CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2017-3563 – Oracle VM VirtualBox 5.0.32 r112930 (x64) - Windows Process COM Injection Privilege Escalation
https://notcve.org/view.php?id=CVE-2017-3563
The process hardening implemented by the VirtualBox driver can be circumvented to load arbitrary code inside a VirtualBox process giving access to the VBoxDrv driver which can allow routes to elevation of privilege from a normal user. • https://www.exploit-db.com/exploits/41908 http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html http://www.securityfocus.com/bid/97732 http://www.securitytracker.com/id/1038288 • CWE-295: Improper Certificate Validation •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2017-0312 – NVIDIA Driver 375.70 - DxgkDdiEscape 0x100008b Out-of-Bounds Read/Write
https://notcve.org/view.php?id=CVE-2017-0312
All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscapeID 0x100008b where user provided input is used as the limit for a loop may lead to denial of service or potential escalation of privileges Todas las versiones de NVIDIA Windows GPU Display Driver contienen una vulnerabilidad en el controlador de la capa del modo kernel (nvlddmkm.sys) para DxgkDdiEscapeID 0x100008b, donde la entrada proporcionada por el usuario se utiliza como límite para un bucle, puede dar lugar a una denegación de servicio o a una potencial escalada de privilegios. • https://www.exploit-db.com/exploits/41364 http://nvidia.custhelp.com/app/answers/detail/a_id/4398 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2017-0313 – NVIDIA Driver 375.70 - Buffer Overflow in Command Buffer Submission
https://notcve.org/view.php?id=CVE-2017-0313
All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) implementation of the SubmitCommandVirtual DDI (DxgkDdiSubmitCommandVirtual) where untrusted input is used to reference memory outside of the intended boundary of the buffer leading to denial of service or escalation of privileges. Todas las versiones de NVIDIA Windows GPU Display Driver contienen una vulnerabilidad en la implementación de la capa de modo kernel (nvlddmkm.sys) del SubmitCommandVirtual DDI (DxgkDdiSubmitCommandVirtual) donde una entrada no confiable se utiliza para hacer referencia a memoria fuera del límite previsto del búfer conduciendo a denegación de servicio o escalada de privilegios. • https://www.exploit-db.com/exploits/41365 http://nvidia.custhelp.com/app/answers/detail/a_id/4398 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2016-8823
https://notcve.org/view.php?id=CVE-2016-8823
All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgDdiEscape where the size of an input buffer is not validated leading to a denial of service or possible escalation of privileges Todas las versiones de NVIDIA Windows GPU Display Driver contienen una vulnerabilidad en el controlador de la capa de modo kernel para DxgDdiEscape donde el tamaño de un búfer de entrada no se valida conduciendo a una denegación de servicio o a una posible escalada de privilegios. • https://github.com/SpiralBL0CK/NDAY_CVE_2016_8823 http://nvidia.custhelp.com/app/answers/detail/a_id/4278 http://www.securityfocus.com/bid/94918 http://www.talosintelligence.com/reports/TALOS-2016-0217 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2016-5647
https://notcve.org/view.php?id=CVE-2016-5647
The igdkmd64 module in the Intel Graphics Driver through 15.33.42.435, 15.36.x through 15.36.30.4385, and 15.40.x through 15.40.4404 on Windows allows local users to cause a denial of service (crash) or gain privileges via a crafted D3DKMTEscape request. El módulo igdkmd64 en el Intel Graphics Driver hasta la versión 15.33.42.435, 15.36.x hasta la versión 15.36.30.4385 y 15.40.x hasta la versión 15.40.4404 en Windows pernute a usuarios locales provocar una denegación de servicio (caída) u obtener privilegios a través de una petición D3DKMTEscape manipulada. • http://www.securityfocus.com/bid/91708 http://www.talosintelligence.com/reports/TALOS-2016-0087 https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00054&languageid=en-fr https://support.lenovo.com/us/en/product_security/ps500068 • CWE-264: Permissions, Privileges, and Access Controls •