CVE-2024-39426

ZDI-CAN-24312: Adobe Acrobat Reader DC Annotation Memory Corruption Remote Code Execution Vulnerability

Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2024-41831

ZDI-CAN-24569: Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability

Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS 3.2% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2024-41833

ZDI-CAN-24310: Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability

Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2024-41834

ZDI-CAN-24311: Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability

Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2024-33993

Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System

Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session details via the 'view' parameter in /candidate/index.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

School Event Management System

CVE-2024-33992

Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System

Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the 'view' parameter in '/student/index.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

School Event Management System

CVE-2024-33991

Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System

Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the 'view' parameter in '/eventwinner/index.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

School Event Management System

CVE-2024-33990

Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System

Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted javascript payload to an authenticated user and partially take over their browser session via the 'id' and 'view' parameters in '/user/index.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

School Event Management System

CVE-2024-33989

Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System

Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted javascript payload to an authenticated user and partially take over their browser session via the 'eventdate' and 'events' parameters in 'port/event_print.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

School Event Management System

CVE-2024-33985

Cross-Site Scripting (XSS) vulnerability in Janobe products

Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'View' parameter in '/course/index.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

School Attendence Monitoring System School Event Management System

CVE-2024-33986

Cross-Site Scripting (XSS) vulnerability in Janobe products

Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'View' parameter in '/department/index.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

School Attendence Monitoring System School Event Management System

CVE-2024-33987

Cross-Site Scripting (XSS) vulnerability in Janobe products

Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate', 'YearLevel', 'eventdate', 'events', 'Users' and 'YearLevel' parameters in '/report/index.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

School Attendence Monitoring System School Event Management System

CVE-2024-33988

Cross-Site Scripting (XSS) vulnerability in Janobe products

Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate' and 'YearLevel' parameters in '/report/attendance_print.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

School Attendence Monitoring System School Event Management System

CVE-2024-33984

Cross-Site Scripting (XSS) vulnerability in Janobe products

Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate' and 'YearLevel' parameters in '/AttendanceMonitoring/report/index.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

School Attendence Monitoring System School Event Management System

CVE-2024-33983

Cross-Site Scripting (XSS) vulnerability in Janobe products

Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate' and 'YearLevel' parameters in '/AttendanceMonitoring/report/attendance_print.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

School Attendence Monitoring System School Event Management System

CVE-2024-33982

Cross-Site Scripting (XSS) vulnerability in Janobe products

Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'StudentID' parameter in '/AttendanceMonitoring/student/controller.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

School Attendence Monitoring System School Event Management System

CVE-2024-33978

Cross-site Scripting in Janobe E-Negosyo System

Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session cookie details via 'category' parameter in '/index.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

Young Entrepreneur E-negosyo System

CVE-2024-33977

Cross-site Scripting in Janobe E-Negosyo System

Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session cookie details via 'view' parameter in /admin/orders/index.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

Young Entrepreneur E-negosyo System

CVE-2024-33976

Cross-site Scripting in Janobe E-Negosyo System

Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload to an authenticated user and partially take over their browser session via 'id' parameter in '/admin/user/index.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

Young Entrepreneur E-negosyo System

CVE-2024-33975

Cross-site Scripting in Janobe E-Negosyo System

Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload to an authenticated user and partially take over their browser session via 'view' parameter in '/admin/products/index.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

Young Entrepreneur E-negosyo System