CVE-2023-39493

CVE-2023-39493 affects PDF-XChange Editor. The vulnerability is in the exportAsText method, where a JavaScript interface exposes the ability to write arbitrary files, enabling remote code execution in the context of the current user. Exploitation requires user interaction (target user must visit ...

CVE-2023-39487

PDF-XChange Editor contains a vulnerability in the handling of util objects that can trigger a read past the end of an allocated object via JavaScript actions. This out-of-bounds read leads to information disclosure and, when combined with other issues, may enable arbitrary code execution in the ...

CVE-2023-39486

PDF-XChange Editor JP2 File Parsing Memory Corruption Remote Code Execution Vulnerability. Affected software: PDF-XChange Editor (Windows). Root cause: improper validation in JP2 file parsing leading to memory corruption. Impact: remote code execution in the compromised process; requires user int...

CVE-2023-39484

CVE-2023-39484 affects PDF-XChange Editor. The vulnerability lies in PDF file parsing where memory is accessed without proper initialization, leading to information disclosure. Impact: potential exposure of sensitive data on affected installations. Exploitation requires user interaction (the targ...

CVE-2023-39482

The CVE-2023-39482 entry concerns Softing Secure Integration Server. The issue is located in the libopcuaclient.so component and stems from hardcoded cryptographic keys, enabling a remote attacker to disclose stored credentials and potentially facilitate further compromise. According to the provi...

CVE-2023-39480

CVE-2023-39480 affects Softing Secure Integration Server, specifically the FileDirectory OPC UA Objects handling. The flaw allows remote attackers to create arbitrary files on affected installations by exploiting unauthorized access to the filesystem, with authentication required but bypassable. ...

CVE-2023-39479

Softing Secure Integration Server OPC UA Gateway Directory Creation Vulnerability (CVE-2023-39479) affects the OPC UA Gateway handling of FileDirectory OPC UA Objects. The flaw allows remote attackers, bypassing authentication, to create directories by accessing the filesystem, potentially enabli...

CVE-2023-39475

CVE-2023-39475 affects Inductive Automation Ignition through the ParameterVersionJavaSerializationCodec deserialization of untrusted data. The root cause is lack of validation of user-supplied data in this class, allowing a remote attacker to execute arbitrary code in the context of SYSTEM withou...

CVE-2023-39474

CVE-2023-39474 (Inductive Automation Ignition) affects the Ignition platform, specifically the downloadLaunchClientJar function. The flaw is due to loading a remote JAR without validating it, enabling a remote attacker to execute arbitrary code in the context of the current user. Exploitation req...

CVE-2023-39472

CVE-2023-39472 — Inductive Automation Ignition is affected through the SimpleXMLReader’s XML External Entity (XXE) handling, where a crafted XML can trigger the parser to fetch a URI and embed its contents, enabling information disclosure in the SYSTEM context. Exploitation requires authenticatio...

CVE-2023-39473

The CVE-2023-39473 entry concerns Inductive Automation Ignition's AbstractGatewayFunction deserialization vulnerability. The flaw stems from insufficient validation of user-supplied data, enabling deserialization of untrusted input and remote code execution. Exploitation requires authentication a...

CVE-2023-39468

Triangle MicroWorks SCADA Data Gateway is affected by CVE-2023-39468 via the DbasSectorFileToExecuteOnReset parameter handling, where an exposed dangerous function allows remote code execution in the SYSTEM context. The flaw requires authentication to exploit. Connected advisories (ZDI-23-1036 an...

CVE-2023-39467

Triangle MicroWorks SCADA Data Gateway is affected by an information-disclosure vulnerability related to the certificate web directory configuration. The flaw allows remote attackers to obtain sensitive data without authentication, via exposure of sensitive information in the application webroot....

CVE-2023-39465

CVE-2023-39465 is tied to Triangle MicroWorks SCADA Data Gateway . The issue is in the TmwCrypto class, due to the use of a hard-coded cryptographic key and a hard-coded certificate, enabling remote disclosure of sensitive information without authentication. The vulnerability is documented across...

CVE-2023-38124

CVE-2023-38124 affects Inductive Automation Ignition Gateway/OPC UA Quick Client Task Scheduling. The flaw stems from exposing a dangerous function in the Ignition Gateway server, allowing remote attackers to execute code with SYSTEM privileges after authenticating. Documents consistently describ...

CVE-2023-38122

CVE-2023-38122 affects Inductive Automation Ignition OPC UA Quick Client. The flaw is in the web server configuration, arising from missing Content Security Policy headers, enabling a cross-domain policy that can lead to remote code execution. Authentication is required to exploit, but the authen...

CVE-2023-38120

The CVE-2023-38120 entry describes a vulnerability in the Adtran SR400ac where the ping command, exposed via JSON-RPC, accepts a crafted host parameter that can cause a system call from a user-supplied string, enabling code execution as root. The flaw is reachable over the network and requires au...

CVE-2023-38115

Summary: CVE-2023-38115 affects Foxit PDF Reader/Editor related to AcroForm handling. The root cause is improper validation of user-supplied data in Doc Objects, causing an out-of-bounds read that may disclose memory content. The vulnerability is described as enabling information disclosure, with...

CVE-2023-38114

CVE-2023-38114 is a Foxit PDF Reader/Editor vulnerability described as an AcroForm Doc Object Use-After-Free leading to remote code execution. The flaw stems from not validating the existence of a Doc object before performing operations, allowing an attacker to run code in the user’s context afte...

CVE-2023-38113

CVE-2023-38113 affects Foxit PDF Reader/Editor (Annotation handling).根The flaw is Use-After-Free in Annotation objects due to missing validation of object existence, enabling information disclosure and potential arbitrary code execution when paired with other vulnerabilities. Exploitation require...