Cross site scripting

LOYTEC LGATE-902 6.3.2 devices allow XSS...

CVE-2018-14918

LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal...

CVE-2018-14918

The CVE-2018-14918 entry concerns Loytec LGATE-902 devices. Affected firmware versions are 6.3.2 (and

CVE-2018-14919

LOYTEC LGATE-902 6.3.2 devices allow XSS...

CVE-2018-14919

The CVE-2018-14919 entry affects Loytec LGATE-902 gateways. Affected firmware is versions prior to 6.4.2 (tested on 6.3.2). The vulnerability is cross-site scripting (XSS) within the device web interface, with evidence of remote exposure. Public disclosures and third‑party writeups confirm that s...

CVE-2018-14916: Incorrect Permission Assignment for Critical Resource

LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion...

PT-2019-9074

Name of the Vulnerable Software and Affected Versions LOYTEC LGATE-902 version 6.3.2 Description The issue allows Directory Traversal. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited...

CVE-2018-14919: Improper Neutralization of Input During Web Page Generation

LOYTEC LGATE-902 6.3.2 devices allow XSS...

PT-2019-9073

Name of the Vulnerable Software and Affected Versions LOYTEC LGATE-902 version 6.3.2 Description The issue allows for arbitrary file deletion. Recommendations For LOYTEC LGATE-902 version 6.3.2, at the moment, there is no information about a newer version that contains a fix for this vulnerabilit...

PT-2019-9075

Name of the Vulnerable Software and Affected Versions LOYTEC LGATE-902 version 6.3.2 Description The issue allows for Cross-Site Scripting XSS attacks. XSS is a type of attack where an attacker can inject malicious scripts into a website, potentially allowing them to steal user data or take contr...

CVE-2018-14918: Improper Limitation of a Pathname to a Restricted Directory

LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal...

Loytec LGATE-902 XSS / Traversal / File Deletion Vulnerabilities

Loytec LGATE-902 versions prior to 6.4.2 suffer from cross site scripting, arbitrary file deletion, and directory traversal vulnerabilities. Loytec LGATE-902 XSS / Traversal / File Deletion Vulnerabilities INFORMATION Product: Loytec LGATE-902 https://www.loytec.com/ Affected versions: 6.4.2 test...

Loytec LGATE-902 XSS / Traversal / File Deletion

INFORMATION Product: Loytec LGATE-902 https://www.loytec.com/ Affected versions: 6.4.2 tested on version 6.3.2 CVE IDs: CVE-2018-14919 Stored and reflected XSS, CVE-2018-14918 Path traversal, and CVE-2018-14916 Arbitrary file deletion. Remote-exploit: yes TIMELINE Vendor notification: 26th July,...

CVE-2017-13992

An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not utilize sufficiently random number generation for the web interface authentication mechanism, which could allow remote code execution...

CVE-2017-13998

An Insufficiently Protected Credentials issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not sufficiently protect sensitive information from unauthorized access...

CVE-2017-13996

A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web user interface fails to prevent access to critical files that non administrative users should not have access to, which could allow an attacker to create or modify files or execute arbitrary code...

Authentication flaw

An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not utilize sufficiently random number generation for the web interface authentication mechanism, which could allow remote code execution...

Path traversal

A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web user interface fails to prevent access to critical files that non administrative users should not have access to, which could allow an attacker to create or modify files or execute arbitrary code...

CVE-2017-13998

An Insufficiently Protected Credentials issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not sufficiently protect sensitive information from unauthorized access...

CVE-2017-13994

A Cross-site Scripting issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web interface lacks proper web request validation, which could allow XSS attacks to occur if an authenticated user of the web interface is tricked into clicking a malicious link...