Evince Detection (Linux/Unix SSH Login)

SSH based detection of Evince. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.112805";...

gThumb: Arbitrary code execution

Background gThumb is an image viewer and browser for GNOME. Description A heap-based buffer overflow in gThumb’s cairoimagesurfacecreatefromjpeg function, located in extensions/cairoio/cairo-image-surface-jpeg.c was discovered. Impact A remote attacker could entice a user to open a specially...

Foxit Reader < 4.0 Privilege Escalation (macOS)

The version of Foxit Reader for Mac installed on the remote macOS host is prior to 4.0. It is, therefore, affected by a Signature Validation Bypass vulnerability that delivers incorrect validation results when validating certain PDF files that have been modified maliciously or contains non-standa...

RTSP for iOS 1.0 - (IP Address) Denial of Service Exploit

Exploit Title: RTSP for iOS 1.0 - 'IP Address' Denial of Service PoC Author: Luis Martinez Vendor Homepage: https://appadvice.com/app/rtsp-viewer/1056996189 Software Link: App Store for iOS devices Tested Version: 1.0 Vulnerability Type: Denial of Service DoS Local Tested on OS: iPhone 7 iOS 13.5...

Foxit Reader < 10.0.1 Multiple Vulnerabilities

According to its version, the Foxit Reader application installed on the remote Windows host is prior to 10.0.1. It is, therefore affected by multiple vulnerabilities: Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. C...

DaviewIndy Memory Misreference Vulnerability

DaViewIndy is a server-based viewer software. A security vulnerability exists in DaviewIndy 8.98.7 and earlier versions. An attacker can exploit the vulnerability to execute arbitrary code via specially crafted files...

DaviewIndy Heap Buffer Overflow Vulnerability

DaViewIndy is a server-based viewer software. A heap buffer overflow vulnerability exists in DaviewIndy 8.98.7 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary code via specially crafted files...

UAF Vulnerability in CAJViewer 7.3

CAJViewer is a specialized viewer for reading and editing literature in the CNKI series of databases. CAJViewer 7.3 suffers from a UAF vulnerability that can be exploited by attackers to cause a denial of service...

Arbitrary Code Execution

Overview shiba is a Live markdown previewer with linter Affected versions of this package are vulnerable to Arbitrary Code Execution due to the default usage of the function load of the package js-yaml instead of its secure replacement , safeLoad. Remediation There is no fixed version for shiba...

The vulnerabilities of PDF viewing and editing programs like Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, Adobe Acrobat 2015, Adobe Acrobat Reader 2015 are related to security exploits that allow attackers to escalate their privileges within the context of the current user.

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015 are related to bypassing security features. Exploiting these vulnerabilities can allow attackers...

Denial of service vulnerability exists in wpsphoto (CNVD-2020-48547)

wpsphoto is a picture viewing program. A denial of service vulnerability exists in wpsphoto, which can be exploited by an attacker to cause the server to deny service...

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015/Reader 2015 involve reading beyond the buffer in memory, allowing attackers to gain unauthorized access to protected information.

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015 are related to reading data beyond the buffer in memory. Exploiting these vulnerabilities can...

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015/Reader 2015 involve reading beyond the buffer in memory, allowing attackers to gain unauthorized access to protected information.

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015 are related to reading data beyond the buffer in memory. Exploiting these vulnerabilities can...

Marked-tree path traversal vulnerability

Marked-tree is a Markdown viewer. A path traversal vulnerability exists in fs.readFile in the index.js file in marked-tree all versions, which stems from the program's failure to clean up paths, and can be exploited by an attacker to gain unauthorized access and overwrite or read arbitrary files...

Intranda Goobi Viewer Core Path Traversal Vulnerability

Intranda Goobi Viewer Core is a Web-based digital library system from Intranda, Germany. A path traversal vulnerability exists in Intranda Goobi Viewer Core versions prior to 4.8.3. A remote attacker could exploit this vulnerability to access files on the server...

Security Bulletin: CVE-2014-3524 CSV Injection in reports

Summary Cells in csv reports need to sanitize for legacy CSV Injection concerns. Vulnerability Details Third Party Entry: PSIRT-ADV0017245 DESCRIPTION: Created from Advisory: ADV0017245 CVSS Base score: 8.1 CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products and Versions...

[SECURITY] Fedora 32 Update: podofo-0.9.6-12.fc32

PoDoFo is a library to work with the PDF file format. The name comes from the first letter of PDF Portable Document Format. A few tools to work with PDF files are already included in the PoDoFo package. The PoDoFo library is a free, portable C++ library which includes classes to parse PDF files a...

CVE-2020-15126

In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object...

GraphQL: Security breach on Viewer query

Impact An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object. Patches This vulnerability has been patched in Parse Server 4.3.0. Workarounds No References See commit...

GHSA-236H-RQV8-8Q73 GraphQL: Security breach on Viewer query

Impact An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object. Patches This vulnerability has been patched in Parse Server 4.3.0. Workarounds No References See commit...