CVE-2020-16136: Improper Limitation of a Pathname to a Restricted Directory

In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine accessible by the owner of the server process via directory traversal ../ sequences in /Administration/Logs/ requests. The attacker is unable to enumerate files,...

PT-2020-9332

Name of the Vulnerable Software and Affected Versions: NETGEAR Nighthawk X10-R900 versions prior to 1.0.4.24 Description: The issue allows an attacker to execute stored XSS attacks against the device by sending a DHCP discover request with a malicious hostname field. When the malicious request is...

CVE-2019-12513: Improper Neutralization of Input During Web Page Generation

In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, by sending a DHCP discover request containing a malicious hostname field, an attacker may execute stored XSS attacks against this device. When the malicious DHCP request is received, the device will generate a log entry containing the malicious...