thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link

The Mozilla Foundation's Security Advisory describes the following issue: Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment message/rfc822 and setting its content type to...

CVE-2024-51392

An issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via the url parameter of the getPDF.php component...

Updated ghostscript packages fix security vulnerabilities

gslibctxstashsanitizedarg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the case. A created PDF document includes its password in cleartext. CVE-2025-48708...

MGASA-2025-0170 Updated ghostscript packages fix security vulnerabilities

gslibctxstashsanitizedarg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the case. A created PDF document includes its password in cleartext. CVE-2025-48708...

SUSE CVE-2025-48708

gslibctxstashsanitizedarg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the case. A created PDF document includes its password in cleartext...

The vulnerability of Poppler’s PDF file rendering library, related to integer overflow, allows attackers to cause service interruptions.

The vulnerability of the Poppler library for displaying PDF files is related to a numerical overflow in the PSStack::roll function. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the Poppler library for displaying PDF files, related to reading beyond the buffer boundary in the JBIG2Bitmap::combine() function, allows a hacker to cause a service failure.

The vulnerability of the Poppler library for displaying PDF files relates to the reading beyond the buffer boundary in the JBIG2Bitmap::combine function. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the adbe.pkcs7.sha1 component of the Poppler PDF rendering library allows a attacker to execute an attack by replacing it.

The vulnerability of the adbe.pkcs7.sha1 component of the Poppler PDF rendering library is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow an attacker to carry out a substitution attack...

thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link

The Mozilla Foundation's Security Advisory describes the following issue: Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment message/rfc822 and setting its content type to...

thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link

The Mozilla Foundation's Security Advisory describes the following issue: Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment message/rfc822 and setting its content type to...

CVE-2025-5138

A vulnerability was found in Bitwarden up to 2.25.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component PDF File Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclos...

The vulnerability of the `gslibctx_stash_sanitized_arg` function in the `base/gslibctx.c` file of the Ghostscript processing, conversion, and generation software set allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the gsLib ctxstashsanitizedarg function in the base/gslibctx.c file of the Ghostscript processing, conversion, and generation software set is related to improper border removal of critical data. Exploiting this vulnerability may allow an attacker to gain unauthorized access t...

CVE-2025-5138

A vulnerability was found in Bitwarden up to 2.25.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component PDF File Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclos...

CVE-2025-5138 Bitwarden PDF File cross site scripting

A vulnerability was found in Bitwarden up to 2.25.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component PDF File Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclos...

CVE-2025-5138 Bitwarden PDF File cross site scripting

A vulnerability was found in Bitwarden up to 2.25.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component PDF File Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclos...

CVE-2025-5138

CVE-2025-5138 affects Bitwarden up to version 2.25.1. The vulnerability arises in the PDF File Handler component and enables cross-site scripting. Exploitation is possible remotely and, per linked sources, the exploit has been disclosed. Several connected sources corroborate an XSS flaw and note ...

PT-2025-22853 · Bitwarden · Bitwarden

Name of the Vulnerable Software and Affected Versions: Bitwarden versions up to 2.25.1 Description: A vulnerability was found in the PDF File Handler component of Bitwarden, leading to cross-site scripting. The attack can be launched remotely, and the exploit has been disclosed to the public. The...

Bitwarden 代码注入漏洞

Bitwarden is an open source password manager from Bitwarden Inc. in the United States. A code injection vulnerability exists in Bitwarden 2.25.1 and earlier versions, which stems from a misbehavior of the component PDF File Handler resulting in cross-site scripting...

CVE-2025-24644

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels print-invoices-packing-slip-labels-for-woocommerce allows Stored XSS.This issue affects WooCommerce PDF Invoice...

CVE-2025-24755

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Stored XSS.This issue affects PDF Invoice Builder for WooCommerce: from n/a through = 4.6.0...