rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-5529 
The svpn component of the F5 BIG-IP APM client prior to version 7.1.7 for Linux and Mac OS X runs as a privileged process and can allow an unprivileged user to assume super-user privileges on the local client host. A malicious local unprivileged user may gain knowledge of sensitive information, manipulate certain data, or disrupt service.
Problem types: description: Privilege Escalation
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP APM client for Linux and Mac OSX
Published: 2018-07-12T18:00:00.000Z
CVE-2018-5530 
F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.1 virtual servers with HTTP/2 profiles enabled are vulnerable to "HPACK Bomb".
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, Edge Gateway, PEM, WebSafe)
Published: 2018-07-25T14:00:00.000Z
CVE-2018-5531 
Through undisclosed methods, on F5 BIG-IP 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.2.1-11.5.6, adjacent network attackers can cause a denial of service for VCMP guest and host systems. Attack must be sourced from adjacent network (layer 2).
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
Published: 2018-07-25T14:00:00.000Z
CVE-2018-5532 
On F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 a domain name cached within the DNS Cache of TMM may continue to be resolved by the cache even after the parent server revokes the record, if the DNS Cache is receiving a stream of requests for the cached name.
Problem types: description: Information leakage
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
Published: 2018-07-19T14:00:00.000Z
CVE-2018-5533 
Under certain conditions on F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.0-11.6.3.1, or 11.5.0-11.5.6, TMM may core while processing SSL forward proxy traffic.
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
Published: 2018-07-19T14:00:00.000Z
CVE-2018-5534 
Under certain conditions on F5 BIG-IP 13.1.0-13.1.0.5, 13.0.0, 12.1.0-12.1.3.1, 11.6.0-11.6.3.1, or 11.5.0-11.5.6, TMM may core while processing SSL forward proxy traffic.
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
Published: 2018-07-19T14:00:00.000Z
CVE-2018-5535 
On F5 BIG-IP 14.0.0, 13.0.0-13.1.0, 12.1.0-12.1.3, or 11.5.1-11.6.3 specifically crafted HTTP responses, when processed by a Virtual Server with an associated QoE profile that has Video enabled, may cause TMM to incorrectly buffer response data causing the TMM to restart resulting in a Denial of Service.
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
Published: 2018-07-19T14:00:00.000Z
CVE-2018-5536 
A remote attacker via undisclosed measures, may be able to exploit an F5 BIG-IP APM 13.0.0-13.1.0.7 or 12.1.0-12.1.3.5 virtual server configured with an APM per-request policy object and cause a memory leak in the APM module.
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (APM)
Published: 2018-07-25T14:00:00.000Z
CVE-2018-5537 
A remote attacker may be able to disrupt services on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 if the TMM virtual server is configured with a HTML or a Rewrite profile. TMM may restart while processing some specially prepared HTML content from the back end.
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, APM, ASM, Edge Gateway, GTM, PEM, WebAccelerator, WebSafe)
Published: 2018-07-25T14:00:00.000Z
CVE-2018-5538 
On F5 BIG-IP DNS 13.1.0-13.1.0.7, 12.1.3-12.1.3.5, DNS Express / DNS Zones accept NOTIFY messages on the management interface from source IP addresses not listed in the 'Allow NOTIFY From' configuration parameter when the db variable "dnsexpress.notifyport" is set to any value other than the default of "0".
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (DNS)
Published: 2018-07-25T14:00:00.000Z
CVE-2018-5539 
Under certain conditions, on F5 BIG-IP ASM 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, 11.5.1-11.5.6, or 11.2.1, when processing CSRF protections, the BIG-IP ASM bd process may restart and produce a core file.
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (ASM)
Published: 2018-07-25T14:00:00.000Z
CVE-2018-5540 
On F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.3, 11.6.0-11.6.3.1, or 11.5.1-11.5.6, Enterprise Manager 3.1.1, BIG-IQ Centralized Management 5.0.0-5.1.0, BIG-IQ Cloud and Orchestration 1.0.0, or F5 iWorkflow 2.1.0-2.3.0 the big3d process does not irrevocably minimize group privileges at start up.
Problem types: description: Privilege escalation
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (DNS, GTM)
vendor: F5 Networks, Inc.
product: Enterprise Manager
vendor: F5 Networks, Inc.
product: BIG-IQ Centralized Management
vendor: F5 Networks, Inc.
product: BIG-IQ Cloud and Orchestration
vendor: F5 Networks, Inc.
product: F5 iWorkflow
Published: 2018-07-19T14:00:00.000Z
CVE-2018-5541 
When F5 BIG-IP ASM 13.0.0-13.1.0.1, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.5.1-11.5.6 is processing HTTP requests, an unusually large number of parameters can cause excessive CPU usage in the BIG-IP ASM bd process.
