CVE-2022-42427

CVE-2022-42427 affects Centreon. A SQL injection in the contact groups configuration page, due to unvalidated user input used to build SQL queries, allows remote attackers with authentication to escalate privileges to administrator. Root cause: improper validation of a user-supplied string affect...

CVE-2022-28320

CVE-2022-28320 affects Bentley View 10.16.02.022. The issue lies in parsing 3DM files where memory is not properly initialized before access, enabling an attacker to execute code in the context of the current process with user interaction required (visit a malicious page or open a malicious file)...

CVE-2022-37391

Foxit PDF Reader 11.2.2.53575 is affected; exploit arises in AcroForms handling due to not validating object existence before operations, enabling remote code execution in the process with user interaction (visiting a malicious page or opening a malicious file). No remediation details are provide...

CVE-2022-42428

CVE-2022-42428 affects Centreon (Centreon poller broker configuration handling). The root cause is improper validation of a user-supplied string used to construct SQL queries, enabling privilege escalation from normal user to administrator with network access and no user interaction. Authenticati...

CVE-2022-37374

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...

CVE-2022-43648

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 1.20B03 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MiniDLNA service. The issue results from the lack of prope...

CVE-2022-28303

Bentley View 10.16.02.022 is affected by a vulnerability in SKP file parsing where the code fails to validate object existence before operations, leading to a use-after-free and remote code execution. The issue is exploitable with minimal user interaction (target must open a crafted SKP file or v...

CVE-2022-28319

Bentley MicroStation CONNECT 10.16.02.034 is affected. The vulnerability originates from the 3DM file parser, where memory is not properly initialized before access, enabling arbitrary code execution. An attacker must lure a user to visit a malicious page or open a malicious file, after which cod...

CVE-2022-43618

CorelDRAW Graphics Suite 23.5.0.506 is affected by a buffer/write past end vulnerability in the PCX file parsing code. The flaw arises from insufficient validation of user-supplied data, enabling an out-of-bounds write that can allow remote code execution in the context of the current process. Ex...

CVE-2022-37352

PDF-XChange Editor is affected by a WMF parsing flaw that can trigger a read past the end of an allocated buffer. This vulnerability may allow remote disclosure of sensitive information and, when combined with other vulnerabilities, could enable arbitrary code execution in the context of the curr...

CVE-2022-27646

CVE-2022-27646 affects NETGEAR R6700v3 with firmware 1.0.4.120_10.0.91. The circled daemon (circled) accepts a crafted circleinfo.txt file that overflows a fixed-length stack buffer, enabling arbitrary code execution with root privileges. Authentication is required but bypassable per disclosures....

CVE-2022-43626

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43611

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Corel CorelDRAW Graphics Suite 23.5.0.506. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific fla...

CVE-2022-42431

CVE-2022-42431 affects Tesla vehicles via the bcmdhd driver. The issue arises from insufficient validation of the length of user-supplied data before copying to a buffer, enabling a local attacker to escalate privileges and execute code with root privileges. The connected document set confirms th...

CVE-2022-37362

CVE-2022-37362 affects PDF-XChange Editor. The root cause is a buffer over-read/write in the PNG parsing path that can trigger arbitrary code execution when a user opens a malicious PNG or visits a malicious page, with exploitation requiring user interaction. Connected documents confirm the vulne...

CVE-2022-43639

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 12.0.1.12430. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2022-28306

Bentley MicroStation CONNECT 10.16.02.034 is affected by a CVE-2022-28306 vulnerability in OBJ file parsing. The issue stems from insufficient validation of the length of user-supplied data prior to copying to a fixed-length stack buffer, enabling remote code execution within the current process ...

CVE-2022-36976

Ivanti Avalanche 6.3.2.3490 contains an SQL injection in GroupDaoImpl that can bypass authentication via crafted input, exposing a total impact on confidentiality, integrity, and availability. Multiple connected sources (ZDI-22-781 and various CVE records) corroborate the authentication-bypass vi...

CVE-2022-43646

CVE-2022-43646 affects D-Link DIR-825 (versions 1.0.9/EE). The vulnerability is in the Vimeo plugin for the xupnpd service (listening on TCP 4044) where unvalidated user-supplied strings are used to spawn a system call, allowing network-adjacent attackers to execute arbitrary code as the admin us...

CVE-2022-28308

CVE-2022-28308 affects Bentley View 10.16.02.022. The issue is in parsing 3DS files, where crafted data can trigger a read past the end of an allocated buffer. This could disclose sensitive information and, in conjunction with other vulnerabilities, allow arbitrary code execution in the current p...