CVE-2021-46645

CVE-2021-46645 affects Bentley MicroStation CONNECT 10.16.0.80. The vulnerability resides in BMP image parsing, where crafted BMP data can trigger a write past the end of an allocated buffer, allowing remote code execution in the context of the current process. User interaction is required (targe...

CVE-2021-46648

Bentley MicroStation CONNECT 10.16.0.80 is affected by a heap-based buffer overflow in DGN file parsing due to improper validation of the length of user-supplied data. This allows remote code execution in the context of the current process, with exploitation requiring user interaction (target mus...

CVE-2021-46563

CVE-2021-46563 concerns Bentley MicroStation CONNECT (10.16.0.80) and stems from the JT file parser. Crafted JT data can trigger a read past the end of an allocated buffer, enabling remote code execution in the process context. Attack requires user interaction (visiting a malicious page or openin...

CVE-2021-46564

CVE-2021-46564 affects Bentley MicroStation CONNECT 10.16.0.80. The flaw is in JT file parsing, where crafted data can trigger a write past the end of an allocated buffer, enabling remote code execution in the context of the current process. Exploitation requires user interaction (visiting a mali...

CVE-2021-46572

CVE-2021-46572 affects Bentley MicroStation CONNECT 10.16.0.80. The vulnerability is in the JT file parsing path, where crafted JT data can trigger an out-of-bounds write in the affected process, allowing remote code execution. Exploitation requires user interaction (target must visit a malicious...

CVE-2021-46575

CVE-2021-46575 affects Bentley MicroStation CONNECT 10.16.0.80. The issue is a parsing-use-after-free flaw in DGN file handling where the code does not validate object existence before operations, enabling remote code execution in the process context. Exploitation requires user interaction (visit...

CVE-2021-46646

CVE-2021-46646 affects Bentley MicroStation CONNECT 10.16.0.80. The issue is an out-of-bounds write in the DGN file parser, allowing code execution in the context of the current process. Exploitation requires user interaction (visiting a malicious page or opening a malicious file) and crafted DGN...

CVE-2021-46614

CVE-2021-46614 concerns Bentley MicroStation CONNECT 10.16.0.80, where the vulnerability arises in the parsing of J2K images. The underlying flaw is an out-of-bounds read that can be triggered by crafted J2K data, allowing an attacker to execute arbitrary code in the context of the affected proce...

CVE-2021-46570

CVE-2021-46570 affects Bentley View 10.16.0.80. The issue lies in parsing JT files where memory is accessed without prior proper initialization, enabling an attacker to disclose sensitive information and, with other vulnerabilities, execute arbitrary code in the current process after user interac...

CVE-2021-46639

CVE-2021-46639 affects Bentley MicroStation CONNECT 10.16.0.80. Connected sources (ZDI-22-226 and related notices) describe an out-of-bounds write in DGN file parsing that can allow remote code execution; exploitation requires user interaction (visiting malicious page or opening a malicious file)...

CVE-2021-46569

CVE-2021-46569 affects Bentley MicroStation CONNECT 10.16.0.80. The issue is a JT file parsing out-of-bounds write that can be triggered by crafted data, enabling remote code execution in the current process. User interaction is required (visit a malicious page or open a malicious file). The prim...

CVE-2021-46562

CVE-2021-46562 affects Bentley MicroStation CONNECT 10.16.0.80. The issue lies in JT file parsing, where crafted data can trigger a read past the end of an allocated buffer, enabling remote code execution in the attacker’s context. User interaction is required (target must open a malicious page/f...

CVE-2021-46583

CVE-2021-46583 affects Bentley MicroStation CONNECT 10.16.0.80. The root cause is an out-of-bounds write in the J2K image parser, triggered by crafted J2K data. This can allow a remote attacker to execute arbitrary code in the context of the affected process, with user interaction required (visit...

CVE-2021-46638

CVE-2021-46638 is substantiated by multiple connected advisories (notably ZDI-22-225) describing a stack-based buffer overflow in Bentley MicroStation CONNECT 10.16.0.80 during DGN file parsing. The flaw arises from insufficient validation of the length of user-supplied data prior to copying it i...

CVE-2021-46605

Bentley MicroStation CONNECT 10.16.0.80 is affected by CVE-2021-46605. The issue is a BMP image parsing heap-based overflow caused by insufficient validation of the length of user-supplied data before copying it to a heap buffer, enabling remote code execution. Exploitation requires user interact...

CVE-2021-46647

The CVE-2021-46647 entry concerns Bentley MicroStation CONNECT (10.16.0.80). The vulnerability is a heap-based buffer overflow during BMP image parsing caused by insufficient validation of the length of user-supplied data prior to copying it into a heap buffer. This flaw can allow an attacker to ...

