deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-34901
Published: 2022-07-18
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability. The specific flaw exists within the Parallels Service. The service executes files from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-16137.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://kb.parallels.com/en/129010; https://www.zerodayinitiative.com/advisories/ZDI-22-948/; https://kb.parallels.com/en/129010
CVE: CVE-2022-34902
Published: 2022-07-18
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Desktop Control Agent service. The service loads Qt plugins from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-15787.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://kb.parallels.com/en/129010; https://www.zerodayinitiative.com/advisories/ZDI-22-946/; https://kb.parallels.com/en/129010
CVE: CVE-2022-35741
Published: 2022-07-18
Description: Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vulnerable to XML external entity (XXE) injection. This plugin is not enabled by default and the attacker would require that this plugin be enabled to exploit the vulnerability. When the SAML 2.0 plugin is enabled in affected versions of Apache CloudStack could potentially allow the exploitation of XXE vulnerabilities. The SAML 2.0 messages constructed during the authentication flow in Apache CloudStack are XML-based and the XML data is parsed by various standard libraries that are now understood to be vulnerable to XXE injection attacks such as arbitrary file reading, possible denial of service, server-side request forgery (SSRF) on the CloudStack management server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2022/07/18/2; http://www.openwall.com/lists/oss-security/2022/07/20/1; https://lists.apache.org/thread/hwhxvtwp1d5dsm156bsf1cnyvtmrfv3f
CVE: CVE-2021-42755
Published: 2022-07-18
Description: An integer overflow / wraparound vulnerability [CWE-190] in FortiSwitch 7.0.2 and below, 6.4.9 and below, 6.2.x, 6.0.x; FortiRecorder 6.4.2 and below, 6.0.10 and below; FortiOS 7.0.2 and below, 6.4.8 and below, 6.2.10 and below, 6.0.x; FortiProxy 7.0.0, 2.0.6 and below, 1.2.x, 1.1.x, 1.0.x; FortiVoiceEnterprise 6.4.3 and below, 6.0.10 and below dhcpd daemon may allow an unauthenticated and network adjacent attacker to crash the dhcpd deamon, resulting in potential denial of service.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-190
References: https://fortiguard.com/psirt/FG-IR-21-155; https://fortiguard.com/psirt/FG-IR-21-155
CVE: CVE-2021-44170
Published: 2022-07-18
Description: A stack-based buffer overflow vulnerability [CWE-121] in the command line interpreter of FortiOS before 7.0.4 and FortiProxy before 2.0.8 may allow an authenticated attacker to execute unauthorized code or commands via specially crafted command line arguments.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://fortiguard.com/psirt/FG-IR-21-179; https://fortiguard.com/psirt/FG-IR-21-179
CVE: CVE-2022-1565
Published: 2022-07-18
Description: The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://plugins.trac.wordpress.org/changeset/2749264/wp-all-import/trunk?contextall=1&old=2737093&old_path=%2Fwp-all-import%2Ftrunk; https://www.wordfence.com/threat-intel/vulnerabilities/id/5d281333-d9af-4eb7-bc5c-ea7ceeddac03?source=cve; https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1565
CVE: CVE-2022-1912
Published: 2022-07-18
Description: The Button Widget Smartsoft plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing nonce validation on the smartsoftbutton_settings page. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/smartsoftbutton-widget-de-botones-de-chat/trunk/admin/pages/settings.php#L60; https://www.wordfence.com/threat-intel/vulnerabilities/id/53[PII_REDACTED]-46cc-b2ae-04b5fc55a35c?source=cve; https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1912
CVE: CVE-2022-22304
Published: 2022-07-18
Description: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAuthenticator OWA Agent for Microsoft version 2.2 and 2.1 may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.com/psirt/FG-IR-22-021; https://fortiguard.com/psirt/FG-IR-22-021
CVE: CVE-2022-23745
Published: 2022-07-18
Description: A potential memory corruption issue was found in Capsule Workspace Android app (running on GrapheneOS). This could result in application crashing but could not be used to gather any sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1218, CWE-787
References: https://supportcenter.us.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk179646; https://supportcenter.us.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk179646
CVE: CVE-2022-2001
Published: 2022-07-18
Description: The DX Share Selection plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce protection on the dxss_admin_page() function found in the ~/dx-share-selection.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site's administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/dx-share-selection/trunk/dx-share-selection.php#L284; https://plugins.trac.wordpress.org/changeset/2747572/dx-share-selection/trunk?contextall=1&old=2384535&old_path=%2Fdx-share-selection%2Ftrunk; https://wordpress.org/plugins/dx-share-selection/
CVE: CVE-2022-2039
Published: 2022-07-18
Description: The Free Live Chat Support plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.11. This is due to missing nonce protection on the livesupporti_settings() function found in the ~/livesupporti.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site's administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/livesupporti/trunk/livesupporti.php#L67; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2762052%40livesupporti&new=2762052%40livesupporti&sfp_email=&sfph_mail=; https://wordpress.org/plugins/livesupporti/#developers
