Directory traversal

LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal...

Arbitrary file deletion

LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion...

CVE-2018-14916

Loytec LGATE-902 (pre-6.4.2) is affected by a local file inclusion vulnerability (CVE-2018-14916). The Nuclei template specifies versions prior to 6.4.2 as vulnerable, enabling an attacker to read sensitive files on the device. The CVE description notes arbitrary file deletion as associated risk....

CVE-2018-14916

LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion...

CVE-2018-14919

LOYTEC LGATE-902 6.3.2 devices allow XSS...

CVE-2018-14919

LOYTEC LGATE-902 6.3.2 devices allow XSS...

Cross site scripting

LOYTEC LGATE-902 6.3.2 devices allow XSS...

CVE-2018-14918

LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal...

CVE-2018-14918

The CVE-2018-14918 entry concerns Loytec LGATE-902 devices. Affected firmware versions are 6.3.2 (and

CVE-2018-14919

LOYTEC LGATE-902 6.3.2 devices allow XSS...

CVE-2018-14919

The CVE-2018-14919 entry affects Loytec LGATE-902 gateways. Affected firmware is versions prior to 6.4.2 (tested on 6.3.2). The vulnerability is cross-site scripting (XSS) within the device web interface, with evidence of remote exposure. Public disclosures and third‑party writeups confirm that s...

Loytec LGATE-902 XSS / Traversal / File Deletion Vulnerabilities

Loytec LGATE-902 versions prior to 6.4.2 suffer from cross site scripting, arbitrary file deletion, and directory traversal vulnerabilities. Loytec LGATE-902 XSS / Traversal / File Deletion Vulnerabilities INFORMATION Product: Loytec LGATE-902 https://www.loytec.com/ Affected versions: 6.4.2 test...

Loytec LGATE-902 XSS / Traversal / File Deletion

INFORMATION Product: Loytec LGATE-902 https://www.loytec.com/ Affected versions: 6.4.2 tested on version 6.3.2 CVE IDs: CVE-2018-14919 Stored and reflected XSS, CVE-2018-14918 Path traversal, and CVE-2018-14916 Arbitrary file deletion. Remote-exploit: yes TIMELINE Vendor notification: 26th July,...

Design/Logic Flaw

An Insufficiently Protected Credentials issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not sufficiently protect sensitive information from unauthorized access...

CVE-2017-13996

A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web user interface fails to prevent access to critical files that non administrative users should not have access to, which could allow an attacker to create or modify files or execute arbitrary code...

Cross site scripting

A Cross-site Scripting issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web interface lacks proper web request validation, which could allow XSS attacks to occur if an authenticated user of the web interface is tricked into clicking a malicious link...

CVE-2017-13992

An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not utilize sufficiently random number generation for the web interface authentication mechanism, which could allow remote code execution...

CVE-2017-13996

A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web user interface fails to prevent access to critical files that non administrative users should not have access to, which could allow an attacker to create or modify files or execute arbitrary code...

CVE-2017-13998

An Insufficiently Protected Credentials issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not sufficiently protect sensitive information from unauthorized access...

Authentication flaw

An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not utilize sufficiently random number generation for the web interface authentication mechanism, which could allow remote code execution...