Bentley Systems
Bug bounty on Self-hosted bentley.com
Accepting reports
Full safe harbor
KYC to get paid
- Top reward
- $1,200
- Top severity paid
- Not published
- Assets in scope
- 14
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $1,200
- top reward, from $100.
- Report by email
- https://bentley.jotform.com/230592159225254?isIframeEmbed=1
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Paid by PayPal
- Proof of identity needed to get paid.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$1,200
Remote Code Execution │ 1200
- Lowest reward
-
$100
DLL hijacking │ 100
- Safe harbor
-
Full
Not to pursue or support any legal action related to your research.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
14 assets you may test, 12 excluded.
Domains 8
- bentley.com
- community.seequent.com
- eventhub.bentley.com
- events.seequent.com
- imodeljs.org
- lms.seequentlearning.com
- partners.seequent.com
- seequent.frontify.com
Desktop and binaries 1
- All Bentley Systems desktop products (Only CONNECT Edition and Later)
Source code 1
- All Bentley Open-Source Projects (including imodeljs.org)
Wildcard domains 1
- all _.bentley.com subdomains
Products and areas 3
- All Bentley Cloud Applications and Services
- All Bentley Systems mobile apps (distributed only on Play and App stores)
- Bentley Systems’ Infrastructure (VPN, Mail Server, SharePoint, Skype, etc.)
Out of scope (12)
- eventhub.bentley.com
- Any services hosted by 3rd-party providers and services
- Findings derived primarily from social engineering (e.g., phishing, vishing)
- Findings from applications or systems not listed in the ‘Scope’ section
- Findings from physical testing, such as office access (e.g., open doors, tailgating)
- Obsolete/deprecated software
- On24 related issues
- https://community.seequent.com
- https://events.seequent.com
- https://lms.seequentlearning.com
- https://partners.seequent.com
- https://seequent.frontify.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Bentley Systems's policy. "We" in these lines means the program, not this site.
While testing
-
Avoid privacy violations, degradation of user experience, disruption to production systems, and destruction of data during security testing.
-
Perform research only within the scope set out below.
-
Keep information about any vulnerabilities you have discovered confidential between you and Bentley Systems until it is fixed.
-
DoS is strictly prohibited.
-
Any form of credentials brute forcing is strictly prohibited.
-
Public disclosure of a reported vulnerability before it has been fixed is prohibited.
-
You may not destroy or degrade our performance or violate the privacy or integrity of our users and their data.
-
Exploiting vulnerabilities (other than a generic PoC) is strictly prohibited and will be prosecuted according to applicable law.
-
Limit the amount of data you access to the minimum required for effectively demonstrating a Proof of Concept; and
Not accepted
-
DoS, and application-level DoS (unless the response is asymmetrical compared to the initial request)
-
Publicly released bugs in internet software within 15 days of their disclosure
-
Self-XSS (we require evidence on how the XSS can be used to attack another user)
-
CSRF without any security impact (e.g. Logout CSRF)
-
X-Frame-Options related (clickjacking)
-
Header injection (unless you can show how they can lead to stealing user data)
-
Issues that are non-exploitable but lead to crashes, stack trace, and similar information leak or stability issues.
-
Version exposure (unless you deliver a PoC of working exploit).
-
Anything requiring outdated browsers, platforms, or crypto (i.e. TLS BEAST, POODLE, etc.)
-
Spam or Social Engineering techniques, including SPF and DKIM issues
-
Rate limit vulnerability not on a login functionality (unless a valid exploit PoC provided)
-
XMLRPC.php file is enabled leading to DoS attack
-
Missing cookie flags on non-sensitive cookies
-
Missing security headers which do not lead directly to a vulnerability (unless you deliver a PoC)
-
Anything from an automated scan
-
Anything that is public by default (e.g. public keys, config files without sensitive information, etc.)
-
Anything not under Bentley Systems control (e.g. Google Analytics, etc.)
-
Theoretical issues that lack practical severity
-
UI and UX bugs and spelling mistakes
-
Credentials found at breach forums like [https://breachforums.st, https://phonebook.cz] etc.