CVE: CVE-2022-2101
Published: 2022-07-18
Description: The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter in versions up to, and including, 3.2.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor level permissions and above to inject arbitrary web scripts on the file's page that will execute whenever an administrator accesses the editor area for the injected file page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40andreabocchetti88/download-manager-3-2-43-contributor-cross-site-scripting-fa4970fba45c; https://packetstormsecurity.com/files/167573/; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2750339%40download-manager&new=2750339%40download-manager&sfp_email=&sfph_mail=
CVE: CVE-2022-2108
Published: 2022-07-18
Description: The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due to missing capability checks and improper nonce checks in several functions related to said actions in versions up to, and including, 2.8.3. This makes it possible for unauthenticated attackers to modify reviews and plugin settings on the affected site.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/review-buddypress-groups/trunk/includes/bgr-ajax.php#L359; https://plugins.trac.wordpress.org/changeset/2742109; https://www.wordfence.com/threat-intel/vulnerabilities/id/397dabc3-5dcf-4d1f-9e24-28af889cb76f?source=cve
CVE: CVE-2022-2117
Published: 2022-07-18
Description: The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wall REST-API endpoint which provides unauthenticated users with donor information even when the donor wall is not enabled. This functionality has been completely removed in version 2.20.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/2743833/give/tags/2.21.0/includes/api/class-give-api-v2.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/addae413-1fc5-427f-a5ef-3da705cbeb5b?source=cve; https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2117
CVE: CVE-2022-2223
Published: 2022-07-18
Description: The WordPress plugin Image Slider is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1.121 due to failure to properly check for the existence of a nonce in the function ewic_duplicate_slider. This make it possible for unauthenticated attackers to duplicate existing posts or pages granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2749352%40image-slider-widget&new=2749352%40image-slider-widget&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/6356e226-a449-4cd0-be60-2a1c9c70aa59?source=cve; https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2223
CVE: CVE-2022-2224
Published: 2022-07-18
Description: The WordPress plugin Gallery for Social Photo is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.0.27 due to failure to properly check for the existence of a nonce in the function gifeed_duplicate_feed. This make it possible for unauthenticated attackers to duplicate existing posts or pages granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2749351%40feed-instagram-lite&new=2749351%40feed-instagram-lite&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c6683edc-8c77-446c-bd7e-e97b8c5d0c57?source=cve; https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2224
CVE: CVE-2022-2435
Published: 2022-07-18
Description: The AnyMind Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1. This is due to missing nonce protection on the createDOMStructure() function found in the ~/anymind-widget-id.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site’s administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/anymind-widget/trunk/anymind-widget-id.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/174eae70-15d7-4772-8fcd-dc4c0fca5b7d?source=cve; https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2435
CVE: CVE-2022-2437
Published: 2022-07-18
Description: The Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress is vulnerable to deserialization of untrusted input via the 'fts_url' parameter in versions up to, and including 2.9.8.5. This makes it possible for unauthenticated attackers to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502, CWE-502
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2754749%40feed-them-social&new=2754749%40feed-them-social&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/50bcea94-b12a-4b31-b0c1-bba834ea9bd0?source=cve; https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2437
CVE: CVE-2022-2443
Published: 2022-07-18
Description: The FreeMind WP Browser plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.2. This is due to missing nonce protection on the FreemindOptions() function found in the ~/freemind-wp-browser.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site's administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/freemind-wp-browser/trunk/freemind-wp-browser.php#L104; https://www.wordfence.com/threat-intel/vulnerabilities/id/c5f3e34d-07fb-4e49-a4e2-f8e92301b35e?source=cve; https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2443
CVE: CVE-2022-2444
Published: 2022-07-18
Description: The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 'remote_data' parameter in versions up to, and including 3.7.9. This makes it possible for authenticated attackers with contributor privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502, CWE-502
References: https://github.com/Codeinwp/visualizer/blob/master/classes/Visualizer/Module/Chart.php#L1115; https://github.com/Codeinwp/visualizer/blob/master/classes/Visualizer/Source/Csv.php; https://github.com/Codeinwp/visualizer/compare/v3.7.9...v3.7.10
CVE: CVE-2022-32387
Published: 2022-07-18
Description: In Kentico before 13.0.66, attackers can achieve Denial of Service via a crafted request to the GetResource handler.
