CVSS: 7.8EPSS: 0%CPEs: 47EXPL: 0CVE-2021-27041 – ICONICS GENESIS64 DWG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-27041
A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. This vulnerability can be exploited to execute arbitrary code Un archivo DWG malicioso puede ser utilizado para escribir más allá del buffer asignado mientras se analizan los archivos DWG. Esta vulnerabilidad puede ser explotada para ejecutar código arbitrario This vulnerability allows remote attackers to execute arbitrary code on affected installations of ICONICS GENESIS64. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. • https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007 • CWE-787: Out-of-bounds Write •
CVSS: 4.3EPSS: 0%CPEs: 43EXPL: 0CVE-2021-27040 – ICONICS GENESIS64 DWG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2021-27040
A maliciously crafted DWG file can be forced to read beyond allocated boundaries when parsing the DWG file. This vulnerability can be exploited to execute arbitrary code. Un archivo DWG diseñado maliciosamente puede ser forzado a leer más allá de los límites asignados al analizar el archivo DWG. Esta vulnerabilidad puede ser explotada para ejecutar código arbitrario This vulnerability allows remote attackers to disclose sensitive information on affected installations of ICONICS GENESIS64. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. • https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0004 https://www.zerodayinitiative.com/advisories/ZDI-21-1236 https://www.zerodayinitiative.com/advisories/ZDI-21-1238 https://www.zerodayinitiative.com/advisories/ZDI-22-378 https://www.zerodayinitiative.com/advisories/ZDI-22-473 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 41EXPL: 0CVE-2019-7364
https://notcve.org/view.php?id=CVE-2019-7364
DLL preloading vulnerability in versions 2017, 2018, 2019, and 2020 of Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D and version 2017 of AutoCAD P&ID. An attacker may trick a user into opening a malicious DWG file that may leverage a DLL preloading vulnerability in AutoCAD which may result in code execution. Vulnerabilidad de precarga de DLL en las versiones 2017, 2018, 2019 y 2020 de Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D y la versión 2017 de AutoCAD P&ID. Un atacante puede engañar a un usuario para que abra un archivo DWG malicioso que puede aprovechar una vulnerabilidad de precarga de DLL en AutoCAD que puede provocar la ejecución del código. • https://www.autodesk.com/trust/security-advisories/adsk-sa-2019-0002 • CWE-427: Uncontrolled Search Path Element •