Vulnerabilities > ATT > High

DATE CVE VULNERABILITY TITLE RISK
2021-08-13 CVE-2021-21812 Out-of-bounds Write vulnerability in ATT Xmill 0.7
A stack-based buffer overflow vulnerability exists in the command-line-parsing HandleFileArg functionality of AT&T Labs’ Xmill 0.7.
local
low complexity
att CWE-787
7.8
2021-08-13 CVE-2021-21813 Out-of-bounds Write vulnerability in ATT Xmill 0.7
Within the function HandleFileArg the argument filepattern is under control of the user who passes it in from the command line.
local
low complexity
att CWE-787
7.8
2021-08-13 CVE-2021-21814 Argument Injection or Modification vulnerability in ATT Xmill 0.7
Within the function HandleFileArg the argument filepattern is under control of the user who passes it in from the command line.
local
low complexity
att CWE-88
7.8
2021-08-13 CVE-2021-21815 Out-of-bounds Write vulnerability in ATT Xmill 0.7
A stack-based buffer overflow vulnerability exists in the command-line-parsing HandleFileArg functionality of AT&T Labs' Xmill 0.7.
local
low complexity
att CWE-787
7.8
2021-07-19 CVE-2020-22650 Memory Leak vulnerability in ATT Alienvault Ossim 5.0
A memory leak vulnerability in sim-organizer.c of AlienVault Ossim v5 causes a denial of service (DOS) via a system crash triggered by the occurrence of a large number of alarm events.
network
low complexity
att CWE-401
7.5
2020-02-12 CVE-2013-7286 Inadequate Encryption Strength vulnerability in ATT products
MobileIron VSP < 5.9.1 and Sentry < 5.0 has a weak password obfuscation algorithm
network
low complexity
att CWE-326
7.5
2017-09-03 CVE-2017-14116 Use of Hard-coded Credentials vulnerability in ATT U-Verse Firmware 9.2.2H0D83
The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG599 device, when IP Passthrough mode is not used, configures WAN access to a caserver https service with the tech account and an empty password, which allows remote attackers to obtain root privileges by establishing a session on port 49955 and then installing new software, such as BusyBox with "nc -l" support.
network
high complexity
att CWE-798
8.1
2017-09-03 CVE-2017-14115 Use of Hard-coded Credentials vulnerability in ATT U-Verse Firmware 9.2.2H0D83
The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures ssh-permanent-enable WAN SSH logins to the remotessh account with the 5SaP9I26 password, which allows remote attackers to access a "Terminal shell v1.0" service, and subsequently obtain unrestricted root privileges, by establishing an SSH session and then entering certain shell metacharacters and BusyBox commands.
network
high complexity
att CWE-798
8.1
2017-09-03 CVE-2017-10793 Information Exposure vulnerability in ATT U-Verse Firmware 9.2.2H0D83
The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589, NVG599, and unspecified other devices, when IP Passthrough mode is not used, configures an sbdc.ha WAN TCP service on port 61001 with the bdctest account and the bdctest password, which allows remote attackers to obtain sensitive information (such as the Wi-Fi password) by leveraging knowledge of a hardware identifier, related to the Bulk Data Collection (BDC) mechanism defined in Broadband Forum technical reports.
network
high complexity
att CWE-200
8.1