CVE-2021-34957

Summary: CVE-2021-34957 affects Foxit PDF Editor/Reader. The flaw is a Use-After-Free in the handling of Annotation objects, caused by not validating the existence of an object before performing operations on it. This can allow remote code execution in the context of the affected process when a u...

CVE-2021-34956

CVE-2021-34956 is a use-after-free vulnerability in Foxit PDF Editor related to Annotation object handling (Underline Annotation). The flaw stems from not validating an object's existence before operations, enabling potential code execution in the application's context. It requires user interacti...

CVE-2021-34955

Foxit PDF Editor Stamp Annotation Use-After-Free (CVE-2021-34955) is documented as a remote code execution vulnerability caused by a missing validation of an Annotation object before operations. The flaw allows an attacker to run arbitrary code in the target process when a user visits a malicious...

CVE-2021-34951

CVE-2021-34951 is a vulnerability in Foxit PDF Reader (and related components) where an uninitialized pointer in the handling of Annotation objects can disclose sensitive information. The flaw can allow a remote attacker to access information from the current process by convincing a user to view ...

CVE-2021-34950

CVE-2021-34950 affects Foxit PDF Reader. A flaw in how Annotation objects are validated can cause an out-of-bounds read, enabling arbitrary code execution in the context of the affected process. The vulnerability requires user interaction (visiting a malicious page or opening a malicious file). A...

CVE-2021-34949

CVE-2021-34949 affects Foxit PDF Reader (and related Foxit products) with an Annotation object handling flaw that allows out-of-bounds reads and information disclosure. The root cause is improper validation of user-supplied data in Annotation objects, which can read past the end of an allocated o...

CVE-2021-34948

CVE-2021-34948 is a Foxit PDF Reader vulnerability (Square Annotation Use-After-Free) that allows remote code execution. The flaw arises from not validating the existence of a square annotation object before performing operations, enabling an attacker to execute code in the process context. Explo...

CVE-2023-40694

CVE-2023-40694 affects IBM Watson CP4D Data Stores (versions 4.0.0 through 4.8.4). The issue stems from storing potentially sensitive information in log files that could be read by a local user, constituting an information-disclosure vulnerability. Red Hat and IBM bulletin entries corroborate the...

CVE-2024-23706

CVE-2024-23706 affects Google Android via health data permissions bypass in the HealthFitness pathway, caused by improper input validation. The result is local escalation of privilege with no additional execution privileges required and no user interaction needed. Affected context appears in Andr...

CVE-2024-34346

CVE-2024-34346 affects Deno and describes a permission-escalation via opening privileged files (e.g., reading /proc/self/environ, writing /proc/self/mem) when sandbox permissions are opened with --allow-read/--allow-write. The issue arises because the sandbox can be weakened if deny flags are not...

CVE-2024-0042

Technical details are not publicly available in the provided documents. No affected products/versions or remediation specifics are listed. Monitor for updates.

CVE-2024-23713

CVE-2024-23713 affects Google's Android Framework, specifically migrateNotificationFilter in NotificationManagerService.java. The root cause is improper input validation that can fail to persist notification settings, enabling local privilege escalation with no extra execution privileges required...

CVE-2024-23710

CVE-2024-23710 affects Google Android: a logic error in InstallPackageHelper.java (assertPackageWithSharedUserIdIsPrivileged) could allow local elevation of privilege by executing arbitrary code as a privileged app, without extra privileges or user interaction. Impact is described as high (CVE-20...

CVE-2024-23704

CVE-2024-23704 is an elevation-of-privilege vulnerability in Android’s WifiDialogActivity.onCreate that bypasses DISALLOW_ADD_WIFI_CONFIG due to a missing permission check. Exploitation requires local access with no user interaction; no remote vector is described. Multiple connected sources (NVD,...

CVE-2024-0026

CVE-2024-0026 corresponds to a DoS in Android’s SnoozeHelper.java, causing a persistent denial of service through resource exhaustion. Affected component: Android framework/system code on Google Android. Impact: local DoS with no extra execution privileges and no user interaction required. Source...

CVE-2024-0022

CVE-2024-0022 affects Android’s CompanionDeviceManagerService.java. The issue is improper input validation that can cause a NotificationAccessConfirmationActivity to be launched for another user profile, enabling local information disclosure without extra privileges and without user interaction. ...

CVE-2024-27273

IBM AIX (AIX 7.2, 7.3, VIOS 3.1, VIOS 4.1) has a privilege-escalation issue in the Unix domain datagram socket implementation when using SO_PEERID, potentially exposing local applications. CVSS indicates LOCAL access, LOW privileges required, with HIGH confidentiality/integrity/availability impac...

CVE-2024-4559

CVE-2024-4559 is a heap buffer overflow in WebAudio used by Google Chrome before version 124.0.6367.155. Multiple connected sources (Debian DSA-5683-1, CNVD-2024-36094, GLSA entries, Astra Linux security bulletin) corroborate this vulnerability in Chromium-based Chrome/WebAudio. Impact is describ...

CVE-2024-4558

CVE-2024-4558: Use-after-free in ANGLE within Google Chrome/Chromium's WebKit/ANGLE path allows a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affects Chrome/Chromium builds prior to version 124.0.6367.155. The issue is addressed in the referenced Chrome update;...

CVE-2024-29209

The CVE-2024-29209/29210 family concerns Phish Alert Button (PAB) for Outlook and related KnowBe4 clients. Technical details across connected records show: attack via update mechanism (CVE-2024-29209) where the client fails to validate the update server’s TLS/SSL and ignores digital signatures, e...