Foxitsoftware vulnerabilities
797 vulnerabilities
Known vulnerabilities in Foxitsoftware products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 24 products.
Products
24- Phantompdf549 vulnerabilities
- Foxit Reader372 vulnerabilities
- Reader259 vulnerabilities
- Foxit Studio Photo54 vulnerabilities
- Pdf Editor28 vulnerabilities
- 3D20 vulnerabilities
- Foxit Pdf Sdk Activex10 vulnerabilities
- U3D9 vulnerabilities
- Enterprise Reader3 vulnerabilities
- Pdf Reader3 vulnerabilities
- Quick Pdf Library3 vulnerabilities
- Wac Server3 vulnerabilities
- Foxit Pdf Toolkit2 vulnerabilities
- Mobilepdf2 vulnerabilities
- E Mail Advertising System1 vulnerabilities
- Foxit Advanced Pdf Editor1 vulnerabilities
- Foxit Mobilepdf Pdf Reader1 vulnerabilities
- Foxit Pdf1 vulnerabilities
- Foxit Pdf Sdk Dll1 vulnerabilities
- Foxit Phantom1 vulnerabilities
- Jpeg2000 Jbig2 Decoder Add On1 vulnerabilities
- Jpeg2000\/Jbig2 Decoder Add On1 vulnerabilities
- Pdf Activex1 vulnerabilities
- Pdf Compressor1 vulnerabilities
CVE-2018-21237foxitsoftwarephantompdf
EPSS score0.82%
An issue was discovered in Foxit PhantomPDF before 8.3.7. It allows NTLM credential theft via a GoToE or GoToR action.CVE-2018-21239foxitsoftwarephantompdf+1EPSS score0.82%
An issue was discovered in Foxit Reader and PhantomPDF before 9.2. It allows NTLM credential theft via a GoToE or GoToR action.CVE-2018-21236foxitsoftwarereaderEPSS score1.04%
An issue was discovered in Foxit Reader before 2.4.4. It has a NULL pointer dereference.CVE-2018-21241foxitsoftwarephantompdfEPSS score0.79%
An issue was discovered in Foxit PhantomPDF before 8.3.6. It has an untrusted search path that allows a DLL to execute remote code.CVE-2018-21244foxitsoftwarephantompdfEPSS score1.81%
An issue was discovered in Foxit PhantomPDF before 8.3.6. It allows arbitrary application execution via an embedded executable file in a PDF portfolio, aka FG-VD-18-029.CVE-2018-21235foxitsoftwaree-mail_advertising_systemEPSS score1.21%
An issue was discovered in Foxit E-mail advertising system before September 2018. It allows authentication bypass and information disclosure, related to Interspire Email Marketer.CVE-2018-21238foxitsoftwarephantompdfEPSS score1.04%
An issue was discovered in Foxit PhantomPDF before 8.3.7. It allows memory consumption via an ArrayBuffer(0xfffffffe) call.CVE-2018-21242foxitsoftwarephantompdfEPSS score2.23%
An issue was discovered in Foxit PhantomPDF before 8.3.6. It allows Remote Code Execution via a GoToE or GoToR action.CVE-2018-21240foxitsoftwarephantompdf+1EPSS score1.04%
An issue was discovered in Foxit Reader and PhantomPDF before 9.2. It allows memory consumption via an ArrayBuffer(0xfffffffe) call.CVE-2018-21243foxitsoftwarephantompdfEPSS score0.90%
An issue was discovered in Foxit PhantomPDF before 8.3.6. It has COM object mishandling when Microsoft Word is used.CVE-2018-16292foxitsoftwarephantompdf+1EPSS score2.66%
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16293, CVE-2018-16294, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.CVE-2018-16291foxitsoftwarephantompdf+1EPSS score2.66%
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.CVE-2018-16297foxitsoftwarephantompdf+1EPSS score2.66%
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16295, and CVE-2018-16296. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.CVE-2018-16296foxitsoftwarephantompdf+1EPSS score2.66%
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16295, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.CVE-2018-16295foxitsoftwarephantompdf+1EPSS score2.66%
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.CVE-2018-16294foxitsoftwarephantompdf+1EPSS score2.66%
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.CVE-2018-16293foxitsoftwarephantompdf+1EPSS score2.66%
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16294, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.CVE-2018-1180foxitfoxit reader+2EPSS score2.64%
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the AFSimple_Calculate method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5491.CVE-2018-1175foxitfoxit reader+2EPSS score2.57%
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the interactive attribute of PrintParams objects. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5438.CVE-2018-1178foxitfoxit reader+2EPSS score2.64%
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the addField method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5489.