CVE-2022-43629

CVE-2022-43629 affects D-Link DIR-1935 v1.03. The vulnerability is a command-injection in the web management portal’s SetSysEmailSettings handling: a user-supplied string parsed inside a system call is not properly validated, enabling an attacker to execute code with root privileges. Exploitation...

CVE-2022-37012

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation OPC UA C++ Demo Server 1.7.6-537. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

CVE-2022-42429

This CVE concerns Centreon. The vulnerability is a SQL injection in the poller broker configuration handling, caused by insufficient validation of a user-supplied string used to build SQL queries. It allows remote attackers to escalate privileges to administrator on affected Centreon installation...

CVE-2022-43640

The vulnerability CVE-2022-43640 affects Foxit PDF Reader 12.0.1.12430. The flaw is in PDF parsing: crafted data in a PDF can trigger a read past the end of an allocated buffer. This may allow information disclosure and, in conjunction with other issues, could enable arbitrary code execution in t...

CVE-2022-2561

Summary: CVE-2022-2561 affects OPC Labs QuickOPC 2022.1. The issue stems from improper validation during XML processing in Connectivity Explorer, leading to deserialization of untrusted data and remote code execution in the current process. Exploitation requires user interaction (visiting a malic...

CVE-2022-43609

CVE-2022-43609 affects IronCAD. The vulnerability stems from parsing STP files where, when handling the VECTOR element, a pointer is not properly initialized before access, enabling remote code execution with user interaction (visiting a malicious page or opening a malicious file). Descriptions f...

CVE-2022-43647

CVE-2022-43647 affects D-Link DIR-825 routers (versions 1.0.9/EE). The vulnerability in the xupnpd service listens on TCP port 4044 and stems from improper validation of a user-supplied string before it’s used to execute a system call. This allows network-adjacent attackers (no authentication req...

CVE-2022-36972

CVE-2022-36972 concerns Ivanti Avalanche 6.3.2.3490. The vulnerability is a SQL injection in the ProfileDaoImpl class that allows a crafted request to assemble and execute SQL from user-supplied input, enabling an authentication bypass over the network. Related disclosures (ZDI-22-777) and vendor...

CVE-2022-43614

CorelDRAW Graphics Suite 23.5.0.506 is affected by a GIF file parsing vulnerability that can cause a write past the end of an allocated object, enabling arbitrary code execution in the current process. Exploitation requires user interaction (visiting a malicious page or opening a malicious file)....

CVE-2022-37374

PDF-XChange Editor is affected by a PNG file parsing use-after-free vulnerability (CVE-2022-37374). The issue stems from validating the existence of an object before performing operations during PNG parsing, enabling remote code execution when a user visits a malicious page or opens a crafted fil...

CVE-2022-43616

CVE-2022-43616 affects CorelDRAW Graphics Suite 23.5.0.506, due to an error in EMF image parsing that allows a read past the end of an allocated object. This can enable remote code execution with current process privileges and requires user interaction (visiting a malicious page or opening a mali...

CVE-2022-36978

Ivanti Avalanche 6.3.2.3490 is affected. The vulnerability resides in the Notification Server service and stems from improper validation of user-supplied data, leading to deserialization of untrusted data and remote code execution in the service account context. Authentication is required to expl...

CVE-2022-37376

CVE-2022-37376 affects Foxit PDF Editor 11.1.1.53537. The flaw lies in the handling of arrays, where actions in JavaScript can trigger a read past the end of an allocated object, enabling sensitive information disclosure. User interaction is required (target must visit a malicious page or open a ...

CVE-2022-28645

Bentley MicroStation CONNECT 10.16.02.34 is affected by a DGN file parsing out-of-bounds read that can disclose sensitive information. The flaw allows an attacker to trigger a read past the end of an allocated buffer and, in conjunction with other vulnerabilities, may lead to arbitrary code execu...

CVE-2022-37368

This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2022-43615

CorelDRAW Graphics Suite 23.5.0.506 is affected by a PDF file parsing vulnerability that can disclose sensitive information via a read past the end of an allocated object. The flaw arises from insufficient validation of user-supplied data during PDF parsing, and exploitation requires user interac...

CVE-2022-43648

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 1.20B03 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MiniDLNA service. The issue results from the lack of prope...

CVE-2022-37390

CVE-2022-37390 affects Foxit PDF Reader 11.2.2.53575; the flaw lies in AcroForms handling where the code does not validate the existence of an object before performing operations. This can allow code execution in the context of the current process after the target visits a malicious page or opens...

CVE-2022-42425

This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of requests to modify poller broker configuration. The issue results from the lack of...

CVE-2022-43627

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...