED Published: 2020-04-01T16:55:48 Last Updated: 2024-08-04T11:14:15.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to trigger a shutdown via RPC from a Low Integrity process via TempShutDownMachine. Additional Analyst Notes: - CVE Program Container: References: - https://forum.avast.com/index.php?topic=232420.0 - https://forum.avast.com/index.php?topic=232423.0 - https://github.com/umarfarook882/Avast_Multiple_Vulnerability_Disclosure/blob/master/README.md
CVE ID: CVE-2020-10864 State: PUBLISHED Published: 2020-04-01T17:00:20 Last Updated: 2024-08-04T11:14:15.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to trigger a reboot via RPC from a Low Integrity process. Additional Analyst Notes: - CVE Program Container: References: - https://forum.avast.com/index.php?topic=232420.0 - https://forum.avast.com/index.php?topic=232423.0 - https://github.com/umarfarook882/Avast_Multiple_Vulnerability_Disclosure/blob/master/README.md
CVE ID: CVE-2020-10865 State: PUBLISHED Published: 2020-04-01T17:02:07 Last Updated: 2024-08-04T11:14:15.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to make arbitrary changes to the Components section of the Stats.ini file via RPC from a Low Integrity process. Additional Analyst Notes: - CVE Program Container: References: - https://forum.avast.com/index.php?topic=232420.0 - https://forum.avast.com/index.php?topic=232423.0 - https://github.com/umarfarook882/Avast_Multiple_Vulnerability_Disclosure/blob/master/README.md
CVE ID: CVE-2020-10866 State: PUBLISHED Published: 2020-04-01T17:04:01 Last Updated: 2024-08-04T11:14:15.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to enumerate the network interfaces and access points from a Low Integrity process via RPC. Additional Analyst Notes: - CVE Program Container: References: - https://forum.avast.com/index.php?topic=232420.0 - https://forum.avast.com/index.php?topic=232423.0 - https://github.com/umarfarook882/Avast_Multiple_Vulnerability_Disclosure/blob/master/README.md
CVE ID: CVE-2020-10867 State: PUBLISHED Published: 2020-04-01T17:06:48 Last Updated: 2024-08-04T11:14:15.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to bypass intended access restrictions on tasks from an untrusted process, when Self Defense is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://forum.avast.com/index.php?topic=232420.0 - https://forum.avast.com/index.php?topic=232423.0 - https://github.com/umarfarook882/Avast_Multiple_Vulnerability_Disclosure/blob/master/README.md
CVE ID: CVE-2020-10868 State: PUBLISHED Published: 2020-04-01T17:08:42 Last Updated: 2024-08-04T11:14:15.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to launch the Repair App RPC call from a Low Integrity process. Additional Analyst Notes: - CVE Program Container: References: - https://forum.avast.com/index.php?topic=232420.0 - https://forum.avast.com/index.php?topic=232423.0 - https://github.com/umarfarook882/Avast_Multiple_Vulnerability_Disclosure/blob/master/README.md
CVE ID: CVE-2020-10870 State: PUBLISHED Published: 2020-03-23T19:07:07 Last Updated: 2024-08-04T11:14:15.681Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AC:L/AV:L/A:H/C:N/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could predict and create Zim's temporary directories and prevent other users from being able to start Zim, resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zim-desktop-wiki/zim-desktop-wiki/issues/1028
CVE ID: CVE-2020-10871 State: PUBLISHED Published: 2020-03-23T19:45:25 Last Updated: 2024-08-04T11:14:15.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NOTE: the vendor disputes the significance of this report because, for instances reachable by an unauthenticated actor, the same information is available in other (more complex) ways, and there is no plan to restrict the information further Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openwrt/luci/issues/3563#issuecomment-578522860 - https://github.com/openwrt/luci/issues/
ferences: - https://github.com/openwrt/luci/issues/3563#issuecomment-578522860 - https://github.com/openwrt/luci/issues/3653#issue-567892007 - https://github.com/openwrt/luci/issues/3766
CVE ID: CVE-2020-10874 State: PUBLISHED Published: 2020-03-23T20:26:27 Last Updated: 2024-08-04T11:14:15.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: Motorola FX9500 devices allow remote attackers to read database files. Additional Analyst Notes: - CVE Program Container: References: - https://www.youtube.com/watch?v=Lv-STOyQCVY
CVE ID: CVE-2020-10875 State: PUBLISHED Published: 2020-03-23T21:45:43 Last Updated: 2024-08-04T11:14:15.766Z Vendors: n/a Products: n/a Problem Types: n/a Description: Motorola FX9500 devices allow remote attackers to conduct absolute path traversal attacks, as demonstrated by PL/SQL Server Pages files such as /include/viewtagdb.psp. Additional Analyst Notes: - CVE Program Container: References: - https://www.youtube.com/watch?v=Lv-STOyQCVY
