CVE-2022-28303

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.16.02.022. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2022-43625

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43628

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-42428

CVE-2022-42428 affects Centreon (Centreon poller broker configuration handling). The root cause is improper validation of a user-supplied string used to construct SQL queries, enabling privilege escalation from normal user to administrator with network access and no user interaction. Authenticati...

CVE-2022-42426

This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of requests to modify poller broker configuration. The issue results from the lack of...

CVE-2022-36977

CVE-2022-36977 affects Ivanti Avalanche 6.3.2.3490. The vulnerability lies in the Certificate Management Server service, where improper validation of untrusted input enables deserialization, allowing remote code execution in the service account context. Authentication is required but can be bypas...

CVE-2022-43634

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dsiwriteinit function. The issue results from the lack of proper validation of the length o...

CVE-2022-37376

CVE-2022-37376 affects Foxit PDF Editor 11.1.1.53537. The flaw lies in the handling of arrays, where actions in JavaScript can trigger a read past the end of an allocated object, enabling sensitive information disclosure. User interaction is required (target must visit a malicious page or open a ...

CVE-2022-42427

CVE-2022-42427 affects Centreon. A SQL injection in the contact groups configuration page, due to unvalidated user input used to build SQL queries, allows remote attackers with authentication to escalate privileges to administrator. Root cause: improper validation of a user-supplied string affect...

CVE-2022-37352

PDF-XChange Editor is affected by a WMF parsing flaw that can trigger a read past the end of an allocated buffer. This vulnerability may allow remote disclosure of sensitive information and, when combined with other vulnerabilities, could enable arbitrary code execution in the context of the curr...

CVE-2022-43621

CVE-2022-43621 affects D-Link DIR-1935 router firmware 1.03. The root cause is an incorrectly implemented comparison in the HNAP login handling, allowing network-adjacent attackers to bypass authentication. Impact is authentication bypass with high confidentiality/integrity/availability risk as p...

CVE-2022-36974

Ivanti Avalanche 6.3.2.3490 is affected by a Web File Server deserialization vulnerability that leads to remote code execution with the service account. The issue stems from improper validation of untrusted data, allowing an attacker to bypass authentication and trigger code execution over the ne...

CVE-2022-28319

Bentley MicroStation CONNECT 10.16.02.034 is affected. The vulnerability originates from the 3DM file parser, where memory is not properly initialized before access, enabling arbitrary code execution. An attacker must lure a user to visit a malicious page or open a malicious file, after which cod...

CVE-2022-43611

CVE-2022-43611 affects CorelDRAW Graphics Suite 23.5.0.506. The root cause is a BMP image parsing flaw that fails to validate user-supplied data, causing a read past the end of an allocated object. This results in information disclosure and, per the initial description, can be leveraged with othe...

CVE-2022-43627

CVE-2022-43627 affects D-Link DIR-1935 with firmware 1.03. The flaw: during SetStaticRouteIPv4Settings handling, parsing of StaticRouteIPv4Data does not validate a user-supplied string before a system call, enabling remote code execution with root privileges for network-adjacent attackers; authen...

CVE-2022-37364

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...

CVE-2022-37363

PDF-XChange Editor is affected by an EMF parsing bug that can trigger a read past the end of an allocated buffer, allowing remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a crafted file). The vulnerability is documented across multiple sources (...

CVE-2022-43618

CorelDRAW Graphics Suite 23.5.0.506 is affected by a buffer/write past end vulnerability in the PCX file parsing code. The flaw arises from insufficient validation of user-supplied data, enabling an out-of-bounds write that can allow remote code execution in the context of the current process. Ex...

CVE-2022-28306

Bentley MicroStation CONNECT 10.16.02.034 is affected by a CVE-2022-28306 vulnerability in OBJ file parsing. The issue stems from insufficient validation of the length of user-supplied data prior to copying to a fixed-length stack buffer, enabling remote code execution within the current process ...

CVE-2022-28320

CVE-2022-28320 affects Bentley View 10.16.02.022. The issue lies in parsing 3DM files where memory is not properly initialized before access, enabling an attacker to execute code in the context of the current process with user interaction required (visit a malicious page or open a malicious file)...