CVE-2022-37355

PDF-XChange Editor is affected by a vulnerability in the parsing of JPG files that can trigger a write-past-end of an allocated buffer, enabling remote code execution with the current process’s privileges after user interaction (visiting a malformed page or opening a malicious file). Evidence tie...

CVE-2022-43620

CVE-2022-43620 affects D-Link DIR-1935, version 1.03. The issue is an authentication bypass in the HNAP login handling, caused by improper authentication implementation. This enables network-adjacent attackers to bypass authentication on affected routers. Documented references include ZDI-22-1494...

CVE-2022-27645

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within readycloudcontrol.cgi. The issue results from the lack of authenticatio...

CVE-2022-28686

This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 04201.2111.1802.0000. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...

CVE-2022-37374

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...

CVE-2022-42431

This vulnerability allows local attackers to escalate privileges on affected Tesla vehicles. An attacker must first obtain the ability to execute privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the bcmdhd driver. The issue results from...

CVE-2022-43616

CVE-2022-43616 affects CorelDRAW Graphics Suite 23.5.0.506, due to an error in EMF image parsing that allows a read past the end of an allocated object. This can enable remote code execution with current process privileges and requires user interaction (visiting a malicious page or opening a mali...

CVE-2022-43626

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-28645

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...

CVE-2022-37360

This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2022-43625

CVE-2022-43625 affects D-Link DIR-1935 (firmware 1.03). The vulnerability lies in the NetMask handling inside the web management portal when processing SetStaticRouteIPv4Settings requests; the value is copied into a fixed-length stack buffer without proper length validation, enabling a stack-base...

CVE-2022-43633

This CVE affects D-Link DIR-1935 routers running v1.03. The underlying issue is a command injection in the web management portal: during parsing of the IPAddress field in SetSysLogSettings, input is insufficiently validated before being passed to a system call, allowing a network-adjacent attacke...

CVE-2022-43640

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 12.0.1.12430. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

CVE-2022-43626

CVE-2022-43626 affects the D-Link DIR-1935 (version 1.03). The flaw is in the web management SetIPv4FirewallSettings handling of IPv4FirewallRule elements, where a user-supplied string isn’t properly validated before it’s used in a system call, enabling arbitrary code execution in the root contex...

CVE-2022-28312

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific fla...

CVE-2022-43646

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Vimeo plugin for the xupnpd service, which listens on TCP...

CVE-2022-37391

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.2.53575. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2022-37350

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

CVE-2022-37366

PDF-XChange Editor is affected by CVE-2022-37366 due to a buffer/out-of-bounds read in the handling of Doc objects. The flaw can be triggered by JavaScript actions and requires user interaction (target visits a malicious page or opens a malicious file), potentially enabling remote code execution ...

CVE-2022-43643

CVE-2022-43643 concerns a remote command injection in the D-Link DIR-825 1.0.9/EE router. The flaw is in the xupnpd Generic plugin listening on TCP port 4044, arising from inadequate validation of user-supplied input used in a system call. This allows network-adjacent attackers to execute code wi...