The default configuration of Adobe Reader and Acrobat 9.x before 9.3 and 8.x before 8.2 on Windows and Mac OS X does not enable the Enhanced Security feature which has unspecified impact and attack vectors related to a \script injection vulnerability \ as demonstrated by Acrobat Forms Data Format (FDF) behavior that allows cross-site scripting (XSS) by user-assisted remote attackers.