CVE-2019-10631

Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via multiple different requests...

CVE-2019-10632

A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the location of any other user's files...

Design/Logic Flaw

Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via multiple different requests...

Directory traversal

A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the location of any other user's files...

CVE-2019-10634

An XSS vulnerability in the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to inject arbitrary JavaScript or HTML via the user, group, and file-share description fields...

CVE-2019-10634

An XSS vulnerability in the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to inject arbitrary JavaScript or HTML via the user, group, and file-share description fields...

CVE-2019-10633

An eval injection vulnerability in the Python web server routing on the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to execute arbitrary code via the tjp6jp6y4, simZysh, and ck6fup6 APIs...

CVE-2019-10633

CVE-2019-10633 affects Zyxel NAS326 (firmware 5.21 and earlier). It is an eval injection vulnerability in the Python web server routing, enabling a remote authenticated attacker to execute arbitrary code via the tjp6jp6y4, simZysh, and ck6fup6 APIs. Root cause is eval-based handling in the routin...

CVE-2019-10632

A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the location of any other user's files...

CVE-2019-10631

CVE-2019-10631 describes a Shell Metacharacter Injection in the Zyxel NAS 326 package installer (versions 5.21 and earlier). An authenticated attacker can execute arbitrary code via multiple different requests. Affected product: Zyxel NAS 326 (Hopscotch). Root cause: shell metacharacter handling ...

CVE-2019-10630

CVE-2019-10630 affects Zyxel NAS326 (Hopscotch) up to firmware 5.21, where a plaintext password vulnerability lets an elevated privileged user obtain the device admin password. The root cause is described as plaintext password handling in the affected firmware. The available documents do not spec...

Zyxel NAS 326 Cross-Site Scripting Vulnerability

The Zyxel NAS 326 is a two-drive personal cloud storage device from Zyxel. A cross-site scripting vulnerability exists in Zyxel NAS 326 version 5.21 and earlier. A remote authenticated attacker can exploit this vulnerability to inject arbitrary JavaScript or HTML via the user, group, and file sha...

Zyxel NAS 326 eval injection vulnerability

Zyxel NAS 326 is a two-drive personal cloud storage device from Zyxel Hopscotch. An eval injection vulnerability exists in the Python web server routing in Zyxel NAS 326 5.21 and earlier versions. A remote authenticated attacker can exploit this vulnerability to execute arbitrary code via the...

The vulnerability of the check_login function in the D-Link DNR-326 router microprogramming system allows a hacker to bypass the authentication process.

The vulnerability of the checklogin function in the D–Link DNR-326 router microprogramming system is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass the authentication process and register using the user’s cookie parameter...

CVE-2014-7858

The checklogin function in D-Link DNR-326 before 2.10 build 03 allows remote attackers to bypass authentication and log in by setting the username cookie parameter to an arbitrary string...

Authentication flaw

The checklogin function in D-Link DNR-326 before 2.10 build 03 allows remote attackers to bypass authentication and log in by setting the username cookie parameter to an arbitrary string...

CVE-2014-7858

The CVE-2014-7858 entry concerns D-Link DNR-326 prior to 2.10 build 03, where the check_login authentication flow is flawed. The weakness allows remote attackers to bypass authentication by manipulating the username cookie parameter, enabling login without proper credentials. Documented impact is...

CVE-2014-7857

D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01, DNS-345 1.03b06, DNS-325 1.05b03, and DNS-322L 2.00b07 allow remote attackers to bypass authentication and log in with administrator permissions by passing the cgisetwto command in the c...

CVE-2014-7857

CVE-2014-7857 affects multiple D-Link NAS/DVR devices (DNS-320L, DNS-327L, DNR-326, DNS-320B, DNS-345, DNS-325, DNS-322L). The root issue is a weakness in the authentication flow: an attacker can bypass login by sending the cgi_set_wto command in the cmd parameter and forcing the spawned session ...

CVE-2014-7858

The checklogin function in D-Link DNR-326 before 2.10 build 03 allows remote attackers to bypass authentication and log in by setting the username cookie parameter to an arbitrary string...