-
CAA certificate missing
-
User enumeration in WP, when only a few Bentley employees, who posted on the website, are exposed
-
Origin IP exposure
-
Misconfigurations on non-resolving URLs
-
AppInsights key exposure
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2022-43656 | Bentley View FBX File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FBX files. Cra | Medium 5.5 | 7 May 2024 |
| CVE-2022-43651 | Bentley View SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue result | High 7.8 | 7 May 2024 |
| CVE-2022-43652 | Bentley View SKP File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The iss | Medium 5.5 | 7 May 2024 |
| CVE-2022-43653 | Bentley View SKP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. Crafted dat | High 7.8 | 7 May 2024 |
| CVE-2022-43655 | Bentley View FBX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FBX files. The | High 7.8 | 7 May 2024 |
| CVE-2023-44430 | Bentley View SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue result | High 7.8 | 3 May 2024 |
| CVE-2023-51708 | Bentley eB System Management Console applications within Assetwise Integrity Information Server allow an unauthenticated user to view configuration options via a crafted request, leading to information disclosure. This affects eB System management Console before 23.00.02.03 and Assetwise ALIM For Transportation before 23.00.01.25. | High 8.6 | 22 Dec 2023 |
| CVE-2023-4863 | Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical) | High 8.8 | 12 Sep 2023 |
| CVE-2022-28641 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. The issue results from the lack of validating the existence of an obje | High 7.8 | 29 Mar 2023 |
| CVE-2022-28642 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. Crafted data in a DGN file can trigger a write past the end of an allo | High 7.8 | 29 Mar 2023 |
| CVE-2022-28643 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. Crafted data in a DGN file can trigger a write past the end of an allo | High 7.8 | 29 Mar 2023 |
| CVE-2022-28644 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. Crafted data in a DGN file can trigger a write past the end of an allo | High 7.8 | 29 Mar 2023 |
| CVE-2022-28645 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. Crafted data in a DGN file can trigger a read past the end of | Medium 5.5 | 29 Mar 2023 |
| CVE-2022-28646 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.2.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an all | High 7.8 | 29 Mar 2023 |
| CVE-2022-28647 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.2.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a read past the end of an allo | High 7.8 | 29 Mar 2023 |
| CVE-2022-28306 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OBJ files. The issue results from the lack of proper validation of the length of | High 7.8 | 29 Mar 2023 |
| CVE-2022-28307 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.16.02.022. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. Crafted data in a DXF file can trigger a read past the end of an allocated buffer. An | High 7.8 | 29 Mar 2023 |
| CVE-2022-28308 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.16.02.022. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DS files. Crafted data in a 3DS file can trigger a read past the end of an allocated bu | Medium 5.5 | 29 Mar 2023 |
| CVE-2022-28309 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.16.02.022. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DS files. Crafted data in a 3DS file can trigger a read past the end of an allocated bu | Medium 5.5 | 29 Mar 2023 |
| CVE-2022-28310 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an obj | High 7.8 | 29 Mar 2023 |
| CVE-2022-28311 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. Crafted data in a DXF file can trigger a read past the end of an allo | High 7.8 | 29 Mar 2023 |
| CVE-2022-28312 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DS files. Crafted data in a 3DS file can trigger a read past the end of | Medium 5.5 | 29 Mar 2023 |
| CVE-2022-28313 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DS files. Crafted data in a 3DS file can trigger a read past the end of | Medium 5.5 | 29 Mar 2023 |
| CVE-2022-28314 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an all | High 7.8 | 29 Mar 2023 |
| CVE-2022-28315 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. The issue results from the lack of proper validation of the length of | High 7.8 | 29 Mar 2023 |
| CVE-2022-28316 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an all | High 7.8 | 29 Mar 2023 |
| CVE-2022-28317 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. The issue results from the lack of proper initialization of memory pri | High 7.8 | 29 Mar 2023 |
| CVE-2022-28318 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an all | High 7.8 | 29 Mar 2023 |
| CVE-2022-28319 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DM files. The issue results from the lack of proper initialization of memory pr | High 7.8 | 29 Mar 2023 |
| CVE-2022-28320 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.16.02.022. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DM files. The issue results from the lack of proper initialization of memory prior to accessing | High 7.8 | 29 Mar 2023 |
| CVE-2022-28300 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation 10.16.02.034 CONNECT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 images. Crafted data in a JP2 file can trigger a write past the end of an al | High 7.8 | 29 Mar 2023 |
| CVE-2022-28301 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an all | High 7.8 | 29 Mar 2023 |
| CVE-2022-28302 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a read past the end of an allo | High 7.8 | 29 Mar 2023 |
| CVE-2022-28303 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.16.02.022. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to per | High 7.8 | 29 Mar 2023 |
