Multiple Buffalo routers vulnerable to cross-site request forgery

Overview Multiple routers provided by Buffalo contain a cross-site request forgery vulnerability. Multiple routers provided by Buffalo have a management screen that allows users to modify settings. These routers contain a cross-site request forgery vulnerability due to an issue in the management...

CVE-2011-1324

Multiple cross-site request forgery CSRF vulnerabilities in the management screen on Buffalo WHR, WZR2, WZR, WER, and BBR series routers with firmware 1.x; BHR-4RV and FS-G54 routers with firmware 2.x; and AS-100 routers allow remote attackers to hijack the authentication of administrators for...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the management screen on Buffalo WHR, WZR2, WZR, WER, and BBR series routers with firmware 1.x; BHR-4RV and FS-G54 routers with firmware 2.x; and AS-100 routers allow remote attackers to hijack the authentication of administrators for...

CVE-2011-1324

Multiple cross-site request forgery CSRF vulnerabilities in the management screen on Buffalo WHR, WZR2, WZR, WER, and BBR series routers with firmware 1.x; BHR-4RV and FS-G54 routers with firmware 2.x; and AS-100 routers allow remote attackers to hijack the authentication of administrators for...

CVE-2011-1324

CVE-2011-1324 describes CSRF vulnerabilities in Buffalo router management interfaces (models WHR, WZR2, WZR, WER, BBR series with firmware 1.x; BHR-4RV/FS-G54 with 2.x; AS-100). The flaw allows remote attackers to hijack administrator authentication and modify settings, demonstrated by changing t...

CVE-2011-1324: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the management screen on Buffalo WHR, WZR2, WZR, WER, and BBR series routers with firmware 1.x; BHR-4RV and FS-G54 routers with firmware 2.x; and AS-100 routers allow remote attackers to hijack the authentication of administrators for...

JVN#50505257: Multiple Buffalo routers vulnerable to cross-site request forgery

Multiple routers provided by Buffalo have a management screen that allows users to modify settings. These routers contain a cross-site request forgery vulnerability due to an issue in the management screen. Impact If a user views a malicious page while logged into the management screen, settings...

Unfixed XSS vulnerability at www.buffaloapartments.com

Security researcher Xylitol, has submitted on 10/01/2009 a cross-site-scripting XSS vulnerability affecting www.buffaloapartments.com, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 29/11/2011. It is...

Unfixed XSS vulnerability at search.buffalostate.edu

Security researcher cherokee warrior, has submitted on 17/06/2008 a cross-site-scripting XSS vulnerability affecting search.buffalostate.edu, which at the time of submission ranked 50350 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 12/07/200...

Buffalo router configuration management interface vulnerable to remote access and password leakage

Overview Some Buffalo routers have a vulnerability that could allow remote access from the WAN side. A remote attacker could exploit this vulnerability to manipulate a router by gaining administrative privileges. By accessing the management interface, a remote attacker could also obtain user's...

TeraStation HD-HTGL series cross-site request forgery vulnerability

Overview TeraStation HD-HTGL series provided by Buffalo, Inc. are hard disks for LAN connection and have administrative web interface. The administrative interface for the TeraStation HD-HTGL contains a cross-site request forgety CSRF vulnerability. Impact If a TeraStation HD-HTGL administrator w...

Unfixed XSS vulnerability at www.buffalo-shop.de

Security researcher Fabian Fingerle, has submitted on 15/02/2008 a cross-site-scripting XSS vulnerability affecting www.buffalo-shop.de, which at the time of submission ranked 107414 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/03/2008. I...

JVN#71872818 AirStation series and BroadStation series vulnerable to cross-site request forgery

Buffalo's AirStation series and BroadStation series routers have a web administration interface that can be accessed from a web browser to configure their functional settings. The web administration interface is vulnerable to cross-site request forgery. Impact If the administrator of such a produ...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the device management interface in Buffalo AirStation WHR-G54S 1.20 allows remote attackers to make configuration changes as an administrator via HTTP requests to certain HTML pages in the res parameter with an inp req parameter to cgi-bin/cgi, as...

CVE-2007-4822

Cross-site request forgery CSRF vulnerability in the device management interface in Buffalo AirStation WHR-G54S 1.20 allows remote attackers to make configuration changes as an administrator via HTTP requests to certain HTML pages in the res parameter with an inp req parameter to cgi-bin/cgi, as...

CVE-2007-4822

Cross-site request forgery CSRF vulnerability in the device management interface in Buffalo AirStation WHR-G54S 1.20 allows remote attackers to make configuration changes as an administrator via HTTP requests to certain HTML pages in the res parameter with an inp req parameter to cgi-bin/cgi, as...

CVE-2007-4822

CVE-2007-4822 affects Buffalo AirStation WHR-G54S (v1.20). A CSRF flaw in the device management interface allows remote attackers to modify configuration via HTTP requests to cgi-bin/cgi pages (e.g., ap.html, filter_ip.html) using res and inp parameters. Impact: integrity partially affected; conf...

CVE-2007-4822: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the device management interface in Buffalo AirStation WHR-G54S 1.20 allows remote attackers to make configuration changes as an administrator via HTTP requests to certain HTML pages in the res parameter with an inp req parameter to cgi-bin/cgi, as...

Buffalo AirStation WHR-G54S crossite request forgery

Request forgery in administration interface...

Buffalo AirStation WHR-G54S CSRF vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Louhi Networks Oy -= Security Advisory =- Advisory: Buffalo AirStation WHR-G54S Web Management CSRF vulnerability Release Date: 2007-09-07 Last Modified: 2007-09-07 Authors: Henri Lindberg, Associate of ISC henri d0t lindberg at louhi d0t fi...