CVE-2022-37360

This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2022-36977

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Certificate...

CVE-2022-43621

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-1935 1.03 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from an...

CVE-2022-37012

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation OPC UA C++ Demo Server 1.7.6-537. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

CVE-2022-43608

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.03 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the BJNP service. The issue results from the lack of...

CVE-2022-43636

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of TP-Link TL-WR940N 6211111 3.20.1US routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by...

CVE-2022-43618

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Corel CorelDRAW Graphics Suite 23.5.0.506. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

CVE-2022-28687

This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 04201.2111.1802.0000. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...

CVE-2022-28307

Bentley View 10.16.02.022 is affected by a DXF file parsing vulnerability that can trigger a read past the end of an allocated buffer, enabling remote code execution. The issue resides in the DXF parsing path and requires user interaction (the target must visit a malicious page or open a maliciou...

CVE-2022-28300

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation 10.16.02.034 CONNECT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

CVE-2022-37386

CVE-2022-37386 affects Foxit PDF Reader 11.2.2.53575. The issue is in the resetForm method, where JavaScript actions can trigger a read past the end of an allocated object. This can be leveraged with other vulnerabilities to execute arbitrary code in the target process, with user interaction requ...

CVE-2022-37379

CVE-2022-37379 affects Foxit PDF Reader 11.2.1.53537. The flaw is in the handling of the AFSpecial_KeystrokeEx method where the code does not validate the existence of an object before performing operations. This can disclose sensitive information and, in conjunction with other vulnerabilities, m...

CVE-2022-36972

CVE-2022-36972 concerns Ivanti Avalanche 6.3.2.3490. The vulnerability is a SQL injection in the ProfileDaoImpl class that allows a crafted request to assemble and execute SQL from user-supplied input, enabling an authentication bypass over the network. Related disclosures (ZDI-22-777) and vendor...

CVE-2022-42430

This vulnerability allows local attackers to escalate privileges on affected Tesla vehicles. An attacker must first obtain the ability to execute privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the wowlanconfig data...

CVE-2022-28643

CVE-2022-28643 affects Bentley MicroStation CONNECT 10.16.02.34. The vulnerability arises from the parsing of DGN files; crafted data can trigger a write past the end of an allocated buffer, allowing remote code execution in the current process. User interaction is required (visiting a malicious ...

CVE-2022-37382

CVE-2022-37382 affects Foxit PDF Reader 11.2.1.53537 (and related Foxit/Editor variants). The root cause is a missing validation of an object before performing operations in removeIcon, allowing information disclosure and, with additional vulnerabilities, potential arbitrary code execution in the...

CVE-2022-43643

CVE-2022-43643 concerns a remote command injection in the D-Link DIR-825 1.0.9/EE router. The flaw is in the xupnpd Generic plugin listening on TCP port 4044, arising from inadequate validation of user-supplied input used in a system call. This allows network-adjacent attackers to execute code wi...

CVE-2022-37354

PDF-XChange Editor is affected by a J2K file parsing vulnerability that can cause an out-of-bounds write, enabling remote code execution with user interaction. The flaw is triggered by crafted J2K data leading to write past the end of an allocated buffer in the parsing path. The available connect...

CVE-2022-42429

This CVE concerns Centreon. The vulnerability is a SQL injection in the poller broker configuration handling, caused by insufficient validation of a user-supplied string used to build SQL queries. It allows remote attackers to escalate privileges to administrator on affected Centreon installation...

CVE-2022-37355

PDF-XChange Editor is affected by a vulnerability in the parsing of JPG files that can trigger a write-past-end of an allocated buffer, enabling remote code execution with the current process’s privileges after user interaction (visiting a malformed page or opening a malicious file). Evidence tie...