CVE-2007-0045

Multiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2, for Mozilla Firefox, Microsoft Internet Explorer 6 SP1, Google Chrome, Opera 8.5.4 build 770, and Opera 9.10.8679 on Windows allow remote attackers to inject arbitrary JavaScript and conduct other attacks via a .pdf URL with a javascript: or res: URI with (1) FDF, (2) XML, and (3) XFDF AJAX parameters, or (4) an arbitrarily named name=URI anchor identifier, aka "Universal XSS (UXSS)."

• CWE-79

• http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf
• http://googlechromereleases.blogspot.com/2009/01/stable-beta-update-yahoo-mail-and.html
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
• http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html
• http://secunia.com/advisories/23483Vendor Advisory
• http://secunia.com/advisories/23691Vendor Advisory
• http://secunia.com/advisories/23812Vendor Advisory
• http://secunia.com/advisories/23877Vendor Advisory
• http://secunia.com/advisories/23882Vendor Advisory
• http://secunia.com/advisories/24457Vendor Advisory
• http://secunia.com/advisories/24533Vendor Advisory
• http://secunia.com/advisories/33754Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200701-16.xml
• http://securityreason.com/securityalert/2090
• http://securitytracker.com/id?1017469
• http://securitytracker.com/id?1023007
• http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102847-1
• http://www.adobe.com/support/security/advisories/apsa07-01.htmlVendor Advisory
• http://www.adobe.com/support/security/advisories/apsa07-02.html
• http://www.adobe.com/support/security/bulletins/apsb07-01.html
• http://www.adobe.com/support/security/bulletins/apsb09-15.html
• http://www.disenchant.ch/blog/hacking-with-browser-plugins/34Exploit
• http://www.gnucitizen.org/blog/danger-danger-danger/Exploit, Vendor Advisory
• http://www.gnucitizen.org/blog/universal-pdf-xss-after-party
• http://www.kb.cert.org/vuls/id/815960Third Party Advisory, US Government Resource
• http://www.mozilla.org/security/announce/2007/mfsa2007-02.html
• http://www.redhat.com/support/errata/RHSA-2007-0021.html
• http://www.securityfocus.com/archive/1/455790/100/0/threadedExploit
• http://www.securityfocus.com/archive/1/455800/100/0/threaded
• http://www.securityfocus.com/archive/1/455801/100/0/threaded
• http://www.securityfocus.com/archive/1/455831/100/0/threadedExploit
• http://www.securityfocus.com/archive/1/455836/100/0/threaded
• http://www.securityfocus.com/archive/1/455906/100/0/threaded
• http://www.securityfocus.com/bid/21858
• http://www.us-cert.gov/cas/techalerts/TA09-286B.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2007/0032Vendor Advisory
• http://www.vupen.com/english/advisories/2007/0957Vendor Advisory
• http://www.vupen.com/english/advisories/2009/2898Vendor Advisory
• http://www.wisec.it/vulns.php?page=9Exploit, Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31271
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6487
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9693
• https://rhn.redhat.com/errata/RHSA-2007-0017.html
• http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf
• http://googlechromereleases.blogspot.com/2009/01/stable-beta-update-yahoo-mail-and.html
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
• http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html
• http://secunia.com/advisories/23483Vendor Advisory
• http://secunia.com/advisories/23691Vendor Advisory
• http://secunia.com/advisories/23812Vendor Advisory
• http://secunia.com/advisories/23877Vendor Advisory
• http://secunia.com/advisories/23882Vendor Advisory
• http://secunia.com/advisories/24457Vendor Advisory
• http://secunia.com/advisories/24533Vendor Advisory
• http://secunia.com/advisories/33754Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200701-16.xml
• http://securityreason.com/securityalert/2090
• http://securitytracker.com/id?1017469
• http://securitytracker.com/id?1023007
• http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102847-1
• http://www.adobe.com/support/security/advisories/apsa07-01.htmlVendor Advisory
• http://www.adobe.com/support/security/advisories/apsa07-02.html
• http://www.adobe.com/support/security/bulletins/apsb07-01.html
• http://www.adobe.com/support/security/bulletins/apsb09-15.html
• http://www.disenchant.ch/blog/hacking-with-browser-plugins/34Exploit
• http://www.gnucitizen.org/blog/danger-danger-danger/Exploit, Vendor Advisory
• http://www.gnucitizen.org/blog/universal-pdf-xss-after-party
• http://www.kb.cert.org/vuls/id/815960Third Party Advisory, US Government Resource
• http://www.mozilla.org/security/announce/2007/mfsa2007-02.html
• http://www.redhat.com/support/errata/RHSA-2007-0021.html
• http://www.securityfocus.com/archive/1/455790/100/0/threadedExploit
• http://www.securityfocus.com/archive/1/455800/100/0/threaded
• http://www.securityfocus.com/archive/1/455801/100/0/threaded
• http://www.securityfocus.com/archive/1/455831/100/0/threadedExploit
• http://www.securityfocus.com/archive/1/455836/100/0/threaded
• http://www.securityfocus.com/archive/1/455906/100/0/threaded
• http://www.securityfocus.com/bid/21858
• http://www.us-cert.gov/cas/techalerts/TA09-286B.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2007/0032Vendor Advisory
• http://www.vupen.com/english/advisories/2007/0957Vendor Advisory
• http://www.vupen.com/english/advisories/2009/2898Vendor Advisory
• http://www.wisec.it/vulns.php?page=9Exploit, Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31271
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6487
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9693
• https://rhn.redhat.com/errata/RHSA-2007-0017.html

Published

Jan 3, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-0039The Exchange Collaboration Data Objects (EXCDO) functionalit…
• CVE-2007-0040The LDAP service in Windows Active Directory in Microsoft Wi…
• CVE-2007-0041The PE Loader service in Microsoft .NET Framework 1.0, 1.1, …
• CVE-2007-0042Interpretation conflict in ASP.NET in Microsoft .NET Framewo…
• CVE-2007-0043The Just In Time (JIT) Compiler service in Microsoft .NET Fr…
• CVE-2007-0044Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, In…
• CVE-2007-0046Double free vulnerability in the Adobe Acrobat Reader Plugin…
• CVE-2007-0047CRLF injection vulnerability in Adobe Acrobat Reader Plugin …
• CVE-2007-0048Adobe Acrobat Reader Plugin before 8.0.0, and possibly the p…
• CVE-2007-0049Geckovich TaskTracker Pro 1.5 and earlier allows remote atta…
• CVE-2007-0050PHP remote file inclusion vulnerability in index.php in Open…
• CVE-2007-0051Format string vulnerability in Apple iPhoto 6.0.5 (316), and…