CyberAlerts

CVE-2025-21159

Description: Illustrator versions 29.1, 28.7.3 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS: HIGH (7.8)

EPSS Score: 0.05%

Source: CVE

February 12th, 2025 (5 months ago)

CVE-2025-21158

InDesign Desktop | Integer Underflow (Wrap or Wraparound) (CWE-191)

Description: InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS: HIGH (7.8)

EPSS Score: 0.07%

Source: CVE

February 12th, 2025 (5 months ago)

CVE-2025-21157

InDesign Desktop | Out-of-bounds Write (CWE-787)

Description: InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS: HIGH (7.8)

EPSS Score: 0.07%

Source: CVE

February 12th, 2025 (5 months ago)

CVE-2025-21156

InCopy | Integer Underflow (Wrap or Wraparound) (CWE-191)

Description: InCopy versions 20.0, 19.5.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS: HIGH (7.8)

EPSS Score: 0.05%

Source: CVE

February 12th, 2025 (5 months ago)

CVE-2025-21123

InDesign Desktop | Heap-based Buffer Overflow (CWE-122)

Description: InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS: HIGH (7.8)

EPSS Score: 0.1%

Source: CVE

February 12th, 2025 (5 months ago)

CVE-2025-21121

InDesign Desktop | Out-of-bounds Write (CWE-787)

Description: InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS: HIGH (7.8)

EPSS Score: 0.07%

Source: CVE

February 12th, 2025 (5 months ago)

CVE-2025-1240

WinZip 7Z File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Description: WinZip 7Z File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of WinZip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 7Z files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24986.

CVSS: HIGH (7.8)

EPSS Score: 0.04%

Source: CVE

February 12th, 2025 (5 months ago)

CVE-2025-1143

Billion Electric M120N - Use of Hard-coded Credentials

Description: Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system.

CVSS: HIGH (8.4)

EPSS Score: 0.04%

Source: CVE

February 12th, 2025 (5 months ago)

CVE-2025-1052

Mintty Sixel Image Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Description: Mintty Sixel Image Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mintty. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of sixel images. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-23382.

CVSS: HIGH (8.8)

EPSS Score: 0.09%

Source: CVE

February 12th, 2025 (5 months ago)

CVE-2025-0910

PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Description: PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25748.

CVSS: HIGH (7.8)

EPSS Score: 0.09%

Source: CVE

February 12th, 2025 (5 months ago)

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2025-21159	Illustrator \| Use After Free (CWE-416) Description: Illustrator versions 29.1, 28.7.3 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. CVSS: HIGH (7.8) EPSS Score: 0.05% Source: CVE February 12th, 2025 (5 months ago)
CVE-2025-21158	InDesign Desktop \| Integer Underflow (Wrap or Wraparound) (CWE-191) Description: InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. CVSS: HIGH (7.8) EPSS Score: 0.07% Source: CVE February 12th, 2025 (5 months ago)
CVE-2025-21157	InDesign Desktop \| Out-of-bounds Write (CWE-787) Description: InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. CVSS: HIGH (7.8) EPSS Score: 0.07% Source: CVE February 12th, 2025 (5 months ago)
CVE-2025-21156	InCopy \| Integer Underflow (Wrap or Wraparound) (CWE-191) Description: InCopy versions 20.0, 19.5.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. CVSS: HIGH (7.8) EPSS Score: 0.05% Source: CVE February 12th, 2025 (5 months ago)
CVE-2025-21123	InDesign Desktop \| Heap-based Buffer Overflow (CWE-122) Description: InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. CVSS: HIGH (7.8) EPSS Score: 0.1% Source: CVE February 12th, 2025 (5 months ago)
CVE-2025-21121	InDesign Desktop \| Out-of-bounds Write (CWE-787) Description: InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. CVSS: HIGH (7.8) EPSS Score: 0.07% Source: CVE February 12th, 2025 (5 months ago)
CVE-2025-1240	WinZip 7Z File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability Description: WinZip 7Z File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of WinZip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 7Z files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24986. CVSS: HIGH (7.8) EPSS Score: 0.04% Source: CVE February 12th, 2025 (5 months ago)
CVE-2025-1143	Billion Electric M120N - Use of Hard-coded Credentials Description: Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system. CVSS: HIGH (8.4) EPSS Score: 0.04% Source: CVE February 12th, 2025 (5 months ago)
CVE-2025-1052	Mintty Sixel Image Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability Description: Mintty Sixel Image Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mintty. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of sixel images. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-23382. CVSS: HIGH (8.8) EPSS Score: 0.09% Source: CVE February 12th, 2025 (5 months ago)
CVE-2025-0910	PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability Description: PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25748. CVSS: HIGH (7.8) EPSS Score: 0.09% Source: CVE February 12th, 2025 (5 months ago)