WaratekVRT Sign in

Com.itextpdf CVEs with no public exploit

5 CVEs, 2 protected by Waratek

Reset
More filters (1)
Columns
Vendor com.itextpdf✕
Overview 5 matches · 2 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
5matches 2protected40.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 40.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 3 60.0%
Critical 2 40.0% High 0 0.0% Medium 3 60.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 40.0% partly blocked 0 0.0% not blocked 3 60.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 5 100.0%
split by peak 3 / month
No exploit published: 3Protected by Waratek: 2 Medium: 3Critical: 2 not blocked: 3blocked by ARMR today: 2 No public exploit: 5
Dec 211 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Jan 220 Feb 223 No exploit published3 Medium3 not blocked3 No public exploit3 Mar 220 Apr 220 May 220 Jun 220 Jul 220 Aug 220 Sep 220 Oct 220 Nov 220 Dec 221 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1
Dec 21Feb 22Apr 22Jun 22Aug 22Oct 22Dec 22
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2017-20151 Critical 2022-12-30 Protected by Waratek No public exploit A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/XfaFile.java. The manipulation leads to xml external entity reference. The patch is identified as ac5590925874ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability.
CVE-2022-24198 Medium 2022-02-01 No exploit published No public exploit iText v7.1.17 was discovered to contain an out-of-bounds exception via the component ARCFOUREncryption.encryptARCFOUR, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. NOTE: Vendor does not view this as a vulnerability and has not found it to be exploitable.
CVE-2022-24197 Medium 2022-02-01 No exploit published No public exploit iText v7.1.17 was discovered to contain a stack-based buffer overflow via the component ByteBuffer.append, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
CVE-2022-24196 Medium 2022-02-01 No exploit published No public exploit iText v7.1.17, up to (exluding)": 7.1.18 and 7.2.2 was discovered to contain an out-of-memory error via the component readStreamBytesRaw, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
CVE-2021-43113 Critical 2021-12-15 Protected by Waratek No public exploit iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.