PT-2020-1543

Name of the Vulnerable Software and Affected Versions PeopleSoft Enterprise HCM Human Resources version 9.2 Description The issue is related to inadequate access control in the Company Dir / Org Chart Viewer component. It allows a low-privileged attacker with network access via HTTP to compromise...

D-Link DIR-859 Remote Code Execution (CVE-2019-17621; CVE-2022-36756; CVE-2022-37053)

A remote code execution vulnerability exists in D-Link DIR-859. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

The vulnerability of the D-Link DIR-412 A1-1.14WW router’s microprogramming software, related to authentication deficiencies, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the D-Link DIR-412 A1-1.14WW router’s microprogramming software is related to authentication deficiencies. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

D-Link DIR-859 Arbitrary Code Execution Vulnerability

The D-Link DIR-859 is a popular router device. A security vulnerability exists in the D-Link DIR-859, which can be exploited by a remote attacker to submit a special request that can be executed in the application context to execute arbitrary code...

CVE-2018-8780

It was found that the methods from the Dir class did not properly handle strings containing the NULL byte. An attacker, able to inject NULL bytes in a path, could possibly trigger an unspecified behavior of the ruby script. Mitigation It is possible to test for presence of the NULL byte manually...

CVE-2013-1642

Multiple cross-site scripting XSS vulnerabilities in QuiXplorer before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the 1 dir, 2 item, 3 order, 4 searchitem, 5 selitems, or 6 srt parameter to index.php or 7 the QUERYSTRING to index.php...

CVE-2019-20213

D-Link DIR-859 routers before v1.07b03beta allow Unauthenticated Information Disclosure via the AUTHORIZEDGROUP=1%0a value, as demonstrated by vpnconfig.php...

CVE-2019-20213

D-Link DIR-859 routers before v1.07b03beta allow Unauthenticated Information Disclosure via the AUTHORIZEDGROUP=1%0a value, as demonstrated by vpnconfig.php...

Information disclosure

D-Link DIR-859 routers before v1.07b03beta allow Unauthenticated Information Disclosure via the AUTHORIZEDGROUP=1%0a value, as demonstrated by vpnconfig.php...

CVE-2019-20213

D-Link DIR-859 routers before v1.07b03beta allow Unauthenticated Information Disclosure via the AUTHORIZEDGROUP=1%0a value, as demonstrated by vpnconfig.php...

CVE-2019-20213

D-Link DIR-859 routers are affected by CVE-2019-20213: unauthenticated information disclosure via the AUTHORIZED_GROUP=1%0a value demonstrated by vpnconfig.php on devices running versions prior to 1.07b03_beta. The vulnerability enables exposure of information over the network with no authenticat...

PT-2020-10375

Name of the Vulnerable Software and Affected Versions D-Link DIR-859 versions prior to 1.07b03 beta Description The issue allows for unauthenticated information disclosure. This can be achieved by using the AUTHORIZED GROUP=1%0a value, as demonstrated in the vpnconfig.php file. Recommendations Fo...

D-Link DIR-859 Information Disclosure Vulnerability

The D-Link DIR-859 is a wireless AC1750 high power Wi-Fi Gigabit router. An information disclosure vulnerability exists in D-Link DIR-859 versions prior to 1.07b03beta, which can be exploited by an attacker to obtain information via the AUTHORIZEDGROUP=1%0a value...

CVE-2019-20213: Improper Neutralization of Special Elements in Output Used by a Downstream Component

D-Link DIR-859 routers before v1.07b03beta allow Unauthenticated Information Disclosure via the AUTHORIZEDGROUP=1%0a value, as demonstrated by vpnconfig.php...

PT-2020-7367

Name of the Vulnerable Software and Affected Versions: QuiXplorer versions prior to 2.5.5 Description: The issue allows remote attackers to inject arbitrary web script or HTML via several parameters to index.php, including the dir, item, order, searchitem, selitems, or srt parameter, as well as t...

Command Execution Vulnerability in DLINKDIR-859 Series Routers

The D-Link DIR-859 is a wireless router from AUO D-Link of Taiwan, China. A remote command execution vulnerability exists in DLINK's DIR-859 series routers, which can be exploited by an attacker to execute arbitrary commands with root privileges on the target device...

CVE-2019-17621

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network...

Design/Logic Flaw

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network...

CVE-2019-17621

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network...

CVE-2019-17621

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network...