CVE-2022-42417

PDF-XChange Editor is affected by CVE-2022-42417, a vulnerability in the parsing of TIF files that can trigger a read past the end of an allocated buffer, allowing remote code execution in the context of the current process. Exploitation requires user interaction (the target must open a malicious...

CVE-2022-42372

PDF-XChange Editor is affected by a U3D file parsing buffer over-read vulnerability that allows remote code execution with user interaction (visiting a malicious page or opening a malicious file). Root cause: crafted U3D data can trigger read past end of allocated memory, enabling code execution ...

CVE-2022-40718

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the anweb service, which listens on TCP ports 80 and 443 by default. The issue...

CVE-2022-42415

PDF-XChange Editor is affected by a JP2 file parsing vulnerability that can trigger a write-past-the-end in an allocated buffer, enabling remote code execution with the current process privileges. The CVE-2022-42415 entries across multiple feeds (NVD/Red Hat/CVE records) attribute this to ZDI-CAN...

CVE-2022-42394

CVE-2022-42394 affects PDF-XChange Editor. The vulnerability stems from the parsing of U3D files, where crafted data can trigger a write past the end of an allocated buffer, allowing an attacker to execute code in the context of the current process. Exploitation requires user interaction (visitin...

CVE-2022-42396

CVE-2022-42396 affects PDF-XChange Editor. The flaw, in the XPS file parsing path, stems from inadequate validation of a user-supplied value before dereferencing a pointer, enabling arbitrary code execution when a user opens a malicious file or visits a malicious page. The vulnerability requires ...

CVE-2022-42373

CVE-2022-42373 affects PDF-XChange Editor. The root cause is an out-of-bounds write during parsing of U3D files, allowing remote attackers to execute arbitrary code after the user opens a crafted U3D file or visits a malicious page. Exploitation requires user interaction and runs with the current...

CVE-2022-40717

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the anweb service, which listens on TCP ports 80 and 443 by default. The issue...

CVE-2022-42400

PDF-XChange Editor is affected by CVE-2022-42400 due to a PDF parsing vulnerability that can write past the end of an allocated buffer, enabling code execution. The attack requires user interaction (visiting a malicious page or opening a malicious file) and is exploitable via crafted PDF data; th...

CVE-2022-42409

This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2022-42404

The CVE-2022-42404 entry concerns PDF-XChange Editor: an EMF file parsing flaw that can trigger a read past the end of an allocated buffer, enabling information disclosure and potentially arbitrary code execution when combined with other vulnerabilities. The vulnerability requires user interactio...

CVE-2022-42377

CVE-2022-42377 affects PDF-XChange Editor. The issue is a memory corruption vulnerability in the parsing of U3D files that can allow remote code execution after user interaction (visiting a malicious page or opening a crafted file). Root cause: insufficient validation of user-supplied data in U3D...

CVE-2022-42383

The CVE-2022-42383 issue affects PDF-XChange Editor and stems from a flaw in parsing U3D files. The vulnerability allows remote disclosure of sensitive information by triggering a read past the end of an allocated buffer when processing crafted U3D data, with user interaction required (visiting a...

CVE-2022-42395

CVE-2022-42395 affects PDF-XChange Editor via a buffer overrun in XPS parsing that permits remote code execution after user interaction. Root cause: crafted XPS data causing write past end of allocated buffer. Exploitation tied to ZDI-18274. CVSS v3.1 base score 7.8 (HIGH). Remediation: update to...

CVE-2022-42373

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...

CVE-2022-42375

CVE-2022-42375 affects PDF-XChange Editor. The issue stems from parsing of U3D files, where crafted data can trigger a read past the end of an allocated buffer, potentially allowing an attacker to disclose sensitive information and, with other vulnerabilities, execute arbitrary code in the curren...

CVE-2022-41144

PDF-XChange Editor is affected by CVE-2022-41144 due to a parsing flaw in U3D files that can trigger a write-past-end of an allocated buffer, allowing remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious file). The issue is documented as ...

CVE-2022-42399

CVE-2022-42399 affects PDF-XChange Editor. Root cause: buffer over-read during PDF parsing that can trigger code execution when a user opens a malicious PDF or visits a crafted page. Affected software is PDF-XChange Editor (Tracker Software). Impact described as arbitrary code execution in the co...

CVE-2022-42410

CVE-2022-42410 affects PDF-XChange Editor. The flaw is an out-of-bounds write in parsing of PGM files, enabling remote code execution when a user opens a crafted PGM file or visits a malicious page. Requires user interaction; attack vector is local (per CVSS context) but remote code execution in ...

CVE-2022-42406

Summary (CVE-2022-42406) : PDF-XChange Editor is affected by a vulnerability in EMF file parsing that can trigger a read past the end of an allocated buffer, allowing sensitive information disclosure. Exploitation requires user interaction (target must visit a malicious page or open a malicious f...