CVE-2021-46590

CVE-2021-46590 (Bentley MicroStation CONNECT 10.16.0.80) : A vulnerability exists in the parsing of JT files where crafted data can trigger a read past the end of an allocated buffer, enabling remote code execution. Exploitation requires user interaction (target must open a malicious page or file...

CVE-2021-46593

CVE-2021-46593 affects Bentley MicroStation CONNECT 10.16.0.80. The issue is in parsing of DWG files due to insufficient validation, causing a read past the end of an allocated buffer and potential arbitrary code execution in the current process when combined with other vulnerabilities. Attacker ...

CVE-2021-46634

Bentley MicroStation CONNECT 10.16.0.80 is affected by CVE-2021-46634 due to an out-of-bounds write in JT file parsing. The flaw can allow remote code execution in the context of the affected process; exploitation requires user interaction (visiting a malicious page or opening a malicious file). ...

CVE-2021-46636

Bentley MicroStation CONNECT 10.16.0.80 contains a DGN file parsing buffer-overread flaw that can allow remote code execution. Attacker must entice a user to open a malicious page/file; code runs in the target process. References: ZDI-22-223, BE-2021-0009. No patch/version details provided.

CVE-2021-46576

Bentley MicroStation CONNECT 10.16.0.80 is affected. The vulnerability lies in JT file parsing, where crafted JT data can trigger a write past the end of an allocated buffer, allowing remote code execution in the context of the current process. User interaction is required (the target must visit ...

CVE-2021-46577

Summary (supported): CVE-2021-46577 affects Bentley MicroStation CONNECT 10.16.0.80. The issue lies in the JT file parsing where the length of user-supplied data is not properly validated before being copied into a heap-based buffer, enabling a heap-based overflow. Impact: remote code execution i...

CVE-2021-46619

Bentley MicroStation CONNECT 10.16.0.80 is affected by CVE-2021-46619 due to an out-of-bounds read during PDF parsing, enabling remote code execution when a user opens a malicious PDF or visits a crafted page/file. The vulnerability requires user interaction. Reports and advisories (e.g., ZDI-22-...

CVE-2021-46604

CVE-2021-46604 affects Bentley MicroStation CONNECT 10.16.0.80. The vulnerability lies in PNG image parsing, where crafted PNG data can cause a write past the end of an allocated buffer, enabling remote code execution in the context of the current process. Exploitation requires user interaction (...

CVE-2021-46620

CVE-2021-46620 affects Bentley MicroStation CONNECT 10.16.0.80. The connected ZDI advisory (ZDI-22-207) describes a vulnerability in FBX file parsing where improper validation can cause a read past the end of an allocated buffer. This results in an information disclosure vulnerability; exploitati...

CVE-2021-46568

This CVE affects Bentley MicroStation CONNECT 10.16.0.80. The vulnerability lies in the JT file parser, where crafted JT data can trigger a write past the end of an allocated buffer, allowing remote code execution in the context of the current process. Exploitation requires user interaction (the ...

CVE-2021-46584

CVE-2021-46584 affects Bentley MicroStation CONNECT 10.16.0.80. The flaw is in the parsing of J2K images, where crafted data can trigger a write past the end of an allocated buffer, allowing an attacker to execute code in the context of the current process. User interaction is required (visiting ...

CVE-2021-46608

This entry covers CVE-2021-46608 affecting Bentley MicroStation CONNECT 10.16.0.80. Affected component: DWG file parsing code. Root cause: improper validation leading to a read past the end of an allocated buffer, enabling information disclosure. Exploitation requires user interaction (target mus...

CVE-2021-46612

CVE-2021-46612 affects Bentley MicroStation CONNECT 10.16.0.80. The vulnerability lies in PDF file parsing, where crafted data can trigger a read past the end of an allocated buffer, enabling remote code execution in the process context. Exploitation requires user interaction (visiting a maliciou...

CVE-2021-46574

Bentley MicroStation CONNECT 10.16.0.80 is affected by a JT file parsing flaw that can trigger a write past the end of an allocated buffer, enabling remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious JT file). The issue is disclosed in ...

CVE-2021-46585

CVE-2021-46585 affects Bentley MicroStation CONNECT 10.16.0.80. The vulnerability is a stack-based buffer overflow caused by insufficient validation of user-supplied data while parsing JT files, enabling remote code execution. Exploitation requires user interaction (visiting a malicious page or o...

CVE-2021-46607

Bentley MicroStation CONNECT 10.16.0.80 is affected by a 3DS file parsing vulnerability that can disclose sensitive information. The flaw arises from insufficient validation during 3DS data processing, causing an out-of-bounds read and potential information disclosure. Exploitation requires user ...

CVE-2021-46637

CVE-2021-46637 affects Bentley MicroStation CONNECT (10.16.0.80). The vulnerability is an out-of-bounds read while parsing DGN files caused by insufficient validation of user-supplied data, allowing a remote attacker to disclose sensitive information by convincing a user to open a malicious file/...

