CVE-2021-44714

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a Violation of Secure Design Principles that could lead to a Security feature bypass. Acrobat Reader DC displays a warning message when a user clicks on a PDF file, which could be used by an attacker to mislead the user. In affected versions, this warning message does not include custom protocols when used by the sender. User interaction is required to abuse this vulnerability as they would need to click 'allow' on the warning message of a malicious file.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Jan 14, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-447155.5Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-boCVE-2021-447167.5net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/CVE-2021-447174.8Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a conseCVE-2021-447185.9wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic fCVE-2021-447198.4Docker Desktop 4.3.0 has Incorrect Access Control.CVE-2021-44726.5The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result inCVE-2021-447207.2In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "MainteCVE-2021-447257.5KNIME Server before 4.13.4 allows directory traversal in a request for a client profile.CVE-2021-447266.1KNIME Server before 4.13.4 allows XSS via the old WebPortal login page.CVE-2021-44739.8Tianxin Internet Behavior Management System contains a command injection vulnerability in the Reporter component endpoint that allows unauthCVE-2021-447308.8snapd 2.54.2 did not properly validate the location of the snap-confine binary. A local attacker who can hardlink this binary to another locCVE-2021-447317.8A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. This could allow a loc
CVE-2021-44714: Low severity, CVSS 3.3 | Vulnix