CVE-2022-37378

CVE-2022-37378 affects Foxit PDF Editor 11.1.1.53537. The flaw is in the optimization of JavaScript functions, caused by not validating the existence of an object before performing operations, enabling arbitrary code execution when a user visits a malicious page or opens a malicious file. Descrip...

CVE-2022-37374

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...

CVE-2022-37382

CVE-2022-37382 affects Foxit PDF Reader 11.2.1.53537 (and related Foxit/Editor variants). The root cause is a missing validation of an object before performing operations in removeIcon, allowing information disclosure and, with additional vulnerabilities, potential arbitrary code execution in the...

CVE-2022-37356

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...

CVE-2022-43647

CVE-2022-43647 affects D-Link DIR-825 routers (versions 1.0.9/EE). The vulnerability in the xupnpd service listens on TCP port 4044 and stems from improper validation of a user-supplied string before it’s used to execute a system call. This allows network-adjacent attackers (no authentication req...

CVE-2022-2560

This vulnerability allows remote attackers to delete arbitrary files on affected installations of EnterpriseDT CompleteFTP 22.1.0 Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HttpFile class. The issue results from the lack of proper...

CVE-2022-43615

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Corel CorelDRAW Graphics Suite 23.5.0.506. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific fla...

CVE-2022-36980

This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-42430

This vulnerability allows local attackers to escalate privileges on affected Tesla vehicles. An attacker must first obtain the ability to execute privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the wowlanconfig data...

CVE-2022-37369

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...

CVE-2022-43636

TP-Link TL-WR940N (version 3.20.1(US)) is affected by CVE-2022-43636. The httpd service on port 80 uses insufficiently random session identifiers, enabling network-adjacent attackers to bypass authentication. Impact is authenticated bypass with high severity; no exploit details provided in the so...

CVE-2022-37391

Foxit PDF Reader 11.2.2.53575 is affected; exploit arises in AcroForms handling due to not validating object existence before operations, enabling remote code execution in the process with user interaction (visiting a malicious page or opening a malicious file). No remediation details are provide...

CVE-2022-37388

CVE-2022-37388 affects Foxit PDF Reader 11.2.2.53575. The flaw is in PDF parsing where crafted data can trigger a read past the end of an allocated buffer, allowing remote code execution in the context of the current process. User interaction is required (visiting a malicious page or opening a ma...

CVE-2022-37367

PDF-XChange Editor is affected by CVE-2022-37367 due to an AcroForms handling flaw that can trigger a read past the end of an allocated buffer, enabling remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious file). The vulnerability is desc...

CVE-2022-37362

CVE-2022-37362 affects PDF-XChange Editor. The root cause is a buffer over-read/write in the PNG parsing path that can trigger arbitrary code execution when a user opens a malicious PNG or visits a malicious page, with exploitation requiring user interaction. Connected documents confirm the vulne...

CVE-2022-37349

CVE-2022-37349 concerns PDF-XChange Editor. The issue is a buffer over-read in the submitForm method that can be triggered via JavaScript when a user visits a malicious page or opens a malicious file, allowing remote code execution in the context of the current process. Details come from ZDI-22-1...

CVE-2022-37361

The CVE-2022-37361 issue affects PDF-XChange Editor and stems from JP2 file parsing. A crafted JP2 payload can trigger a read past the end of an allocated buffer, enabling information disclosure. Exploitation requires user interaction (visiting a malicious page or opening a malicious file), and, ...

CVE-2022-37387

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.2.53575. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2022-37369

CVE-2022-37369 affects PDF-XChange Editor. Connected sources confirm a PDF parsing flaw that can trigger a write past the end of an allocated buffer, enabling remote code execution when a user opens a malicious PDF or visits a malicious page. The vulnerability requires user interaction. Root caus...

CVE-2022-37368

PDF-XChange Editor contains a vulnerability (CVE-2022-37368) in the handling of Doc objects that can disclose sensitive information. The flaw allows an attacker to trigger a read past the end of an allocated object by performing JavaScript actions, requiring user interaction, and could be leverag...