CVSS Score: 7.5 (HIGH)
References: https://devnet.kentico.com/download/hotfixes; https://devnet.kentico.com/download/hotfixes
CVE: CVE-2021-22131
Published: 2022-07-18
Description: A improper validation of certificate with host mismatch in Fortinet FortiTokenAndroid version 5.0.3 and below, Fortinet FortiTokeniOS version 5.2.0 and below, Fortinet FortiTokenWinApp version 4.0.3 and below allows attacker to retrieve information disclosed via man-in-the-middle attacks.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-295
References: https://fortiguard.com/advisory/FG-IR-21-024; https://fortiguard.com/advisory/FG-IR-21-024
CVE: CVE-2021-29788
Published: 2022-07-18
Description: IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 203310.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/203310; https://www.ibm.com/support/pages/node/6604005; https://exchange.xforce.ibmcloud.com/vulnerabilities/203310
CVE: CVE-2021-29790
Published: 2022-07-18
Description: IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 203440.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/203440; https://www.ibm.com/support/pages/node/6604005; https://exchange.xforce.ibmcloud.com/vulnerabilities/203440
CVE: CVE-2021-29799
Published: 2022-07-18
Description: IBM Engineering Requirements Quality Assistant On-Premises (All versions) could allow an authenticated user to obtain sensitive information due to improper client side validation. IBM X-Force ID: 203738.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/203738; https://www.ibm.com/support/pages/node/6604005; https://exchange.xforce.ibmcloud.com/vulnerabilities/203738
CVE: CVE-2021-38868
Published: 2022-07-18
Description: IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force Id: 208310.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/208310; https://www.ibm.com/support/pages/node/6604005; https://exchange.xforce.ibmcloud.com/vulnerabilities/208310
CVE: CVE-2021-41031
Published: 2022-07-18
Description: A relative path traversal vulnerability [CWE-23] in FortiClient for Windows versions 7.0.2 and prior, 6.4.6 and prior and 6.2.9 and below may allow a local unprivileged attacker to escalate their privileges to SYSTEM via the named pipe responsible for FortiESNAC service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://fortiguard.com/advisory/FG-IR-21-190; https://fortiguard.com/advisory/FG-IR-21-190
CVE: CVE-2022-22445
Published: 2022-07-18
Description: An attacker that gains service access to the FSP (POWER9 only) or gains admin authority to a partition can compromise partition firmware.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/224546; https://www.ibm.com/support/pages/node/6604071; https://exchange.xforce.ibmcloud.com/vulnerabilities/224546
CVE: CVE-2022-23438
Published: 2022-07-18
Description: An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in FortiOS version 7.0.5 and prior and 6.4.9 and prior may allow an unauthenticated remote attacker to perform a reflected cross site scripting (XSS) attack in the captive portal authentication replacement page.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.com/psirt/FG-IR-21-057; https://fortiguard.com/psirt/FG-IR-21-057
CVE: CVE-2022-26117
Published: 2022-07-18
Description: An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL databases via the CLI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-521
References: https://fortiguard.com/psirt/FG-IR-22-058; https://github.com/orangecertcc/security-research/security/advisories/GHSA-r259-5p5p-2q47; https://fortiguard.com/psirt/FG-IR-22-058
CVE: CVE-2022-26118
Published: 2022-07-18
Description: A privilege chaining vulnerability [CWE-268] in FortiManager and FortiAnalyzer 6.0.x, 6.2.x, 6.4.0 through 6.4.7, 7.0.0 through 7.0.3 may allow a local and authenticated attacker with a restricted shell to escalate their privileges to root due to incorrect permissions of some folders and executable files on the system.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: https://fortiguard.com/psirt/FG-IR-21-056; https://fortiguard.com/psirt/FG-IR-21-056
CVE: CVE-2022-26120
Published: 2022-07-18
Description: Multiple improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerabilities [CWE-89] in FortiADC management interface 7.0.0 through 7.0.1, 5.0.0 through 6.2.2 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: https://fortiguard.com/psirt/FG-IR-22-051; https://fortiguard.com/psirt/FG-IR-22-051
CVE: CVE-2022-28669
Published: 2022-07-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16420.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-760/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-28670
Published: 2022-07-18
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of AcroForms. Crafted data in an AcroForm can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-16523.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-761/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-28671
Published: 2022-07-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16639.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-762/; https://www.foxit.com/support/security-bulletins.html