CVE Vulnerability Catalog

The Comcast firmware on Cisco DPC3939 and DPC3941T devices allows remote attackers to access the web UI by establishing a session to the wan0 WAN IPv6 address and then entering unspecified hardcoded credentials.

The Comcast firmware on Cisco DPC3939 devices allows remote attackers to compute password-of-the-day values via unspecified vectors.

The Comcast firmware on Cisco DPC3939 devices allows remote attackers to write arbitrary data to a known /var/tmp/sess_* pathname by leveraging the device's operation in UI dev mode.

The Comcast firmware on Cisco DPC3939 devices allows remote attackers to discover a CM MAC address by sniffing Wi-Fi traffic and performing simple arithmetic calculations.

The Comcast firmware on Cisco DPC3939 devices allows Network Processor Linux users to obtain root access to the Application Processor Linux system via shell metacharacters in commands.

The Comcast firmware on Cisco DPC3939 devices allows remote attackers to obtain root access to the Network Processor (NP) Linux system by enabling a TELNET daemon and then establishing a TELNET session.

The Comcast firmware on Cisco DPC3939 devices allows remote attackers to obtain unintended access to the 169.254/16 IP network by adding a routing-table entry that specifies the LAN IP address as the router for that network.

The Comcast firmware on Cisco DPC3939 devices allows remote attackers to execute arbitrary commands as root by leveraging local network access and connecting to the syseventd server.

The Comcast firmware on Cisco DPC3939 devices sets the CM MAC address with a two-byte offset from the MTA/VoIP MAC address, allowing remote attackers to discover hidden Home Security Wi-Fi networks.

In Earcms Ear Music through version 4.1 build 20170710, remote authenticated users can execute arbitrary PHP code by changing the allowable music-upload extensions to include .php in addition to .mp3 and .m4a in admin.php?iframe=config_upload, and then using user.php/music/add/ to upload the code.

The function 'Token& Scanner::peek' in yaml-cpp version 0.5.3 and earlier allows remote attackers to cause a denial of service via a '!2' string.

InternetSoft FTP Commander version 8.02 and prior has an untrusted search path, allowing DLL hijacking via a malicious dwmapi.dll file.

VIT Spider Player version 2.5.3 has an untrusted search path, allowing DLL hijacking via a Trojan horse dwmapi.dll, olepro32.dll, dsound.dll, or AUDIOSES.dll file.

Tenshi 0.15 creates a tenshi.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by modifying tenshi.pid before a root script executes a 'kill `cat /pathname/tenshi.pid`' command.

The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat versions 2.2.1 and 2.2.2 on Windows allows local users to gain privileges via a Trojan horse ADVAPI32.DLL in the current working directory due to an untrusted search path, known as DLL hijacking.

Version 4.2.18 of BigTree contains an SQL injection vulnerability in process.php, allowing remote authenticated users to execute arbitrary SQL commands via the tags array parameter.

In Xinha 0.96, used in Jojo 4.4.0, there is a directory traversal vulnerability in plugins/ImageManager/backend.php that allows remote attackers to delete any folder via directory traversal sequences in the deld parameter.

VMware vCenter Server versions 5.5, 6.0, and 6.5 allow vSphere users with limited privileges to use the VIX API to access Guest Operating Systems without the need for authentication.

The NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where a NULL pointer dereference may lead to denial of service or potential escalation of privileges.

The NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a value passed from a user to the driver is not correctly validated and used as the index to an array.