Foxitsoftware Phantompdf
549 CVEs affecting Foxitsoftware Phantompdf. Latest disclosed: 2021-08-11. Critical: 26, High: 438.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-38574 | Critical | 9.8 | 2021-08-11 | An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows SQL Injection via crafted data at the end of a string. |
CVE-2021-38573 | Critical | 9.8 | 2021-08-11 | An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because a CombineFiles pathname is not validated. |
CVE-2021-38572 | Critical | 9.8 | 2021-08-11 | An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because the extractPages pathname is not validated. |
CVE-2021-38568 | Critical | 9.8 | 2021-08-11 | An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows memory corruption during conversion of a PDF document to a different document f… |
CVE-2021-33793 | Critical | 9.8 | 2021-08-11 | Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write because the Cross-Reference table is mishandled during Office document conv… |
CVE-2020-26539 | Critical | 9.8 | 2020-10-02 | An issue was discovered in Foxit Reader and PhantomPDF before 10.1. When there is a multiple interpretation error for /V (in the Additional Action and Field di… |
CVE-2020-26537 | Critical | 9.8 | 2020-10-02 | An issue was discovered in Foxit Reader and PhantomPDF before 10.1. In a certain Shading calculation, the number of outputs is unequal to the number of color c… |
CVE-2020-26535 | Critical | 9.8 | 2020-10-02 | An issue was discovered in Foxit Reader and PhantomPDF before 10.1. If TslAlloc attempts to allocate thread local storage but obtains an unacceptable index val… |
CVE-2020-26534 | Critical | 9.8 | 2020-10-02 | An issue was discovered in Foxit Reader and PhantomPDF before 10.1. There is an Opt object use-after-free related to Field::ClearItems and Field::DeleteOptions… |
CVE-2019-20830 | Critical | 9.8 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has an out-of-bounds write when Internet Explorer is used. |
CVE-2019-20827 | Critical | 9.8 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF Mac 3.3 and Foxit Reader for Mac before 3.3. It allows stack consumption because of interaction between ICC-Based c… |
CVE-2019-20825 | Critical | 9.8 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.11. It has an out-of-bounds write when Internet Explorer is used. |
CVE-2018-21244 | Critical | 9.8 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.6. It allows arbitrary application execution via an embedded executable file in a PDF portfolio, aka FG-… |
CVE-2018-21242 | Critical | 9.8 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.6. It allows Remote Code Execution via a GoToE or GoToR action. |
CVE-2020-13814 | Critical | 9.8 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.1. It has a use-after-free via a document that lacks a dictionary. |
CVE-2020-13805 | Critical | 9.8 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has brute-force attack mishandling because the CAS service lacks a limit on login failu… |
CVE-2020-13804 | Critical | 9.8 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows information disclosure of a hardcoded username and password in the DocuSign plug… |
CVE-2019-14209 | Critical | 9.8 | 2019-07-21 | An issue was discovered in Foxit PhantomPDF before 8.3.10. The application could be exposed to Heap Corruption due to data desynchrony when adding AcroForm. |
CVE-2018-17611 | Critical | 9.8 | 2018-09-28 | Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) because properties of Ann… |
CVE-2018-17610 | Critical | 9.8 | 2018-09-28 | Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) because properties of Ann… |