Home > Vulnerability Database > CVE-2007-0045

Mend.io Vulnerability Database

CVE-2007-0045

Date: January 3, 2007

Multiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2, for Mozilla Firefox, Microsoft Internet Explorer 6 SP1, Google Chrome, Opera 8.5.4 build 770, and Opera 9.10.8679 on Windows allow remote attackers to inject arbitrary JavaScript and conduct other attacks via a .pdf URL with a javascript: or res: URI with (1) FDF, (2) XML, and (3) XFDF AJAX parameters, or (4) an arbitrarily named name=URI anchor identifier, aka "Universal XSS (UXSS)."

Severity Score

3.7

Related Resources (47)

Url: http://www.redhat.com/support/errata/RHSA-2007-0021.html

Url: http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html

Url: http://www.securityfocus.com/archive/1/455831/100/0/threaded

Url: http://securityreason.com/securityalert/2090

Url: http://www.gnucitizen.org/blog/danger-danger-danger/

Url: http://www.us-cert.gov/cas/techalerts/TA09-286B.html

Url: https://rhn.redhat.com/errata/RHSA-2007-0017.html

Url: http://www.vupen.com/english/advisories/2007/0032

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2007-0045

Url: http://www.mozilla.org/security/announce/2007/mfsa2007-02.html

Url: http://www.adobe.com/support/security/advisories/apsa07-01.html

Url: http://www.securityfocus.com/archive/1/455836/100/0/threaded

Url: http://securitytracker.com/id?1017469

Url: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9693

Url: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6487

Url: http://secunia.com/advisories/23877

Url: http://www.securityfocus.com/archive/1/455790/100/0/threaded

Url: http://sunsolve.sun.com/search/document.do?assetkey=1-26-102847-1

Url: http://secunia.com/advisories/23812

Url: https://nvd.nist.gov/vuln/detail/CVE-2007-0045

Url: http://www.disenchant.ch/blog/hacking-with-browser-plugins/34

Url: http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131

Url: http://secunia.com/advisories/23691

Url: http://www.adobe.com/support/security/advisories/apsa07-02.html

Url: http://www.securityfocus.com/archive/1/455906/100/0/threaded

Url: http://securitytracker.com/id?1023007

Url: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

Url: http://secunia.com/advisories/33754

Url: http://www.vupen.com/english/advisories/2009/2898

Url: http://www.securityfocus.com/bid/21858

Url: https://exchange.xforce.ibmcloud.com/vulnerabilities/31271

Url: http://security.gentoo.org/glsa/glsa-200701-16.xml

Url: http://googlechromereleases.blogspot.com/2009/01/stable-beta-update-yahoo-mail-and.html

Url: http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf

Url: http://secunia.com/advisories/24457

Url: http://www.adobe.com/support/security/bulletins/apsb09-15.html

Url: http://www.vupen.com/english/advisories/2007/0957

Url: http://www.securityfocus.com/archive/1/455800/100/0/threaded

Url: http://www.securityfocus.com/archive/1/455801/100/0/threaded

Url: http://www.adobe.com/support/security/bulletins/apsb07-01.html

Url: http://www.kb.cert.org/vuls/id/815960

Url: http://secunia.com/advisories/23483

Url: http://secunia.com/advisories/23882

Url: http://www.gnucitizen.org/blog/universal-pdf-xss-after-party

Url: http://www.wisec.it/vulns.php?page=9

Url: http://secunia.com/advisories/24533

Url: https://www.mend.io/vulnerability-database/CVE-2007-0045

Severity Score

3.7

Weakness Type (CWE)

Cross-Site Scripting (XSS)

CWE-79

CVSS v3.1

Base Score:	3.7
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	LOW
Availability (A):	NONE

CVSS v2

Base Score:	4.3
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	PARTIAL
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2007-0045

Date: January 3, 2007

Severity Score

Related Resources (47)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?