CVE-2021-46581

CVE-2021-46581 affects Bentley MicroStation CONNECT 10.16.0.80. The vulnerability arises from parsing JT files, where crafted data can trigger a write past the end of an allocated buffer, enabling remote code execution in the current process. Exploitation requires user interaction (visiting a mal...

CVE-2021-46586

Bentley MicroStation CONNECT (affected version 10.16.0.80) is vulnerable due to a flaw in 3DS file parsing that can trigger a write past the end of an allocated buffer, enabling remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious file); ...

CVE-2021-46591

The CVE-2021-46591 entry covers Bentley MicroStation CONNECT 10.16.0.80. The vulnerability resides in the parsing of JT files, where crafted JT data can trigger a read past the end of an allocated buffer, enabling remote code execution in the context of the current process. Exploitation requires ...

CVE-2021-46601

Bentley MicroStation CONNECT JT File Parsing Use-After-Free Remote Code Execution (CVE-2021-46601) involves a vulnerability in the JT file parsing path where the software may perform operations on objects without validating their existence, leading to a use-after-free condition. This can allow re...

CVE-2021-46649

Bentley MicroStation CONNECT 10.16.0.80 is affected by CVE-2021-46649 due to an out-of-bounds read while parsing DGN files. The flaw stems from insufficient validation of user-supplied data, allowing reading beyond the end of an allocated buffer. This can disclose sensitive information and, in co...

CVE-2021-46579

Bentley MicroStation CONNECT 10.16.0.80 is affected by a JT file parsing use-after-free vulnerability that allows remote code execution. The root cause is failure to validate the existence of an object before operating on it during JT file processing, enabling an attacker to run code in the curre...

CVE-2021-46603

Bentley MicroStation CONNECT 10.16.0.80 is affected by CVE-2021-46603 due to a heap-based buffer overflow in the J2K image parser. The vulnerability arises from inadequate validation of the length of user-supplied data before copying it into a heap buffer, allowing remote attackers to execute arb...

CVE-2021-46565

Bentley MicroStation CONNECT 10.16.0.80 is affected by CVE-2021-46565, a vulnerability in parsing JT files where improper validation of user-supplied data length leads to a stack-based buffer overflow. This allows remote code execution in the context of the current process and requires user inter...

CVE-2021-46573

Bentley MicroStation CONNECT JT file parsing contains a use-after-free vulnerability that allows remote code execution. Affected versions include MicroStation CONNECT 10.16.0.80. Exploitation requires user interaction (visiting a malicious page or opening a malicious JT file). The issue arises fr...

CVE-2021-46598

Bentley MicroStation CONNECT 10.16.0.80 is affected by a memory corruption remote code execution vulnerability in the JT file parser. The flaw stems from insufficient validation of user-supplied data during JT file parsing, allowing an attacker to execute code with the current process context aft...

CVE-2021-46594

Bentley MicroStation CONNECT (10.16.0.80) is affected by CVE-2021-46594. The vulnerability is a DWG parsing buffer over-read caused by insufficient input validation, potentially allowing an attacker to disclose sensitive information and, in conjunction with other flaws, execute arbitrary code in ...

CVE-2021-46635

Bentley MicroStation CONNECT 10.16.0.80 is affected by a buffer overrun in the DGN file parser. Crafted DGN data can trigger a write past the end of an allocated buffer, enabling remote code execution in the context of the current process after the user visits a malicious page or opens a maliciou...

CVE-2021-46592

CVE-2021-46592 affects Bentley MicroStation CONNECT 10.16.0.80. The root cause is in the parsing of 3DS files where the code fails to validate the existence of an object before performing operations, leading to use-after-free and remote code execution. Exploitation requires user interaction (visi...

CVE-2021-46616

Bentley MicroStation CONNECT 10.16.0.80 is affected by a BMP image parsing flaw that can cause an out-of-bounds read in the parsing code. The issue, triggered by processing a malicious BMP, allows disclosure of sensitive data and can enable arbitrary code execution in the context of the current p...

CVE-2021-46633

CVE-2021-46633 affects Bentley MicroStation CONNECT 10.16.0.80. The root cause is improper validation of an object before operations during PDF parsing, enabling an attacker to execute arbitrary code in the current process. Requires user interaction (visiting a malicious page or opening a crafted...

CVE-2021-46571

CVE-2021-46571 affects Bentley View 10.16.0.80. The vulnerability arises in the JT file parsing code, due to not validating the existence of an object before performing operations, enabling remote code execution in the attacker’s context. Exploitation requires user interaction (visiting a malicio...

CVE-2021-46589

Bentley MicroStation CONNECT vulnerability CVE-2021-46589 involves a DGN file parsing flaw that can trigger an out-of-bounds read on an affected installation (MicroStation CONNECT 10.16.0.80). The issue stems from insufficient validation of user-supplied data and can allow an attacker to disclose...