CVE-2023-35749

CVE-2023-35749 concerns the D-Link DAP-2622 DDP service. The vulnerability is a stack-based buffer overflow in the firmware upgrade file name handling, triggered by insufficient validation of user-supplied data, allowing a network-adjacent attacker to execute code with root privileges. Authentica...

CVE-2023-35748

CVE-2023-35748 concerns the D-Link DAP-2622 DDP firmware upgrade server. The issue is a stack-based buffer overflow caused by insufficient validation of the length of user-supplied data in the IPv6 address handling of the DDP service. This allows network-adjacent attackers to execute arbitrary co...

CVE-2022-43652

Bentley View SKP File Parsing Use-After-Free Information Disclosure Vulnerability (CVE-2022-43652) affects Bentley View. The flaw is in the SKP file parser where the software fails to validate the existence of an object before operations, enabling information disclosure and potentially arbitrary ...

CVE-2021-35002

CVE-2021-35002 (BMC Track-It!) involves an unvalidated processing path for email attachments in Track-It!, enabling an attacker to upload arbitrary files and execute code in the service account context. Affected software is BMC Track-It! (Track-It! helpdesk/asset management product). The root cau...

CVE-2021-35001

CVE-2021-35001 affects BMC Track-It! GetData endpoint. The root cause is missing authorization prior to accessing functionality, allowing remote disclosure of sensitive information (stored credentials) on affected installations. Exploitation requires authentication per descriptions, and no explic...

CVE-2021-35000

OpenBSD Kernel multicast routing contains an uninitialized memory access flaw that leads to local information disclosure. The vulnerability exists in the multicast routing implementation and allows a local attacker who can execute low-privilege code to obtain sensitive kernel memory contents. The...

CVE-2021-34982

The CVE-2021-34982 entry describes a pre-auth, remote code execution vulnerability in the httpd service of NETGEAR routers. The flaw is a stack-based buffer overflow caused by unchecked length of user-supplied data in the strings file, leading to code execution with root privileges when a network...

CVE-2021-34981

CVE-2021-34981 concerns the Linux kernel’s Bluetooth CMTP module. The issue stems from failing to validate the existence of an object before performing free operations, enabling a local attacker to escalate privileges by executing code in the kernel context (double free). The vulnerability is lin...

CVE-2021-34975

CVE-2021-34975 : Foxit PDF Reader contains a use-after-free in the transitionToState method, caused by failing to validate an object’s existence before use. This allows an attacker to execute arbitrary code in the context of the current process, with user interaction required (target must visit a...

CVE-2021-34971

CVE-2021-34971 is a heap-based buffer overflow in Foxit PDF Reader JPG2000 file parsing that enables remote code execution when a user opens a crafted file or visits a malicious page. The root cause is improper validation of the length of user-supplied data before copying it to a heap buffer. The...

CVE-2021-34968

CVE-2021-34968 concerns Foxit PDF Editor. The flaw lies in the transitionToState implementation where the code does not validate the existence of an object before operating on it, enabling a Use-After-Free that can lead to Remote Code Execution . Exploitation requires user interaction (the target...

CVE-2021-34967

CVE-2021-34967 affects Foxit PDF Editor (Line Annotation) and is a use-after-free in handling annotation objects. The flaw stems from not validating the existence of an Annotation object before operations, enabling remote code execution when a user opens a malicious page/file or visits a maliciou...

CVE-2021-34966

Foxit PDF Editor - CVE-2021-34966: A use-after-free in FileAttachment Annotation handling arises from not validating the existence of an object before operations, enabling remote code execution. Affected: Foxit PDF Editor (annotation processing path). Impact: arbitrary code execution in the conte...

CVE-2021-34965

CVE-2021-34965 describes a use-after-free in Foxit PDF Editor’s Squiggly Annotation handling. The flaw arises from not validating the existence of an Annotation object before operations, enabling an attacker to execute code in the context of the target process. The vulnerability requires user int...

CVE-2021-34964

Foxit PDF Editor exposes a Use-After-Free vulnerability in Polygon Annotation handling (Annotation objects). The flaw stems from not validating the existence of an object before operations, allowing attacker-controlled input to run arbitrary code with the user’s privileges when a target visits a ...

CVE-2021-34963

CVE-2021-34963 affects Foxit PDF software (PDF Editor/Reader) where the PolyLine Annotation is handled insecurely, leading to a Use-After-Free that can allow remote code execution. The flaw stems from not validating the existence of an object before performing operations on Annotation objects, en...

CVE-2021-34961

Foxit PDF Editor/Reader (incl. PhantomPDF lineage) is affected by a Use-After-Free in the Ink Annotation handling. The flaw arises from not validating the existence of an Annotation object before performing operations, allowing an attacker to execute code in the victim process. Exploitation requi...

CVE-2021-34960

Foxit PDF Editor CVE-2021-34960: Use-after-free in Circle Annotation handling allows remote code execution when a user visits a malicious page or opens a malicious file. Root cause: missing validation of object existence before operations on Annotation objects, executing code in the current proce...

CVE-2021-34959

CVE-2021-34959 affects Foxit PDF Editor, with a vulnerability in the handling of Square/Annotation objects. The issue is described as a use-after-free flaw caused by not validating the existence of an object before operations, enabling an attacker to execute arbitrary code in the process context....

CVE-2021-34958

Foxit PDF Editor (Text Annotation) contains a use-after-free vulnerability (CVE-2021-34958) in the handling of Annotation objects that allows remote code execution. The flaw arises from not validating the existence of an object before performing operations, enabling code execution in the context ...