CVE-2020-24376

A DNS rebinding vulnerability in the UPnP IGD implementations in Freebox v5 before 1.5.29 and Freebox Server before 4.2.3...

CVE-2020-24376

CVE-2020-24376 describes a DNS rebinding vulnerability in the UPnP Internet Gateway Device (IGD) implementations of Freebox v5 prior to 1.5.29 and Freebox Server prior to 4.2.3. The connected records confirm the affected products and versions and reiterate the same vulnerability description. No d...

CVE-2020-24373

CVE-2020-24373 affects Freebox Server's UPnP MediaServer (prior to version 4.2.3). The vulnerability is a CSRF issue in the UPnP MediaServer implementation that could be triggered by an attacker. The available connected documents confirm the affected software (Freebox Server) and vulnerable compo...

CVE-2020-24373

A CSRF vulnerability in the UPnP MediaServer implementation in Freebox Server before 4.2.3...

CVE-2020-24374

A DNS rebinding vulnerability in Freebox v5 before 1.5.29...

CVE-2020-24374

The CVE-2020-24374 entry describes a DNS rebinding vulnerability in Freebox v5 prior to 1.5.29. The available connected sources indicate that the issue affects Freebox software (v5) and that upgrading to version 1.5.29 or later mitigates the vulnerability (per PT-2020-15716). CVSS metrics in the ...

PT-2020-15719 · Freebox · Freebox Server

Name of the Vulnerable Software and Affected Versions: Freebox Server versions prior to 4.2.3 Description: A DNS rebinding issue affects the Freebox OS web interface. This could potentially allow for malicious actions. Recommendations: For versions prior to 4.2.3, update to version 4.2.3 or later...

PT-2020-15715 · Free · Freebox Server

Name of the Vulnerable Software and Affected Versions: Freebox Server versions prior to 4.2.3 Description: A CSRF issue exists in the UPnP MediaServer implementation. Recommendations: For versions prior to 4.2.3, update to version 4.2.3 or later to resolve the issue...

PT-2020-15716 · Free · Freebox

Name of the Vulnerable Software and Affected Versions: Freebox version 1.5.28 and earlier Description: A DNS rebinding issue affects the software, potentially allowing unauthorized access. Recommendations: For versions prior to 1.5.29, update to version 1.5.29 or later to resolve the issue...

CVE-2014-9382

Freebox OS Web interface 3.0.2 has CSRF which can allow VPN user account creation...

Cross site request forgery (csrf)

Freebox OS Web interface 3.0.2 has CSRF which can allow VPN user account creation...

CVE-2014-9382

Freebox OS Web interface 3.0.2 has CSRF which can allow VPN user account creation...

CVE-2014-9382

CVE-2014-9382 affects Freebox OS Web interface 3.0.2. A cross-site request forgery (CSRF) vulnerability allows creating a VPN user without proper authorization. The issue is demonstrated in vendor advisories and security summaries, including a POC that shows a VPN user creation request being trig...

CVE-2014-9405

A Cross-Site Scripting XSS vulnerability exists in the description field of an Download RSS item or Contacts in Freebox OS Web interface 3.0.2, which allows malicious users to execute arbitrary code...

Cross site scripting

A Cross-Site Scripting XSS vulnerability exists in the description field of an Download RSS item or Contacts in Freebox OS Web interface 3.0.2, which allows malicious users to execute arbitrary code...

CVE-2014-9405

A Cross-Site Scripting XSS vulnerability exists in the description field of an Download RSS item or Contacts in Freebox OS Web interface 3.0.2, which allows malicious users to execute arbitrary code...

CVE-2014-9405

CVE-2014-9405 is an XSS in Freebox OS Web interface 3.0.2. The vulnerability is in the description field of a Download RSS item or Contacts, allowing injected script when a user views the feed or imported VCARD content. Root cause: insufficient input filtering in the web interface; impact describ...

Freebox OS Web interface cross-site request forgery vulnerability

The Freebox OS Web interface is a web interface for the ADSL modem Freebox operating system. A cross-site request forgery vulnerability exists in the Freebox OS Web interface version 3.0.2. An attacker could exploit this vulnerability by sending a specially crafted request to perform an...

Freebox OS Web interface cross-site scripting vulnerability

The Freebox OS Web interface is a web interface for the ADSL modem Freebox operating system. A cross-site scripting vulnerability exists in version 3.0.2 of the Freebox OS Web interface, which stems from the program not adequately filtering user-submitted input. When a user browses the affected...

Freebox OS Web interface 3.0.2 XSS, CSRF

Hello list, Here are two CVEs I reported to Freebox, a french ISP: - CVE-2014-9382 - CSRF in VPN user account creation - CVE-2014-9405 - XSS Vulnerable product: Freebox OS Web interface 3.0.2. CVE-2014-9382 - CSRF in Freebox OS Web interface 3.0.2 allowing VPN user account creation...