EUVD-2020-29792

Malware in sbrugna...

D-Link DIR-2150 security vulnerabilities

The D-Link DIR-2150 is a wireless router from China-based AUO D-Link. A security vulnerability exists in the D-Link DIR-2150 that stems from an incorrect authentication bypass vulnerability implemented by the LoginPassword authentication algorithm...

D-Link DIR-2640-US Bypass Security Restrictions

The vulnerability of the web interface for managing D-Link DIR-2640-US microprogramming software is related to deficiencies in the authentication process when processing the LoginPassword parameter. Exploiting this vulnerability allows a malicious actor to bypass security restrictions by sending ...

PT-2023-3004

Name of the Vulnerable Software and Affected Versions D-Link DIR-2150 affected versions not specified Description The issue is related to the implementation of the LoginPassword function in the D-Link DIR-2150 router's software, which allows for authentication bypass. This can be exploited by a...

PT-2022-6578 · D Link · D-Link Dir-2640

Name of the Vulnerable Software and Affected Versions: D-Link DIR-2640 affected versions not specified Description: This issue allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-2640 routers. The flaw exists within the web management interface, whic...

(0Day) D-Link DCS-960L HNAP LoginPassword Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DCS-960L Wi-Fi cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from...

Stack overflow

A stack-based buffer overflow was found on the D-Link DIR-842 REVC with firmware v3.13B09 HOTFIX due to the use of strcpy for LOGINPASSWORD when handling a POST request to the /MTFWU endpoint...

CVE-2020-8962

CVE-2020-8962 describes a stack-based buffer overflow in the D-Link DIR-842 REVC, caused by the use of strcpy for LOGINPASSWORD when handling a POST request to the /MTFWU endpoint (firmware v3.13B09 HOTFIX). The provided documents do not explicitly detail the impact beyond the overflow descriptio...

PT-2020-20399

Name of the Vulnerable Software and Affected Versions D-Link DIR-842 REVC version v3.13B09 HOTFIX Description A stack-based buffer overflow issue was discovered due to the use of strcpy for LOGINPASSWORD when handling a POST request to the "/MTFWU" endpoint. Recommendations For D-Link DIR-842 REV...

CVE-2020-8962: Out-of-bounds Write

A stack-based buffer overflow was found on the D-Link DIR-842 REVC with firmware v3.13B09 HOTFIX due to the use of strcpy for LOGINPASSWORD when handling a POST request to the /MTFWU endpoint...

CVE-2019-15530

An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 exploitable with Authentication via shell metacharacters in the LoginPassword field to Login...

Command injection

An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 exploitable with Authentication via shell metacharacters in the LoginPassword field to Login...

CVE-2019-15530

An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 exploitable with Authentication via shell metacharacters in the LoginPassword field to Login...

PT-2019-3258

Name of the Vulnerable Software and Affected Versions D-Link DIR-823G version V1.0.2B05 Description The issue is related to the lack of data sanitization on the management level of the D-Link DIR-823G router's firmware. This can be exploited by a remote attacker to elevate privileges and execute...

CVE-2019-15530: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 exploitable with Authentication via shell metacharacters in the LoginPassword field to Login...

CVE-2015-8298: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the login page in RXTEC RXAdmin UPDATE 06 / 2012 allow remote attackers to execute arbitrary SQL commands via the 1 loginpassword, 2 loginusername, 3 zusatzlicher, or 4 groupid parameter to index.htm, or the 5 rxtec cookie to index.htm...

PT-2018-4439

Name of the Vulnerable Software and Affected Versions RXTEC RXAdmin UPDATE 06 / 2012 Description The issue concerns SQL injection vulnerabilities in the login page. Remote attackers can execute arbitrary SQL commands by manipulating specific parameters to the index.htm page, including the...

PT-2018-4959

Name of the Vulnerable Software and Affected Versions D-Link DIR routers, including DIR-823, DIR-822, DIR-818LW, DIR-895L, DIR-890L, DIR-885L, DIR-880L, DIR-868L, and DIR-850L affected versions not specified Description The issue arises when processing malformed SOAP messages during the HNAP Logi...

eservice.gov.bd XSS vulnerability

Open Bug Bounty ID: OBB-442714 Description| Value ---|--- Affected Website:| eservice.gov.bd Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

CVE-2017-16902

Vonage VDV-23 115 devices running firmware 3.2.11-0.9.40 are affected by CVE-2017-16902. A long string in loginUsername or loginPassword sent to goform/login can trigger a crash and router reboot, effectively a denial-of-service. CNVD-2017-37697 corroborates the reboot via a long login field; 133...