CVE-2022-37371

PDF-XChange Editor is affected by CVE-2022-37371 due to a parsing flaw that allows a crafted PDF to trigger a write past the end of an allocated buffer, enabling remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious file). Root cause: buff...

CVE-2022-27646

CVE-2022-27646 affects NETGEAR R6700v3 with firmware 1.0.4.120_10.0.91. The circled daemon (circled) accepts a crafted circleinfo.txt file that overflows a fixed-length stack buffer, enabling arbitrary code execution with root privileges. Authentication is required but bypassable per disclosures....

CVE-2022-28300

Bentley MicroStation CONNECT (10.16.02.034) is affected by CVE-2022-28300 due to an out-of-bounds write in the JP2 image parser. Crafted JP2 data can trigger a write past the end of an allocated buffer, enabling code execution in the context of the current process. User interaction is required (v...

CVE-2022-3210

This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpd service, which listens on TCP port 4044 by defaul...

CVE-2022-43611

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Corel CorelDRAW Graphics Suite 23.5.0.506. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific fla...

CVE-2022-27641

Summary (CVE-2022-27641): Affected: NETGEAR R6700v3 with firmware 1.0.4.120 10.0.91. Component: NetUSB module. Cause: improper validation of user-supplied data leading to an integer overflow during buffer allocation. Impact: remote code execution in the context of root by network-adjacent attacke...

CVE-2022-27648

CVE-2022-27648 affects KOYO Screen Creator 0.1.1.1. The flaw is in parsing of SCA2 files where the length of user-supplied data is not validated before copying to a fixed-length stack-based buffer, enabling remote code execution when a user visits a malicious page or opens a malicious file. Attac...

CVE-2022-37380

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

CVE-2022-28305: Stack-based Buffer Overflow

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

CVE-2022-43648

CVE-2022-43648 affects D-Link DIR-3040 routers (version 1.20B03). The flaw is in the MiniDLNA service, where the length of user-supplied data is not properly validated before copying to a heap-based buffer, enabling a heap-based buffer overflow. This allows network-adjacent attackers to execute a...

CVE-2022-43637

Foxit PDF Reader 12.0.1.12430 contains a U3D parsing flaw where the code fails to validate the existence of an object before operating on it, enabling arbitrary code execution in the current process. The vulnerability requires user interaction (open a malicious file or visit a malicious page). Th...

CVE-2022-43610

CVE-2022-43610 affects CorelDRAW Graphics Suite 23.5.0.506. The vulnerability is a read-past-end-of-allocated-object due to improper validation while parsing GIF images, leading to potential information disclosure. Exploitation requires user interaction (target visits a malicious page or opens a ...

CVE-2022-43628

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43636

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of TP-Link TL-WR940N 6211111 3.20.1US routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by...

CVE-2022-43634

Netatalk CVE-2022-43634 is a remote code execution flaw in the dsi_writeinit function caused by improper validation of user-supplied data length, leading to root privileges via a heap-based buffer overflow. Affected: Netatalk implementations on various Linux distributions and Netatalk-based appli...

CVE-2022-28301

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

CVE-2022-37387

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.2.53575. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2022-28312

The CVE-2022-28312 issue affects Bentley MicroStation CONNECT 10.16.02.034, with a flaw in 3DS file parsing that can trigger a read past the end of an allocated buffer. This leads to information disclosure and, in conjunction with other vulnerabilities, may allow arbitrary code execution in the a...

xorg-server -- Overlay Window Use-After-Free

The X.Org project reports: ZDI-CAN-19866/CVE-2023-1393: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability If a client explicitly destroys the compositor overlay window aka COW, the Xserver would leave a dangling pointer to that window in the CompScreen structure,...

CVE-2022-43634

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dsiwriteinit function. The issue results from the lack of proper validation of the length o...