PT-2020-8842

Name of the Vulnerable Software and Affected Versions NETGEAR D6100 versions 1.0.0.0 through 1.0.0.56 NETGEAR R7800 versions 1.0.0.0 through 1.2.0.43 NETGEAR R9000 versions 1.0.0.0 through 1.0.2.51 NETGEAR WNDR3700v4 versions 1.0.0.0 through 1.0.2.91 NETGEAR WNDR4300 versions 1.0.0.0 through...

PT-2020-8818

Name of the Vulnerable Software and Affected Versions D6100 versions prior to 1.0.0.57 R7500 versions prior to 1.0.0.122 R7800 versions prior to 1.0.2.40 R9000 versions prior to 1.0.2.52 WNDR3700v4 versions prior to 1.0.2.92 WNDR4300 versions prior to 1.0.2.94 WNDR4300v2 versions prior to 1.0.0.5...

CVE-2018-21100: Improper Neutralization of Special Elements used in an OS Command

NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user...

PT-2020-8755

Name of the Vulnerable Software and Affected Versions D3600 versions 1.0.0.0 through 1.0.0.74 D6000 versions 1.0.0.0 through 1.0.0.74 D6100 versions 1.0.0.0 through 1.0.0.59 R7800 versions 1.0.0.0 through 1.0.2.51 R8900 versions 1.0.0.0 through 1.0.4.1 R9000 versions 1.0.0.0 through 1.0.4.1...

CVE-2020-8474: Improper Privilege Management

Weak Registry permissions in ABB System 800xA Base allow low privileged users to read and modify registry settings related to control system functionality, allowing an authenticated attacker to cause system functions to stop or malfunction...

CVE-2018-21112: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.44, R7500v2 before 1.0.3.38, R7800 before 1.0.2.52, R8900 before 1.0.4.12, and R9000 before 1.0.4.12...

CVE-2018-21146: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.34, R7800 before 1.0.2.42, R8900 before 1.0.3.10, R9000 before 1.0.3.10, WNDR4300v2 before 1.0.0.54, and WNDR4500v3 before 1.0.0.54...

PT-2020-10694

Name of the Vulnerable Software and Affected Versions NETGEAR D6220 versions 1.0.0.0 through 1.0.0.47 NETGEAR D6400 versions 1.0.0.0 through 1.0.0.81 NETGEAR D7000v2 versions 1.0.0.0 through 1.0.0.51 NETGEAR D8500 versions 1.0.0.0 through 1.0.3.42 NETGEAR R6250 versions 1.0.0.0 through 1.0.4.33...

CVE-2019-20728: Buffer Copy without Checking Size of Input

Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects D6400 before 1.0.0.74, D7000v2 before 1.0.0.74, D7800 before 1.0.1.34, D8500 before 1.0.3.39, DGN2200v4 before 1.0.0.102, DGND2200Bv4 before 1.0.0.102, DM200 before 1.0.0.52, JNDR3000 before 1.0.0.22,...

CVE-2020-1624: Insertion of Sensitive Information into Log File

A local, authenticated user with shell can obtain the hashed values of login passwords and shared secrets via raw objmon configuration files. This issue affects all versions of Junos OS Evolved prior to 19.1R1...

CVE-2020-6647

An improper neutralization of input vulnerability in the dashboard of FortiADC may allow an authenticated attacker to perform a cross site scripting attack XSS via the name parameter...

CVE-2020-11516: Improper Neutralization of Input During Web Page Generation

Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected wpajaxcf7dpsavesettings AJAX action and the uitheme parameter. If an administrator creat...

CVE-2020-8423

A buffer overflow in the httpd daemon on TP-Link TL-WR841N V10 firmware version 3.16.9 devices allows an authenticated remote attacker to execute arbitrary code via a GET request to the page for the configuration of the Wi-Fi network...

CVE-2020-5558: Improper Control of Generation of Code

CuteNews 2.0.1 allows remote authenticated attackers to execute arbitrary PHP code via unspecified vectors...

CVE-2020-10173: Improper Neutralization of Special Elements used in an OS Command

Comtrend VR-3033 DE11-416SSG-C01R02.A2pvI042j1.d26m devices have Multiple Authenticated Command Injection vulnerabilities via the ping and traceroute diagnostic pages, as demonstrated by shell metacharacters in the pingIpAddress parameter to ping.cgi...

CVE-2019-20499: Improper Neutralization of Special Elements used in an OS Command

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=configrestore configRestore or configServerip parameter...

CVE-2019-19223

A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface Firmware EU1.03 allows an attacker to reboot the router by submitting a reboot.html GET request without being authenticated on the admin interface...

CVE-2020-5534

Aterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via unspecified vectors...

CVE-2020-5525: Improper Neutralization of Special Elements used in an OS Command

Aterm series Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via management screen...

Design/Logic Flaw

On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI syscmd.htm is not available. This allows for full control over the device's internals. This affects A3002RU through...