CVE-2008-1255

The ZyXEL P-660HW series router maintains authentication state by IP address, which allows remote attackers to bypass authentication by establishing a session from a source IP address of a previously authenticated user...

CVE-2008-1261

The Zyxel P-2602HW-D1A router with 3.40AJZ.1 firmware provides different responses to admin page requests depending on whether a user is logged in, which allows remote attackers to obtain current login status by requesting an arbitrary admin URI...

CVE-2008-1255

The ZyXEL P-660HW series router maintains authentication state by IP address, which allows remote attackers to bypass authentication by establishing a session from a source IP address of a previously authenticated user...

CVE-2008-1256

The ZyXEL P-660HW series router has "admin" as its default password, which allows remote attackers to gain administrative access...

CVE-2008-1255

The CVE-2008-1255 entry concerns the ZyXEL P-660HW series router. The vulnerability arises because the device maintains authentication state by source IP, allowing a remote attacker to bypass authentication by initiating a session from the IP address of a previously authenticated user. This affec...

CVE-2008-1256

Affected product : ZyXEL P-660HW series routers. Vulnerability : default password “admin” enables remote attackers to gain administrative access. Root cause / detail : the vulnerability stems from using a default credential, allowing unauthenticated remote administration. Impact : total compromis...

CVE-2008-1254

CVE-2008-1254 concerns the ZyXEL P-660HW series router and describes multiple CSRF vulnerabilities. The affected functionality is the web management interface, where remote attackers could (via unspecified vectors) change DNS servers and add keywords to the ban list. The entry provides a CVSS v2 ...

CVE-2008-1260

The CVE-2008-1260 entry affects the Zyxel P-2602HW-D1A router running firmware 3.40(AJZ.1). The described vulnerabilities are CSRF flaws that let remote attackers (no authentication required) influence the device: (1) expose the admin web server on WAN via WWWAccessInterface in Forms/RemMagWWW_1,...

CVE-2008-1257

Cross-site scripting XSS vulnerability in Forms/DiagGeneral2 on the ZyXEL P-660HW series router allows remote attackers to inject arbitrary web script or HTML via the PingIPAddr parameter...

CVE-2008-1257

CVE-2008-1257 is a cross-site scripting (XSS) vulnerability affecting ZyXEL P-660HW series routers, exploitable via the PingIPAddr parameter under Forms/DiagGeneral_2. Attackers can inject arbitrary web script or HTML in the router’s web interface. According to the connected NVD entry, the affect...

CVE-2008-1261

The CVE-2008-1261 entry affects the Zyxel P-2602HW-D1A router (firmware 3.40(AJZ.1)). The vulnerability arises because the device’s admin page responses differ based on whether a user is logged in, enabling remote attackers to learn the current login status by requesting an arbitrary admin URI. T...

mod_autoindex XSS

Cross-site scripting XSS vulnerability in modautoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that th...

mod_autoindex XSS

Cross-site scripting XSS vulnerability in modautoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that th...

mod_autoindex XSS

Cross-site scripting XSS vulnerability in modautoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that th...

CVE-2008-0191

WordPress 2.2.x and 2.3.x allows remote attackers to obtain sensitive information via an invalid p parameter in an rss2 action to the default URI, which reveals the full path and the SQL database structure...

CVE-2007-6658

SQL injection vulnerability in admin.php/vars.php in CustomCMS CCMS 3.1 Demo allows remote attackers to execute arbitrary SQL commands via the p parameter in the Console page...

Sql injection

SQL injection vulnerability in admin.php/vars.php in CustomCMS CCMS 3.1 Demo allows remote attackers to execute arbitrary SQL commands via the p parameter in the Console page...

CVE-2007-6648

Directory traversal vulnerability in index.php in SanyBee Gallery 0.1.0 and 0.1.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter...

ZyXEL P-330W跨站脚本执行及请求伪造漏洞

BUGTRAQ ID: 27024 ZyXEL P-330W是一款无线宽带路由器。 ZyXEL P-330W处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞攻击用户系统。 ZyXEL P-330W的ping.asp文件中没有正确地过滤对pingstr参数的输入便返回给了用户，这允许攻击者通过跨站脚本在用户浏览器会话中执行任意HTML和脚本代码；此外设备还允许用户通过HTTP请求执行各种操作，但没有验证请求的有效性，这可能允许攻击者通过伪造请求执行各种攻击，如更改管理员口令。 ZyXEL P-330W ZyXEL -----...

zyxel-xssxsrf.txt

ZyXEL P-330W “Secure Wireless Internet Sharing Router” is vulnerable to multiple XSS and XSRF attacks. There are a plethora of XSS vulns in the web-based management interface so I'll leave it to you to discover these gifts on your own. Here is a starting point: http://:/ping.asp?pingstr=”alert"M...