CVE-2021-33794

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 allow information disclosure or an application crash after mishandling the Tab key during XFA form interaction.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.foxitsoftware.com/support/security-bulletins.htmlPatch, Vendor Advisory
https://www.foxitsoftware.com/support/security-bulletins.htmlPatch, Vendor Advisory

Timeline

Published: Aug 11, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-337955.5Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 produce incorrect PDF document signatures because the certificate name, document own CVE-2021-337967.5In MuJS before version 1.1.2, a use-after-free flaw in the regexp source property access may cause denial of service.CVE-2021-337979.8Buffer-overflow in jsdtoa.c in Artifex MuJS in versions 1.0.1 to 1.1.1. An integer overflow happens when js_strtod() reads in floating point CVE-2021-337986.5A null pointer dereference was found in libpano13, version libpano13-2.9.20. The flow allows attackers to cause a denial of service and pote CVE-2021-33806.5Insecure direct object reference (IDOR) vulnerability in ICREM H8 SSRMS allows attackers to disclose sensitive information via the Print Inv CVE-2021-338007.5In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal.CVE-2021-338069.8The BDew BdLib library before 1.16.1.7 for Minecraft allows remote code execution because it deserializes untrusted data in ObjectInputStrea CVE-2021-338077.5Cartadis Gespage through 8.2.1 allows Directory Traversal in gespage/doDownloadData and gespage/webapp/doDownloadData.CVE-2021-338137.5An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.CVE-2021-338158.8dwa_uncompress in libavcodec/exr.c in FFmpeg 4.4 allows an out-of-bounds array access because dc_count is not strictly checked.CVE-2021-338169.8The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system CVE-2021-338187.5An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67. Attackers can use slowhttptest tool to send incomplete HTTP