CVE-2014-3778: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in goform/RgDdns in ARRIS formerly Motorola SBG901 SURFboard Wireless Cable Modem allow remote attackers to hijack the authentication of administrators for requests that 1 change the dns service via the DdnsService parameter, 2 change the...

PT-2014-4176

Name of the Vulnerable Software and Affected Versions Conceptronic C54APM access point with runtime code 1.26 Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters in certain actions. This can be achieved by exploiting the submit-url paramete...

PT-2014-4174

Name of the Vulnerable Software and Affected Versions Conceptronic C54APM access point with runtime code 1.26 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This can be achieved via two methods: 1 the submit-url parameter in a...

PT-2014-3716

Name of the Vulnerable Software and Affected Versions Technicolor TC7200 version STD6.01.12 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities can ...

PT-2014-3717

Name of the Vulnerable Software and Affected Versions Technicolor TC7200 version STD6.01.12 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for various requests,...

CVE-2013-5039

The CVE-2013-5039 entry concerns the HOTBOX router (SAGEMCOM HOTBOX F@st 3184) with firmware 2.1.11. It describes a CSRF flaw in goform/wlanBasicSecurity that lets an attacker hijack administrator authentication to set WifiSecurity to Deactivated. Public material (e.g., exploit-db, packetstorm, 0...

PT-2013-5344

Name of the Vulnerable Software and Affected Versions HOTBOX router version 2.1.11 Description A cross-site request forgery CSRF issue exists in the goform/wlanBasicSecurity endpoint, allowing remote attackers to hijack administrator authentication for requests that modify the WiFi Security field...

PT-2013-5453

Name of the Vulnerable Software and Affected Versions HOTBOX router software version 2.1.11 Description The issue allows remote attackers to cause a denial of service, resulting in a device crash, by sending crafted HTTP POST data to the "goform/login" endpoint. Recommendations For software versi...

CVE-2013-5039: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in goform/wlanBasicSecurity on the HOT HOTBOX router with software 2.1.11 allows remote attackers to hijack the authentication of administrators for requests that change the WiFi Security field to Deactivated via the WifiSecurity parameter...

CVE-2013-5220: Improper Input Validation

goform/login on the HOT HOTBOX router with software 2.1.11 allows remote attackers to cause a denial of service device crash via crafted HTTP POST data...

CVE-2013-6976

CVE-2013-6976 involves a CSRF flaw in Cisco EPC3925 devices’ goform/Quick_setup that lets an attacker hijack administrator sessions and change the password via Password and PasswordReEnter. Affected product: Cisco EPC3925 (router). Root cause: cross-site request forgery enabling unauthorized pass...

PT-2013-6215

Name of the Vulnerable Software and Affected Versions Cisco EPC3925 devices affected versions not specified Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack administrator authentication for requests that change passwords. This is achieved via the...

CVE-2013-6976: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in goform/Quicksetup on Cisco EPC3925 devices allows remote attackers to hijack the authentication of administrators for requests that change a password via the Password and PasswordReEnter parameters, aka Bug ID CSCuh37496...

PT-2013-6251

Name of the Vulnerable Software and Affected Versions Cisco Scientific Atlanta DPR2320R2 router version 2.0.2r1262-090417 Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including changing a password via the Password parameter to...

CVE-2013-3963

CVE-2013-3963 describes a CSRF vulnerability in Grandstream goform/usermanage affecting GXV3501/3504/3601/3601HD/LL/3611HD/LL/3615W/P/3651FHD/3662HD/3615WP_HD/3500 (and potentially other camera models) that lets remote attackers hijack a victim’s session to add users. Root cause is CSRF in the us...

PT-2013-4763

Name of the Vulnerable Software and Affected Versions Grandstream GXV3501 versions affected versions not specified Grandstream GXV3504 versions affected versions not specified Grandstream GXV3601 versions affected versions not specified Grandstream GXV3601HD/LL versions affected versions not...

CVE-2013-3963: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in goform/usermanage in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WPHD, GXV3500, and possibly other camera models allows remote attackers to hijack the authentication of unspecified...

CVE-2012-1922: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Sitecom WLM-2501 allow remote attackers to hijack the authentication of administrators for requests that modify settings for 1 Mac Filtering via admin/formFilter, 2 IP/Port Filtering via formFilter, 3 Port Forwarding via formPortFw, 4...

PT-2013-1536

Name of the Vulnerable Software and Affected Versions Sitecom WLM-2501 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for requests that modify various settings,...

PT-2012-3654

Name of the Vulnerable Software and Affected Versions Sitecom WLM-2501 Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack administrator authentication for requests that change the router passphrase via the pskValue parameter in the...