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (ASM)
Published: 2018-07-25T14:00:00.000Z
CVE-2018-5542 
F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.6, or 11.2.1-11.6.3.2 HTTPS health monitors do not validate the identity of the monitored server.
Problem types: description: Information disclosure
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
Published: 2018-07-25T14:00:00.000Z
CVE-2018-5543 
The F5 BIG-IP Controller for Kubernetes 1.0.0-1.5.0 (k8s-bigip-crtl) passes BIG-IP username and password as command line parameters, which may lead to disclosure of the credentials used by the container.
Problem types: description: Information Disclosure
Affected products: vendor: F5 Networks, Inc.
product: F5 Container Connector
Published: 2018-07-31T14:00:00.000Z
CVE-2018-5544 
When the F5 BIG-IP APM 13.0.0-13.1.1 or 12.1.0-12.1.3 renders certain pages (pages with a logon agent or a confirm box), the BIG-IP APM may disclose configuration information such as partition and agent names via URI parameters.
Problem types: description: Information Disclosure
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (APM)
Published: 2018-07-31T14:00:00.000Z
CVE-2018-5545 
On F5 WebSafe Alert Server 1.0.0-4.2.6, a malicious, authenticated user can execute code on the alert server by using a maliciously crafted payload.
Problem types: description: Remote Code Execution
Affected products: vendor: F5 Networks, Inc.
product: F5 WebSafe Alert Server
Published: 2018-09-13T14:00:00.000Z
CVE-2018-5546 
The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a privileged process and can allow an unprivileged user to get ownership of files owned by root on the local client host. A malicious local unprivileged user may gain knowledge of sensitive information, manipulate certain data, or assume super-user privileges on the local client host.
Problem types: description: Privilege Escalation
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP APM client for Linux
vendor: F5 Networks, Inc.
product: BIG-IP APM client for macOS
Published: 2018-08-17T13:00:00.000Z
CVE-2018-5547 
Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7.1.7.1 for Windows by default uses Legacy logon mode which uses a SYSTEM account to establish network access. This feature displays a certificate user interface dialog box which contains the link to the certificate policy. By clicking on the link, unprivileged users can open additional dialog boxes and get access to the local machine windows explorer which can be used to get administrator privilege. Windows Logon Integration is vulnerable when the APM client is installed by an administrator on a user machine. Users accessing the local machine can get administrator privileges
Problem types: description: Privilege Escalation
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP APM client for Windows
Published: 2018-08-17T13:00:00.000Z
CVE-2018-5548 
On BIG-IP APM 11.6.0-11.6.3, an insecure AES ECB mode is used for orig_uri parameter in an undisclosed /vdesk link of APM virtual server configured with an access profile, allowing a malicious user to build a redirect URI value using different blocks of cipher texts.
Problem types: description: XSS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP APM
Published: 2018-09-13T14:00:00.000Z
CVE-2018-5549 
On BIG-IP APM 11.6.0-11.6.3.1, 12.1.0-12.1.3.3, 13.0.0, and 13.1.0-13.1.0.3, APMD may core when processing SAML Assertion or response containing certain elements.
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP APM
Published: 2018-09-13T14:00:00.000Z
CVE-2018-5550 
Versions of Epson AirPrint released prior to January 19, 2018 contain a reflective cross-site scripting (XSS) vulnerability, which can allow untrusted users on the network to hijack a session cookie or perform other reflected XSS attacks on a currently logged-on user.
Problem types: cwe_id: CWE-79
description: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
Affected products: vendor: Epson
product: Epson AirPrint
Published: 2018-02-08T19:00:00.000Z
CVE-2018-5551 DocuTrac DTISQLInstaller.exe Hard-Coded Credentials
Versions of DocuTrac QuicDoc and Office Therapy that ship with DTISQLInstaller.exe version 1.6.4.0 and prior contain three credentials with known passwords: QDMaster, OTMaster, and sa.
Problem types: cwe_id: CWE-798
description: Hard-Coded Credentials (CWE-798)
Affected products: vendor: DocuTrac
product: DTISQLInstaller.exe
Published: 2018-03-19T15:00:00.000Z
CVE-2018-5552 DocuTrac DTISQLInstaller.exe Hard-Coded Salt
Versions of DocuTrac QuicDoc and Office Therapy that ship with DTISQLInstaller.exe version 1.6.4.0 and prior contains a hard-coded cryptographic salt, "S@l+&pepper".
