CVE-2022-37387

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.2.53575. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2022-43623

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43642

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the YouTube plugin for the xupnpd service, which listens on TC...

CVE-2022-36982

This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the AgentTaskHandle...

CVE-2022-28686

Affected product: AVEVA Edge 2020 SP2 Patch 0 (4201.2111.1802.0000). Vulnerability in APP file handling where the process loads a library from an unsecured location, enabling arbitrary code execution with the user’s context after user interaction (malicious page/file). CVSS 3.1/3.0 base score 7.8...

CVE-2022-2848

CVE-2022-2848 affects Kepware KEPServerEX 6.11.718.0. A heap-based buffer overflow occurs during handling of text encoding conversions due to improper length validation of user-supplied data, allowing remote code execution in the context of SYSTEM. The vulnerability is network-exploitable with no...

CVE-2022-43640

The vulnerability CVE-2022-43640 affects Foxit PDF Reader 12.0.1.12430. The flaw is in PDF parsing: crafted data in a PDF can trigger a read past the end of an allocated buffer. This may allow information disclosure and, in conjunction with other issues, could enable arbitrary code execution in t...

CVE-2022-43639

Foxit PDF Reader 12.0.1.12430 is affected by CVE-2022-43639 due to improper handling of U3D files. The flaw arises from not validating object existence before operations, enabling remote code execution when a user opens a malicious file or visits a malicious page. Exploitation requires user inter...

CVE-2022-43631

CVE-2022-43631 affects D-Link DIR-1935 (firmware 1.03). The bug is in the web portal’s SetVirtualServerSettings handling, where parsing subelements of VirtualServerInfo does not properly validate a user-supplied string before it is used to execute a system call. This enables network-adjacent atta...

CVE-2022-28312

The CVE-2022-28312 issue affects Bentley MicroStation CONNECT 10.16.02.034, with a flaw in 3DS file parsing that can trigger a read past the end of an allocated buffer. This leads to information disclosure and, in conjunction with other vulnerabilities, may allow arbitrary code execution in the a...

CVE-2022-37360

CVE-2022-37360 affects PDF-XChange Editor. The vulnerability stems from EMF file parsing, where crafted EMF data can trigger a read past the end of an allocated buffer. This can disclose sensitive information and, when combined with other vulnerabilities, may allow arbitrary code execution in the...

CVE-2022-43632

CVE-2022-43632 affects D-Link DIR-1935 firmware 1.03. The flaw is in SetQoSSettings QoSInfo parsing: unvalidated user-supplied data is used in a system call, allowing network-adjacent attackers to achieve code execution as root. Exploitation details are documented by ZDI (ZDI-22-1504) and other f...

CVE-2022-37365

CVE-2022-37365 affects PDF-XChange Editor. The flaw is in the saveAs method where the application exposes a JavaScript interface that allows writing arbitrary files, enabling an attacker to execute arbitrary code in the context of the current user. Exploitation requires user interaction (visiting...

CVE-2022-43620

CVE-2022-43620 affects D-Link DIR-1935, version 1.03. The issue is an authentication bypass in the HNAP login handling, caused by improper authentication implementation. This enables network-adjacent attackers to bypass authentication on affected routers. Documented references include ZDI-22-1494...

CVE-2022-37373

PDF-XChange Editor is affected by CVE-2022-37373 due to a parsing flaw in PDF files that can trigger a read past the end of an allocated buffer. This can lead to information disclosure and, when combined with other vulnerabilities, may enable arbitrary code execution in the context of the current...

CVE-2022-37385

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2022-43608

CVE-2022-43608 affects Canon imageCLASS MF644Cdw 10.03 with a BJNP service input validation flaw that can overflow a buffer, allowing network-adjacent attackers to execute code with root privileges, unauthenticated. Exploitation details are documented across multiple sources (ZDI advisory and Red...

CVE-2022-28301

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

CVE-2022-36983

Ivanti Avalanche is affected by an authentication bypass in the SetSettings class. The issue allows remote attackers with network access to bypass authentication and access features without prior login. The core detail across sources is that the vulnerability stems from lack of authentication bef...

CVE-2022-43643

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Generic plugin for the xupnpd service, which listens on TC...