OpenWRT 10.03 Cross Site Request Forgery / Cross Site Scripting

The openwrt 10.03 webinterface seems to have no protection against csrf... In addition, the following xss can be used against the webinterface: 1. nearly any page e.g. http://192.168.0.1/cgi-bin/luci/;stok=d/admin/network/network/"/alert1; 2. the query for packages e.g...

OpenWrt 10.03 - Multiple Cross-Site Scripting Vulnerabilities

OpenWrt 10.03 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/44843/info OpenWrt is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrar...

OpenWrt 10.03 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/44843/info OpenWrt is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

OpenWrt Router with a Blank Password (telnet check)

The remote host is running OpenWrt, an open source Linux distribution for embedded devices, especially routers. It is currently configured without a password, which is the case by default. Anyone can connect to the device via Telnet and gain administrative access to it. %NASLMINLEVEL 70300 C...

[Full-disclosure] Dropbear SSH server Denial of Service

Dropbear SSH server Denial of Service Credits: Pablo Fernandez March 7th, 2006 I. BACKGROUND Dropbear is a relatively small SSH 2 server and client. It runs on a variety of POSIX-based platforms. Dropbear is open source software, distributed under a MIT-style license. Dropbear is particularly...