Deserialization of untrusted data

This vulnerability allows remote attackers to execute arbitrary code on affected installations of OPC Labs QuickOPC 2022.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2022-42432

This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.2.53575. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2023-1393

A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client explicitly destroys the compositor overlay window aka COW, the Xserver would leave a dangling pointer to that window in the CompScreen structure, which will trigger a use-after-fr...

CVE-2022-42424

This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of requests to modify poller broker configuration. The issue results from the lack of...

CVE-2022-28308

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.16.02.022. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2022-36974

Ivanti Avalanche 6.3.2.3490 is affected by a Web File Server deserialization vulnerability that leads to remote code execution with the service account. The issue stems from improper validation of untrusted data, allowing an attacker to bypass authentication and trigger code execution over the ne...

CVE-2022-36980

CVE-2022-36980 affects Ivanti Avalanche 6.3.2.3490. The vulnerability is an authentication bypass in the EnterpriseServer service caused by lack of proper locking during authentication, enabling remote attackers to bypass authentication. Connected sources identify ZDI-22-785 and related advisorie...

CVE-2022-43637

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 12.0.1.12430. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2022-43644

CVE-2022-43644 affects D-Link DIR-825 routers (version 1.0.9/EE). The vulnerability originates in the Dreambox plugin for the xupnpd service, which listens on TCP port 4044. It stems from improper validation of a user-supplied string before it is used to execute a system call, allowing network-ad...

CVE-2022-37359

PDF-XChange Editor is affected by a J2K file parsing use-after-free vulnerability that allows remote code execution with user interaction (target must open a malicious file or visit a malicious page). The root cause is a lack of validation for the existence of objects before operations, enabling ...

CVE-2022-36973

This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the ProfileDaoImp...

CVE-2022-28309

Bentley View 10.16.02.022 is affected by a parsing flaw in 3DS files that can trigger an out-of-bounds read in the allocated buffer. The vulnerability, associated with ZDI-CAN-16308, requires user interaction (victim opens a malicious file/page). Exploitation could lead to arbitrary code executio...

CVE-2022-43647

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpd service, which listens on TCP port 4044. The issue...

CVE-2022-37360

CVE-2022-37360 affects PDF-XChange Editor. The vulnerability stems from EMF file parsing, where crafted EMF data can trigger a read past the end of an allocated buffer. This can disclose sensitive information and, when combined with other vulnerabilities, may allow arbitrary code execution in the...

CVE-2022-43627

CVE-2022-43627 affects D-Link DIR-1935 with firmware 1.03. The flaw: during SetStaticRouteIPv4Settings handling, parsing of StaticRouteIPv4Data does not validate a user-supplied string before a system call, enabling remote code execution with root privileges for network-adjacent attackers; authen...

CVE-2022-42430

This vulnerability allows local attackers to escalate privileges on affected Tesla vehicles. An attacker must first obtain the ability to execute privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the wowlanconfig data...

CVE-2022-43618

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Corel CorelDRAW Graphics Suite 23.5.0.506. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

CVE-2022-37383

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

CVE-2022-36979

CVE-2022-36979 affects Ivanti Avalanche 6.3.2.3490. The issue is a SQL injection in the AvalancheDaoSupport class that allows an attacker to bypass authentication by crafting a request that triggers SQL queries composed from user input. Descriptions in multiple sources (including ZDI-22-784 and r...