CVE-2018-19447

A stack-based buffer overflow can occur for specially crafted PDF files in Foxit Reader SDK ActiveX 5.4.0.1031 when parsing the URI string. An attacker can leverage this to gain remote code execution...

Command injection

A command injection can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031 when the JavaScript API app.launchURL is used. An attacker can leverage this to gain remote code execution...

Stack overflow

A stack-based buffer overflow can occur for specially crafted PDF files in Foxit Reader SDK ActiveX 5.4.0.1031 when parsing the URI string. An attacker can leverage this to gain remote code execution...

Command injection

A command injection can occur for specially crafted PDF files in Foxit Reader SDK ActiveX 5.4.0.1031 when parsing a launch action. An attacker can leverage this to gain remote code execution...

Remote code execution

A File Write can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031 when the JavaScript API Doc.createDataObject is used. An attacker can leverage this to gain remote code execution...

CVE-2018-19444

CVE-2018-19444 describes a use-after-free in the TextBox Validate action of IReader_ContentProvider within Foxit Reader SDK ActiveX Professional 5.4.0.1031. Exploitation via specially crafted PDFs can lead to remote code execution. The Red Hat and CVE mappings note this vulnerability is distinct ...

CVE-2018-19445

CVE-2018-19445 affects Foxit Reader SDK ActiveX Pro (5.4.0.1031) where the JavaScript API app.launchURL can be abused to inject commands, enabling remote code execution. The root cause is insufficient validation of user-supplied strings before executing them via a system call in the ActiveX compo...

CVE-2018-19446

CVE-2018-19446 affects Foxit Reader SDK ActiveX Pro (5.4.0.1031). The vulnerability lies in the JavaScript API Doc.createDataObject, which can cause a File Write when processing specially crafted PDFs, enabling remote code execution. According to the connected SRCINCITE entry, exploitation requir...

CVE-2018-19447

Foxit PDF SDK ActiveX vulnerability CVE-2018-19447 affects Foxit Reader SDK ActiveX Std/Pro 5.4.0.1031, where parsing URI strings can trigger a stack-based buffer overflow, enabling remote code execution. Root cause: unchecked URI parsing in the ActiveX component. Reported impact: remote code exe...

CVE-2018-19448

The CVE-2018-19448 vulnerability affects Foxit Reader SDK ActiveX Pro, where an uninitialized pointer in IReader_ContentProvider::GetDocEventHandler can be triggered when the ActiveX control is embedded in Office documents, allowing remote code execution. Exploitation requires user interaction (e...

CVE-2018-19448

In Foxit Reader SDK ActiveX Professional 5.4.0.1031, an uninitialized object in IReaderContentProvider::GetDocEventHandler occurs when embedding the control into Office documents. By opening a specially crafted document, an attacker can trigger an out of bounds write condition, possibly leveragin...

CVE-2018-19450

CVE-2018-19450 affects Foxit Reader SDK ActiveX: a command-injection bug occurs when parsing a Launch action in specially crafted PDF files, enabling remote code execution. Affected: Foxit Reader SDK ActiveX prior to 5.5.1 (e.g., 5.4.0.1031). Exploitation requires user interaction. Vendor guidanc...

Foxit PDF SDK ActiveX Installed (Windows)

Binary data foxitpdfsdkactivexinstalled.nbin...

Foxit PDF SDK ActiveX < 5.5.1 Multiple Vulnerabilities

According to its version, the Foxit PDF SDK ActiveX application installed on the remote Windows host is prior to 5.5.1. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability exists due to a lack of security permission control which could allow LaunchURL...

CVE-2019-1005

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploit...

CVE-2019-0888

A remote code execution vulnerability exists in the way that ActiveX Data Objects ADO handle objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with the victim user’s privileges. An attacker could craft a website that exploits the vulnerabilit...

CVE-2019-0888

A remote code execution vulnerability exists in the way that ActiveX Data Objects ADO handle objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with the victim user’s privileges. An attacker could craft a website that exploits the vulnerabilit...

Remote code execution

A remote code execution vulnerability exists in the way that ActiveX Data Objects ADO handle objects in memory, aka 'ActiveX Data Objects ADO Remote Code Execution Vulnerability'...

CVE-2019-0888 ActiveX Data Objects (ADO) Remote Code Execution Vulnerability

...

CVE-2019-0888

CVE-2019-0888 affects Microsoft ActiveX Data Objects (ADO). A use-after-free in memory handling could allow remote code execution when a user visits a crafted website; the vulnerability is addressed by a Microsoft security update that changes how ADO handles objects in memory. A PoC/Exploit exist...