Advisories

NEC EXPRESSCLUSTER X Disk Agent 0x104 Stack Overflow Vulnerability

OCTOBER 31, 2021

EIP-8b0cfb43 A stack-based buffer overflow has been found in NEC EXPRESSCLUSTER X that can lead to remote arbitrary code execution with full SYSTEM privileges. The Disk Agent (clpdiskagent.exe) is the component that is tasked...

Read More

NEC EXPRESSCLUSTER X Disk Agent 0x103 Stack Overflow Vulnerability

OCTOBER 31, 2021

EIP-ff1ca610 A stack-based buffer overflow has been found in NEC EXPRESSCLUSTER X that can lead to remote arbitrary code execution with full SYSTEM privileges. The Disk Agent (clpdiskagent.exe) is the component that is tasked...

Read More

SolarWinds Serv-u File Server Command Injection Vulnerability

SEPTEMBER 27, 2021

EIP-d3400c52 The Serv-U File Server supports site specific commands which may not be universally supported by all FTP clients. Among these is the SITE EXEC command which allows a user to execute programs and scripts...

Read More

McAfee DLP Agent Stack Buffer Overflow Remote Code Execution Vulnerability

SEPTEMBER 17, 2021

EIP-035220ca The vulnerability affects both Data Loss Prevention (DLP) Endpoint for Windows and the DLP Discover products from McAfee. The vulnerability is present within the included lasr.dll module, which is part of the Keyview SDK3...

Read More

Adobe Acrobat Reader Base URI Unicode String Heap Buffer Overflow Vulnerability

SEPTEMBER 17, 2021

EIP-47ea5148 A heap buffer overflow vulnerability exists in the IA32.api module of Adobe Acrobat and Acrobat Reader DC. Upon parsing a specially crafted PDF document containing URI entries with URI dictionaries and a specially...

Read More

Foxit PhantomPDF ConvertToPDF Arbitrary File Write Remote Code Execution Vulnerability

AUGUST 24, 2021

EIP-884255a1 The vulnerability exists within an RPC interface listening on TCP port 6000, exposed by Foxit PhantomPDF. The ConvertToPDF method of the Creator object does not properly validate the bstrDestPathName argument, allowing arbitrary files...

Read More

Foxit PhantomPDF CombineFiles Arbitrary File Write Remote Code Execution Vulnerability

AUGUST 24, 2021

EIP-adf3136a The vulnerability exists within an RPC interface listening on TCP port 6000, exposed by Foxit PhantomPDF. The CombineFiles method of the Creator object does not properly validate the DestPDFFile argument, allowing arbitrary files...

Read More

Foxit PhantomPDF ConnectedPDF DocSearch_Locator_Table SQL Injection Remote Code Execution Vulnerability

AUGUST 24, 2021

EIP-68b878c6 The vulnerability exists within the ConnectedPDF service, implemented by the FoxitPhantomConnectedPDFService.exe binary. The service listens for connections on TCP port 44440 on localhost and fails to sanitize input data before using it to...

Read More

Foxit PhantomPDF ConnectedPDF ConnectedPDF_DRM_Table SQL Injection Remote Code Execution Vulnerability

AUGUST 24, 2021

EIP-962d432f The vulnerability exists within the ConnectedPDF service, implemented by the FoxitPhantomConnectedPDFService.exe binary. The service listens for connections on TCP port 44440 on localhost and fails to sanitize input data before using it to...

Read More

Foxit PhantomPDF ConnectedPDF DocUpdate_Notify_Table SQL Injection Remote Code Execution Vulnerability

AUGUST 24, 2021

EIP-6eceec3d The vulnerability exists within the ConnectedPDF service, implemented by the FoxitPhantomConnectedPDFService.exe binary. The service listens for connections on TCP port 44440 on localhost and fails to sanitize input data before using it to...

Read More