Privilege escalation

An elevation of privilege vulnerability exists when the Windows CDP User Components improperly handle memory. To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges. The...

CVE-2020-1549 Windows CDP User Components Elevation of Privilege Vulnerability

...

CVE-2020-1549

CVE-2020-1549 is the Windows CDP User Components Elevation of Privilege vulnerability. It stems from improper memory handling in Windows CDP User Components, enabling an attacker who already has code execution on the system to run a crafted application to elevate privileges. The issue is addresse...

CVE-2020-1550

Technical details for CVE-2020-1550 are not publicly provided in the connected documents; the initial entry notes memory handling in Windows CDP User Components but no vendor/version/root-cause specifics are given here. Monitor for updates.

CVE-2020-1550 Windows CDP User Components Elevation of Privilege Vulnerability

...

Microsoft Windows and Microsoft Windows Server Elevation of Privilege Vulnerability (CNVD-2020-48270)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. An elevation of privilege vulnerability exists in Microsoft Windows and Microsoft Windows...

Windows CDP User Components Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Windows CDP User Components improperly handle memory. To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges. The...

Windows CDP User Components Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Windows CDP User Components improperly handle memory. To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges. The...

KB4566782: Windows 10 Version 2004 August 2020 Security Update

The remote Windows host is missing security update 4566782. It is, therefore, affected by multiple vulnerabilities : - A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exploited the vulnerability could instal...

KB4571709: Windows 10 Version 1803 August 2020 Security Update

The remote Windows host is missing security update 4571709. It is, therefore, affected by multiple vulnerabilities : - A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exploited the vulnerability could instal...

KB4571694: Windows 10 Version 1607 and Windows Server 2016 August 2020 Security Update

The remote Windows host is missing security update 4571694. It is, therefore, affected by multiple vulnerabilities : - A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exploited the vulnerability could instal...

KB4571741: Windows 10 Version 1709 August 2020 Security Update

The remote Windows host is missing security update 4571741. It is, therefore, affected by multiple vulnerabilities : - A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exploited the vulnerability could instal...

COMMAX WallPad Input Validation Error Vulnerability

COMMAX WallPad is a smart home control panel from COMMAX Korea. An input validation error vulnerability exists in the COMMAX WallPad CDP-1020MB version prior to 2019.12.30. An attacker can exploit this vulnerability to execute arbitrary code...

CVE-2019-19163

CVE-2019-19163 affects the COMMAX WallPad CDP-1020MB firmware. The vulnerability arises from an outdated MySQL version inside the device, enabling an unauthenticated adjacent attacker to execute arbitrary code. The documents describe the affected product and the root cause but do not provide expl...

CVE-2020-3119

A vulnerability in the Cisco Discovery Protocol implementation for Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability exists because the Cisco Discovery Protocol parser does not properly...

Cisco Discovery Protocol (CDP) enabled devices are vulnerable to denial-of-service and remote code execution

Overview Cisco Discovery Protocol CDP is a proprietary layer-2 networking protocol that Cisco devices use to gather information about devices connected to the network. Armis Security found that CDP supported devices are vulnerable to heap overflow in Cisco IP Cameras CVE-2020-3110, stack overflow...

BlockDev Sp. Z o.o: Earn free DAI interest (inflation) through instant CDP+DSR in one tx

Summary: The MCD contracts contain different mechanisms for accumulating rates in different contracts, namely pot and jug corresponding to the cost of a loan and interest earned on savings. Because these rates are not synchronised, and depend on the call to the drip method to be calculated, it's...

Cisco TelePresence Endpoint Command Shell Injection Vulnerability

According to its self-reported version, the Cisco TelePresence Codec TC and Collaboration Endpoint CE Cisco TelePresence Software is affected by a vulnerability in the Cisco Discovery Protocol CDP implementation which could allow an unauthenticated, adjacent attacker to inject arbitrary shell...

CVE-2019-1878

CVE-2019-1878 describes a shell-injection vulnerability in the Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE) software via the Cisco Discovery Protocol (CDP). The root cause is insufficient input validation of CDP packets, enabling an unauthenticated, adjacent attacker to craft CDP...

CVE-2019-1878 Cisco TelePresence Endpoint Command Shell Injection Vulnerability

A vulnerability in the Cisco Discovery Protocol CDP implementation for the Cisco TelePresence Codec TC and Collaboration Endpoint CE Software could allow an unauthenticated, adjacent attacker to inject arbitrary shell commands that are executed by the device. The vulnerability is due to...