CVE-2022-43630

CVE-2022-43630 affects D-Link DIR-1935 (firmware ~1.03). The vulnerability is a stack-based buffer overflow in the handling of SOAPAction header in the web management portal, exploitable by network-adjacent attackers without authentication to execute code as root. The issue is documented as a rem...

CVE-2022-43617

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Corel CorelDRAW Graphics Suite 23.5.0.506. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

CVE-2022-43650

This vulnerability allows remote attackers to disclose sensitive information on affected installations of RARLAB WinRAR 6.11.0.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2022-28304

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

CVE-2022-43640

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 12.0.1.12430. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

CVE-2022-36978

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Notification...

CVE-2022-37366

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

CVE-2022-43622

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of Login requests to the web management portal. When...

CVE-2022-36982

CVE-2022-36982 affects Ivanti Avalanche 6.3.3.101. The flaw is in the AgentTaskHandler and stems from inadequate validation of a user-supplied path before file operations, enabling a path-traversal-like disclosure of arbitrary files and stored session cookies. Authentication is required to exploi...

CVE-2022-43610

CVE-2022-43610 affects CorelDRAW Graphics Suite 23.5.0.506. The vulnerability is a read-past-end-of-allocated-object due to improper validation while parsing GIF images, leading to potential information disclosure. Exploitation requires user interaction (target visits a malicious page or opens a ...

CVE-2022-36975

CVE-2022-36975 affects Ivanti Avalanche 6.3.2.3490. The root cause is a SQL injection in the ProfileDaoImpl class triggered by a crafted request that builds SQL from user-supplied strings, enabling authentication bypass. This is documented across multiple sources (ZDI advisory ZDI-22-780 and ZDI-...

CVE-2022-28645

Bentley MicroStation CONNECT 10.16.02.34 is affected by a DGN file parsing out-of-bounds read that can disclose sensitive information. The flaw allows an attacker to trigger a read past the end of an allocated buffer and, in conjunction with other vulnerabilities, may lead to arbitrary code execu...

CVE-2022-37012

The CVE-2022-37012 entry affects Unified Automation OPC UA C++ Demo Server 1.7.6-537. The underlying flaw is in OpcUa_SecureListener_ProcessSessionCallRequest, where a crafted OPC UA message can cause an incorrect reference-count update, enabling a network-based denial-of-service without authenti...

CVE-2022-43625

CVE-2022-43625 affects D-Link DIR-1935 (firmware 1.03). The vulnerability lies in the NetMask handling inside the web management portal when processing SetStaticRouteIPv4Settings requests; the value is copied into a fixed-length stack buffer without proper length validation, enabling a stack-base...

CVE-2022-28688

CVE-2022-28688 affects AVEVA Edge 2020 SP2 Patch 0 (4201.2111.1802.0000). The flaw is in how APP files are handled: the process loads a library from an unsecured location, enabling arbitrary code execution when a user visits a malicious page or opens a crafted file. Exploitation requires user int...

CVE-2022-37385

CVE-2022-37385 (Foxit PDF Reader version 11.2.1.53537) is a renderer/process‑level vulnerability originating from the handling of Doc objects where the code fails to validate the existence of an object before performing operations. This allows remote attackers to execute arbitrary code in the con...

CVE-2022-28641

CVE-2022-28641 affects Bentley MicroStation CONNECT 10.16.02.34. The vulnerability is in the IFC file parsing code and is caused by a lack of validating object existence before operations, enabling a use-after-free condition that allows remote code execution when a user visits a malicious page or...

CVE-2022-28301

Bentley MicroStation CONNECT 10.16.02.34 is affected by CVE-2022-28301 due to an out-of-bounds write in IFC file parsing. The flaw can allow remote code execution with user interaction (target must open a malicious IFC file/page). Concrete details across connected documents confirm the vulnerable...

CVE-2022-36971

Ivanti Avalanche 6.3.2.3490 is affected by CVE-2022-36971 due to deserialization of untrusted data in JwtTokenUtility, enabling remote code execution with network access and low attack complexity. Authentication is required but may be bypassed. No official patch/version is stated in the provided ...

CVE-2022-37368

This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...