3669 matches found
CVE-2019-10039: Missing Authentication for Critical Function
The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use an API URL /goform/setSysAdm to edit the web or system account without authentication...
CVE-2019-10040: Missing Authentication for Critical Function
The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use a hidden API URL /goform/SystemCommand to execute a system command without authentication...
CVE-2018-20305: Out-of-bounds Write
D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpass parameter. In the /goform/form2userconfig.cgi handler function, a long password may lead to a stack-based buffer overflow and overwrite a return address...
CVE-2018-20057
An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter...
PT-2018-3890 · D Link · D-Link Dir-605L +1
Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L version 2.06B1 D-Link DIR-605L version 2.12B1 Description: An issue was discovered in the /bin/boa component of D-Link DIR-619L and DIR-605L devices. The goform/formSysCmd endpoint allows remote authenticated users to execute...
CVE-2018-20057: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter...
CVE-2018-20056: Out-of-bounds Write
An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. There is a stack-based buffer overflow allowing remote attackers to execute arbitrary code without authentication via the goform/formLanguageChange currTime parameter...
Moxa NPort W2x50A Operating System Command Injection Vulnerability
Moxa NPort W2x50A is a Moxa serial communication server for connecting industrial serial devices to a network. An operating system command injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware prior to version 2.2 Build18082311. An attacker can...
CVE-2018-19926
Zenitel Norway IP-StationWeb before 4.2.3.9 allows reflected XSS via the goform/ PATHINFO...
Cross site scripting
Zenitel Norway IP-StationWeb before 4.2.3.9 allows stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zFormsavechanges sipnick parameter. The password of alphaadmin for the admin account may be used for authentication in some cases...
CVE-2018-19659: Improper Neutralization of Special Elements used in an OS Command
An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Build18082311. A specially crafted HTTP POST request to /goform/netWebPingGetValue can result in running OS commands as the root user. This is...
CVE-2018-19660: Improper Neutralization of Special Elements used in an OS Command
An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Build18082311. A specially crafted HTTP POST request to /goform/webSettingProfileSecurity can result in running OS commands as the root user...
CVE-2018-19927: Improper Neutralization of Input During Web Page Generation
Zenitel Norway IP-StationWeb before 4.2.3.9 allows stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zFormsavechanges sipnick parameter. The password of alphaadmin for the admin account may be used for authentication in some cases...
CVE-2018-19926: Improper Neutralization of Input During Web Page Generation
Zenitel Norway IP-StationWeb before 4.2.3.9 allows reflected XSS via the goform/ PATHINFO...
PT-2018-15171
Name of the Vulnerable Software and Affected Versions Zenitel Norway IP-StationWeb versions prior to 4.2.3.9 Description The issue allows for stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zForm save changes sip nick parameter. In some cases, the...
PT-2018-15035
Name of the Vulnerable Software and Affected Versions Moxa NPort W2x50A products with firmware prior to 2.2 Build 18082311 Description An exploitable authenticated command-injection issue exists in the web server functionality. A specially crafted HTTP POST request to...
PT-2018-15034
Name of the Vulnerable Software and Affected Versions Moxa NPort W2x50A products with firmware prior to 2.2 Build 18082311 Description An exploitable authenticated command-injection issue exists in the web server functionality. A specially crafted HTTP POST request to "/goform/net WebPingGetValue...
PT-2018-15170
Name of the Vulnerable Software and Affected Versions Zenitel Norway IP-StationWeb versions prior to 4.2.3.9 Description The issue allows for reflected XSS via the goform/ API endpoint, specifically through the PATH INFO. Recommendations For versions prior to 4.2.3.9, update to version 4.2.3.9 or...
CVE-2018-14558: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44CNAC7, AC9 devices with firmware through V15.03.05.196318CNAC9, and AC10 devices with firmware through V15.03.06.23CNAC10. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a craft...