Problem types: cwe_id: CWE-760
description: Use of a One-Way Hash with a Predictable Salt (CWE-760)
Affected products: vendor: DocuTrac
product: DTISQLInstaller.exe
Published: 2018-03-19T15:00:00.000Z
CVE-2018-5553 Crestron DGE-100 Console Command Injection (FIXED)
The Crestron Console service running on DGE-100, DM-DGE-200-C, and TS-1542-C devices with default configuration and running firmware versions 1.3384.00049.001 and lower are vulnerable to command injection that can be used to gain root-level access.
Problem types: cwe_id: CWE-78
description: CWE-78 (Improper Neutralization of Special Elements used in an OS Command)
Affected products: vendor: Crestron
product: DGE-100
vendor: Crestron
product: TS-1542-C
vendor: Crestron
product: DM-DGE-200-C
Credits: lang: en
value: This issue was discovered by Rapid7 researchers Cale Black and Jordan Larose. It is being disclosed in accordance Rapid7's vulnerability disclosure policy (https://www.rapid7.com/disclosure/).
Published: 2018-07-10T16:00:00.000Z
CVE-2018-5559 
In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could return some configurations of connection data without obscuring sensitive data from the API response sent over an encrypted channel. This issue does not affect Rapid7 Komand version 0.42.0 and later versions.
Problem types: cwe_id: CWE-212
description: CWE-212
description: Improper Cross-boundary Removal of Sensitive Data
Affected products: vendor: Rapid7
product: Komand
Credits: lang: en
value: Alexander Jäger, https://twitter.com/alexanderjaeger
Published: 2018-11-28T19:00:00.000Z
CVE-2018-5560 Guardzilla All-In-One Video Security System Hard-Coded Credential
A reliance on a static, hard-coded credential in the design of the cloud-based storage system of Practecol's Guardzilla All-In-One Video Security System allows an attacker to view the private data of all users of the Guardzilla device.
Problem types: cwe_id: CWE-798
description: CWE-798
description: Use of Hard-coded Credentials
Affected products: vendor: Practecol, LLC
product: Guardzilla All-In-One Video Security System
Credits: lang: en
value: Discovered by Nick McClendon, Andrew Mirghassemi, Charles Dardaman, INIT_6, and Chris.
Published: 2019-01-31T21:00:00.000Z
CVE-2018-5650 
In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the unzip_match function in runzip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted lrz file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T22:00:00.000Z
CVE-2018-5651 
An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php dark_mode_start parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5652 
An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php dark_mode_end parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5653 
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php weblizar_pffree_settings_save_get-users parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5654 
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php PFFREE_Access_Token parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5655 
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php security parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5656 
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. CSRF exists via wp-admin/admin-ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5657 
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title_icon parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5658 
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. CSRF exists via wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5659 
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5660 
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_sub_title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5661 
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_width parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5662 
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5663 
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php button_text_link parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5664 
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php social_icon_1 parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5665 
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_height parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5666 
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php bg_color parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5667 
An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnu_username_validation_pattern parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5668 
An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnu_username_validation_title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5669 
An issue was discovered in the read-and-understood plugin 2.1 for WordPress. CSRF exists via wp-admin/options-general.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5670 
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php sale_conditions[count][] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5671 
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extra_field1[items][field_item1][price_percent] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5672 
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php form_field5[label] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5673 
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-13T00:00:00.000Z
CVE-2018-5674 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of specially crafted pdf files with embedded u3d images. Crafted data in the PDF file can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code under the context of the current process, a different vulnerability than CVE-2018-5676 and CVE-2018-5678.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-24T21:00:00.000Z
CVE-2018-5675 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of specially crafted pdf files with embedded u3d images. Crafted data in the PDF file can trigger an out-of-bounds write on a buffer. An attacker can leverage this vulnerability to execute code under the context of the current process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-24T21:00:00.000Z
CVE-2018-5676 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of specially crafted pdf files with embedded u3d images. Crafted data in the PDF file can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code under the context of the current process, a different vulnerability than CVE-2018-5674 and CVE-2018-5678.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-24T21:00:00.000Z
CVE-2018-5677 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of specially crafted pdf files with embedded u3d images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process, a different vulnerability than CVE-2018-5679 and CVE-2018-5680.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-24T21:00:00.000Z
CVE-2018-5678 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of specially crafted pdf files with embedded u3d images. Crafted data in the PDF file can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code under the context of the current process, a different vulnerability than CVE-2018-5674 and CVE-2018-5676.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-24T21:00:00.000Z