CVE ID: CVE-2020-10876 State: PUBLISHED Published: 2020-05-04T13:09:47 Last Updated: 2024-08-04T11:14:15.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) does not correctly implement its timeout on the four-digit verification code that is required for resetting passwords, nor does it properly restrict excessive verification attempts. This allows an attacker to brute force the four-digit verification code in order to bypass email verification and change the password of a victim account. Additional Analyst Notes: - CVE Program Container: References: - https://apps.apple.com/us/app/oklok/id1392287
account. Additional Analyst Notes: - CVE Program Container: References: - https://apps.apple.com/us/app/oklok/id1392287771 - https://github.com/fierceoj/ownklok
CVE ID: CVE-2020-10878 State: PUBLISHED Published: 2020-06-05T13:27:22 Last Updated: 2024-08-04T11:14:15.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/202006-03 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/ - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg0004
ect.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/ - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3 - https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod - https://security.netapp.com/advisory/ntap-20200611-0001/ - https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8 - https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html -
ml - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2020-10879 State: PUBLISHED Published: 2020-03-23T21:44:49 Last Updated: 2024-08-04T11:14:16.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rconfig/rconfig/commit/3385f906427d228c48b914625136bf620f4ca0a9 - https://www.exploit-db.com/exploits/48241
CVE ID: CVE-2020-10881 State: PUBLISHED Published: 2020-03-25T19:15:23 Last Updated: 2024-08-04T11:14:15.617Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TP-Link Products: Archer A7 Problem Types: CWE-121 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of DNS responses. A crafted DNS message can trigger an overflow of a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of t
w of a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the root user. Was ZDI-CAN-9660. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-333/
CVE ID: CVE-2020-10882 State: PUBLISHED Published: 2020-03-25T19:15:23 Last Updated: 2024-08-04T11:14:15.768Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TP-Link Products: Archer A7 Problem Types: CWE-78 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP port 20002 by default. When parsing the slave_mac parameter, the process does not properly validate a user-supplied string before using it to exec
n parsing the slave_mac parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the root user. Was ZDI-CAN-9650. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-334/ - http://packetstormsecurity.com/files/157255/TP-Link-Archer-A7-C7-Unauthenticated-LAN-Remote-Code-Execution.html
CVE ID: CVE-2020-10883 State: PUBLISHED Published: 2020-03-25T19:15:24 Last Updated: 2024-08-04T11:14:15.683Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: TP-Link Products: Archer A7 Problem Types: CWE-732 Description: This vulnerability allows local attackers to escalate privileges on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the file system. The issue lies in the lack of proper permissions set on the file system. An attacker can leverage this vulnerabi
system. The issue lies in the lack of proper permissions set on the file system. An attacker can leverage this vulnerability to escalate privileges. Was ZDI-CAN-9651. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-335/ - http://packetstormsecurity.com/files/157255/TP-Link-Archer-A7-C7-Unauthenticated-LAN-Remote-Code-Execution.html
CVE ID: CVE-2020-10884 State: PUBLISHED Published: 2020-03-25T19:15:24 Last Updated: 2024-08-04T11:14:15.710Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: TP-Link Products: Archer A7 Problem Types: CWE-321 Description: This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP port 20002 by default. This issue results from the use of hard-coded encryption key. An attacker can leverage this in conjunction with other vulnera
issue results from the use of hard-coded encryption key. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9652. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-336/ - http://packetstormsecurity.com/files/157255/TP-Link-Archer-A7-C7-Unauthenticated-LAN-Remote-Code-Execution.html
CVE ID: CVE-2020-10885 State: PUBLISHED Published: 2020-03-25T19:15:25 Last Updated: 2024-08-04T11:14:15.886Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TP-Link Products: Archer A7 Problem Types: CWE-20 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of DNS responses. The issue results from the lack of proper validation of DNS reponses prior to further processing. An attacker can leverage this in conjunction with other vulnerabilities