| CVE-2022-28304 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OBJ files. The issue results from the lack of proper validation of the length of | High 7.8 | 29 Mar 2023 |
| CVE-2022-28305 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OBJ files. The issue results from the lack of proper validation of the length of | High 7.8 | 29 Mar 2023 |
| CVE-2022-1229 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.2.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an all | High 7.8 | 28 Mar 2023 |
| CVE-2022-40201 | Bentley Systems MicroStation Connect versions 10.17.0.209 and prior are vulnerable to a Stack-Based Buffer Overflow when a malformed design (DGN) file is parsed. This may allow an attacker to execute arbitrary code. | High 7.8 | 6 Jan 2023 |
| CVE-2022-41613 | Bentley Systems MicroStation Connect versions 10.17.0.209 and prior are vulnerable to an Out-of-Bounds Read when when parsing DGN files, which may allow an attacker to crash the product, disclose sensitive information, or execute arbitrary code. | High 7.8 | 6 Jan 2023 |
| CVE-2022-42899 | Bentley MicroStation and MicroStation-based applications may be affected by out-of-bounds read and stack overflow issues when opening crafted SKP files. Exploiting these issues could lead to information disclosure and code execution. The fixed versions are 10.17.01.58* for MicroStation and 10.17.01.19* for Bentley View. | High 7.8 | 13 Oct 2022 |
| CVE-2022-42900 | Bentley MicroStation and MicroStation-based applications may be affected by out-of-bounds read issues when opening crafted FBX files. Exploiting these issues could lead to information disclosure and code execution. The fixed versions are 10.17.01.58* for MicroStation and 10.17.01.19* for Bentley View. | High 7.8 | 13 Oct 2022 |
| CVE-2022-42901 | Bentley MicroStation and MicroStation-based applications may be affected by out-of-bounds and stack overflow issues when opening crafted XMT files. Exploiting these issues could lead to information disclosure and code execution. The fixed versions are 10.17.01.58* for MicroStation and 10.17.01.19* for Bentley View. | High 7.8 | 13 Oct 2022 |
| CVE-2022-35904 | An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open an IFC file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within the parsing of IFC files could enable an attacker to read information in the context of the current pr | Low 3.3 | 15 Jul 2022 |
| CVE-2022-35905 | An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open an FBX file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within the parsing of FBX files could enable an attacker to read information in the context of the current pr | Low 3.3 | 15 Jul 2022 |
| CVE-2022-35906 | An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open a DGN file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within the parsing of DGN files could enable an attacker to read information in the context of the current pro | Low 3.3 | 15 Jul 2022 |
| CVE-2022-35900 | An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open a JP2 file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within the parsing of JP2 files could enable an attacker to read information in the context of the current pro | Low 3.3 | 15 Jul 2022 |
| CVE-2022-35901 | An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open a J2K file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within the parsing of J2K files could enable an attacker to read information in the context of the current pro | Low 3.3 | 15 Jul 2022 |
| CVE-2022-35902 | An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open an OBJ file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within the parsing of OBJ files could enable an attacker to read information in the context of the current pr | Low 3.3 | 15 Jul 2022 |
| CVE-2022-35903 | An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open a 3DS file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within the parsing of 3DS files could enable an attacker to read information in the context of the current pro | Low 3.3 | 15 Jul 2022 |
| CVE-2021-46646 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. Crafted data in a DGN file can trigger a write past the end of an alloc | High 7.8 | 18 Feb 2022 |
| CVE-2021-46647 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BMP images. The issue results from the lack of proper validation of the length of | High 7.8 | 18 Feb 2022 |
| CVE-2021-46648 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. The issue results from the lack of proper validation of the length of u | High 7.8 | 18 Feb 2022 |
| CVE-2021-46649 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. The issue results from the lack of proper validation of user-su | Medium 5.5 | 18 Feb 2022 |
| CVE-2021-46650 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. The issue results from the lack of proper validation of user-su | Medium 5.5 | 18 Feb 2022 |
| CVE-2021-46651 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. The issue results from the lack of proper validation of user-su | Medium 5.5 | 18 Feb 2022 |
| CVE-2021-46652 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. Crafted data in a DGN file can trigger a write past the end of an allocated buffer. An | High 7.8 | 18 Feb 2022 |
| CVE-2021-46653 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BMP images. The issue results from the lack of proper validation of the length of user-supplied da | High 7.8 | 18 Feb 2022 |
| CVE-2021-46654 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. The issue results from the lack of proper validation of user-supplied data, whi | Medium 5.5 | 18 Feb 2022 |
| CVE-2021-46655 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of validating the existence of an object prior to perfor | High 7.8 | 18 Feb 2022 |
| CVE-2021-46656 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An at | High 7.8 | 18 Feb 2022 |