EUVD-2020-22014

Malware in sbrugna...

CVE-2020-29656: Direct Request

An information disclosure vulnerability exists in RT-AC88U Download Master before 3.1.0.108. A direct access to /downloadmaster/dmapply.cgi?actionmode=initial&downloadtype=General&specialcgi=getlanguage makes it possible to reach "unknown functionality" in a "known to be easy" manner via an...

PT-2020-17236

Name of the Vulnerable Software and Affected Versions RT-AC88U Download Master version 3.1.0.107 and earlier Description An information disclosure issue exists, allowing direct access to "/downloadmaster/dm apply.cgi?action mode=initial&download type=General&special cgi=get language" which can...

PT-2020-17235

Name of the Vulnerable Software and Affected Versions RT-AC88U Download Master versions prior to 3.1.0.108 Description An injection issue exists, allowing an attacker to influence the appearance of the login page. Accessing "Main Login.asp?flag=1&productname=FOOBAR&url=/downloadmaster/task.asp"...

CVE-2020-29655: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An injection vulnerability exists in RT-AC88U Download Master before 3.1.0.108. Accessing MainLogin.asp?flag=1&productname=FOOBAR&url=/downloadmaster/task.asp will redirect to the login site, which will show the value of the parameter productname within the title. An attacker might be able to...