ion of DNS reponses prior to further processing. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the root user. Was ZDI-CAN-9661. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-337/
CVE ID: CVE-2020-10886 State: PUBLISHED Published: 2020-03-25T19:15:25 Last Updated: 2024-08-04T11:14:15.619Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TP-Link Products: Archer A7 Problem Types: CWE-78 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tmpServer service, which listens on TCP port 20002. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverag
he lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9662. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-339/
CVE ID: CVE-2020-10887 State: PUBLISHED Published: 2020-03-25T19:15:26 Last Updated: 2024-08-04T11:14:15.707Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TP-Link Products: Archer A7 Problem Types: CWE-693 Description: This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of IPv6 connections. The issue results from the lack of proper filtering of IPv6 SSH connections. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. W
tions. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9663. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-338/
CVE ID: CVE-2020-10888 State: PUBLISHED Published: 2020-03-25T19:15:26 Last Updated: 2024-08-04T11:14:15.895Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: TP-Link Products: Archer A7 Problem Types: CWE-287 Description: This vulnerability allows remote attackers to bypass authentication on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SSH port forwarding requests during initial setup. The issue results from the lack of proper authentication prior to establishing SSH port forwarding rules. An attacker can leverage
esults from the lack of proper authentication prior to establishing SSH port forwarding rules. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the WAN interface. Was ZDI-CAN-9664. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-340/
CVE ID: CVE-2020-10889 State: PUBLISHED Published: 2020-04-22T20:50:55 Last Updated: 2024-08-04T11:14:15.618Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-843 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the DuplicatePages command of the communication API. The issue results from the lack of proper validation of user-supplied data, which can
command of the communication API. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9828. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-20-511/
CVE ID: CVE-2020-10890 State: PUBLISHED Published: 2020-04-22T20:50:55 Last Updated: 2024-08-04T11:14:15.746Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-352 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the communication API. The issue lies in the handling of the ConvertToPDF command, which allows an arbitrary file write with attacker controlled data. An a
es in the handling of the ConvertToPDF command, which allows an arbitrary file write with attacker controlled data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9829. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-20-512/
CVE ID: CVE-2020-10891 State: PUBLISHED Published: 2020-04-22T20:50:56 Last Updated: 2024-08-04T11:14:15.641Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-843 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the Save command of the communication API. The issue results from the lack of proper validation of user-supplied data, which can result in
the communication API. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9831. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-20-514/
CVE ID: CVE-2020-10892 State: PUBLISHED Published: 2020-04-22T20:50:56 Last Updated: 2024-08-04T11:14:15.770Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-352 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the communication API. The issue lies in the handling of the CombineFiles command, which allows an arbitrary file write with attacker controlled data. An a
es in the handling of the CombineFiles command, which allows an arbitrary file write with attacker controlled data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9830. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-20-513/
CVE ID: CVE-2020-10893 State: PUBLISHED Published: 2020-04-22T20:50:57 Last Updated: 2024-08-04T11:14:15.716Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in a PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a write past
d in a PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10189. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-20-521/
CVE ID: CVE-2020-10894 State: PUBLISHED Published: 2020-04-22T20:50:57 Last Updated: 2024-08-04T11:14:15.676Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-125 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in a PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a rea