CVE-2024-9849

CVE-2024-9849 (Real 3D FlipBook Lite – 3D FlipBook, PDF Viewer, PDF Embedder): The vulnerability is an authenticated arbitrary-file-upload flaw caused by missing file-type validation in the r3dfb_save_thumbnail_callback, affecting all versions up to 4.6. An Author+ level attacker can upload arbit...

[SECURITY] Fedora 40 Update: ghostscript-10.02.1-13.fc40

This package provides useful conversion utilities based on Ghostscript softwa re, for converting PS, PDF and other document formats between each other. Ghostscript is a suite of software providing an interpreter for Adobe Systems' PostScript PS and Portable Document Format PDF page description...

WordPress plugin PDF Generator Addon for Elementor Page Builder 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. WordPress plugin is an application plug-in. A path traversal vulnerability...

GHSA-3VJH-XRHF-V9XH Improper Restriction of XML External Entity Reference in dompdf/dompdf

An improper restriction of external entities XXE vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery SSRF and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to...

WordPress 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin Plugin <= 4.6 is vulnerable to Arbitrary File Upload

Software 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin Type Plugin Vulnerable versions = 4.6 Fixed in 4.8.5 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-9849 Patch priority Medium CVSS severity Medium 9.1 Developer Claim ownership PSID...

The vulnerability of PDF-XChange Editor’s document viewing and editing software, related to errors in the certificate validation process, allows a perpetrator to execute arbitrary code.

The vulnerability of PDF-XChange Editor’s PDF document viewing and editing software is related to errors in the certificate authenticity verification process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2024-39950 · WordPress · Pdf Generator Addon For Elementor Page Builder

Name of the Vulnerable Software and Affected Versions: PDF Generator Addon for Elementor Page Builder plugin for WordPress versions up to, and including, 1.7.5 Description: The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal. This makes it...

The vulnerability of the PDF document viewing program Foxit PDF Reader (formerly Foxit Reader) and the PDF file editing program Foxit PDF Editor (formerly Foxit PhantomPDF) allows a perpetrator to execute arbitrary code.

The vulnerability of the PDF document viewing program Foxit PDF Reader formerly Foxit Reader and the PDF file editing program Foxit PDF Editor formerly Foxit PhantomPDF is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability affects the AcroForm Handler component of the PDF Foxit Reader (formerly Foxit Reader) and the Foxit PDF Editor (formerly Foxit PhantomPDF) software for viewing electronic documents. This vulnerability allows a malicious actor to execute arbitrary code.

The vulnerability of the AcroForm Handler component in the PDF Foxit Reader software formerly Foxit Reader and the Foxit PDF Editor software for editing PDF files is related to the use of memory after it is released. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability of PDF viewing and editing programs like Acrobat Reader lies in the improper use of dynamic memory, allowing attackers to execute arbitrary code.

The vulnerability of PDF viewing and editing programs like Acrobat Reader is related to the improper use of dynamic memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerabilities of PDF viewing and editing programs such as Acrobat DC, Acrobat Reader DC, Acrobat 2024, Acrobat 2020, and Acrobat Reader 2020 are related to the use of memory after it is freed. This allows attackers to execute arbitrary code.

The vulnerability of PDF viewing and editing programs such as Acrobat DC, Acrobat Reader DC, Acrobat 2024, Acrobat 2020, and Acrobat Reader 2020 is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code in the context of the...

CVE-2024-52300

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whole XWiki installation when an admin...

CVE-2024-52299

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" that is passed to prevent this is computed incorrectly, calling skip on the digest stream doesn't update the digest...

CVE-2024-52298

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The PDF Viewer macro allows an attacker to view any attachment using the "Delegate my view right" feature as long as the attacker can view a page whose last author has access to the attachment. For this, the attacker only needs...

CVE-2024-52298

The CVE-2024-52298 issue affects the macro-pdfviewer (XWiki) that uses Mozilla pdf.js. An attacker can view any attachment by exploiting the Delegate my view right privilege if they can access a page whose last author has permission to the attachment. The attacker needs only a reference to a PDF ...

CVE-2024-52298 macro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last author

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The PDF Viewer macro allows an attacker to view any attachment using the "Delegate my view right" feature as long as the attacker can view a page whose last author has access to the attachment. For this, the attacker only needs...

CVE-2024-52298 macro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last author

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The PDF Viewer macro allows an attacker to view any attachment using the "Delegate my view right" feature as long as the attacker can view a page whose last author has access to the attachment. For this, the attacker only needs...

CVE-2024-52298 macro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last author

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The PDF Viewer macro allows an attacker to view any attachment using the "Delegate my view right" feature as long as the attacker can view a page whose last author has access to the attachment. For this, the attacker only needs...

CVE-2024-52299 The PDF viewer macro allows accessing any attachment without access right checks

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" that is passed to prevent this is computed incorrectly, calling skip on the digest stream doesn't update the digest...

CVE-2024-52299

The CVE-2024-52299 entry concerns the XWiki macro-pdfviewer (PDF Viewer Macro using Mozilla pdf.js). The root cause is that the access control key passed to prevent access is computed incorrectly, along with a digest stream issue where calling skip does not update the digest. This permits any use...