CVE-2018-19348

The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Data from Faulting Address controls Branch Selection starting at U3DBrowser!PlugInMain+0x000000000012dff5" issue.

• CWE-125

• https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/08/2018/11/2018-11-08/index.htmlBroken Link, Third Party Advisory
• https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/10/2018/11/2018-11-10/index.htmlBroken Link, Third Party Advisory
• https://yan-1-20.github.io/2018/11/08/2018/11/2018-11-08/Broken Link, Third Party Advisory
• https://yan-1-20.github.io/2018/11/10/2018/11/2018-11-10/Broken Link, Third Party Advisory
• https://www.foxitsoftware.com/support/security-bulletins.phpVendor Advisory
• https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/08/2018/11/2018-11-08/index.htmlBroken Link, Third Party Advisory
• https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/10/2018/11/2018-11-10/index.htmlBroken Link, Third Party Advisory
• https://yan-1-20.github.io/2018/11/08/2018/11/2018-11-08/Broken Link, Third Party Advisory
• https://yan-1-20.github.io/2018/11/10/2018/11/2018-11-10/Broken Link, Third Party Advisory

Published

Nov 17, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-19342The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in F…
• CVE-2018-19343The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in F…
• CVE-2018-19344The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in F…
• CVE-2018-19345The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in F…
• CVE-2018-19346The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in F…
• CVE-2018-19347The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in F…
• CVE-2018-19349In SeaCMS v6.64, there is SQL injection via the admin_makeht…
• CVE-2018-1935IBM Connections 5.0, 5.5, and 6.0 could allow an authenticat…4.3
• CVE-2018-19350In SeaCMS v6.6.4, there is stored XSS via the member.php?act…
• CVE-2018-19351Jupyter Notebook before 5.7.1 allows XSS via an untrusted no…
• CVE-2018-19352Jupyter Notebook before 5.7.2 allows XSS via a crafted direc…
• CVE-2018-19353The ansilove_ansi function in loaders/ansi.c in libansilove …