CVE-2008-6975

CVE-2008-6975: CSRF vulnerabilities in apply.cgi of DD-WRT 24 sp2 allow remote attackers to hijack administrator sessions by manipulating parameters (ping_ip, http_username/http_passwd, remote_management, and port-forward fields from/to/ip/pro). The issue is linked to a reportedly weak anti-CSRF ...

CVE-2008-6974

Multiple cross-site request forgery CSRF vulnerabilities in apply.cgi in DD-WRT 24 sp1 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary commands via the pingip parameter; 2 change the administrative credentials via the...

CVE-2008-6975

Multiple cross-site request forgery CSRF vulnerabilities in apply.cgi in DD-WRT 24 sp2 allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary commands via the pingip parameter; 2 change the administrative credentials via the httpusername and...

CVE-2008-6974

CVE-2008-6974 affects DD-WRT 24 sp1 and earlier. The vulnerability is a CSRF in apply.cgi that allows remote attackers to hijack administrator authentication and issue privileged requests via parameters such as ping_ip (arbitrary command execution), http_username/http_passwd (credential changes),...

Klinzmann A-A-S XSRF / Code Execution

Syhunt: A-A-S Application Access Server Multiple Security Vulnerabilities Advisory-ID: 200905111 Discovery Date: 3.23.2009 Release Date: 5.11.2009 Affected Applications: A-A-S 2.0.48 and possibly older versions Class: XSRF Cross Site Request Forgery Arbitrary Command Execution, Undocumented Defau...

Syhunt: A-A-S (Application Access Server) Multiple Security Vulnerabilities

Syhunt: A-A-S Application Access Server Multiple Security Vulnerabilities Advisory-ID: 200905111 Discovery Date: 3.23.2009 Release Date: 5.11.2009 Affected Applications: A-A-S 2.0.48 and possibly older versions Class: XSRF Cross Site Request Forgery Arbitrary Command Execution, Undocumented Defau...

Linksys WRT54GC Password Changer

document.senha.submit;...

Linksys WRT54GC - Admin Password Change (POC)

!-- Gabriel Lima - [email protected] www.falandodeseguranca.com English: Linksys WRT54GC - Administration Password Change The Router WRT54GC doesn't seem to check authentication from the administrator in it's .CGI files, accepting any POST request, as a password change. Below, follow...

3Com OfficeConnect Wireless Cable/DSL路由器SaveCfgFile绕过认证漏洞

BUGTRAQ ID: 33686 3Com OfficeConnect Wireless Cable/DSL是一款小型的无线路由器。 OfficeConnect Wireless Cable/DSL路由器默认启用了一个Web控制台以便于设备管理。即使http守护程序不允许未经认证便访问HTML页面和Web控制台，仍可以调用并执行已有的CGI程序。System Tools--Configuration--Backup Configuration功能将实际的配置文件保存到了名为config.bin的纯文本文件中，未经认证的用户可以直接调用SaveCfgFile...

3Com OfficeConnect Wireless Cable/DSL Router Authentication Bypass

==================================================== Security Research Advisory Vulnerability name: "3Com OfficeConnect Wireless Cable/DSL Router Authentication Bypass" Advisory number: LC-2008-05 Advisory URL: http://www.ikkisoft.com ==================================================== 1 Affecte...

Multiple XSRF in DD-WRT (Remote Root Command Execution)

Author: Michael Brooks !!!! I usually don't like posting my leet exploits to bugtraq because it is so unprofessional. You guys usually malform my exploits so they are totally useless, even to someone trying to write a patch! You also tend to get the wrong name! Michael Brooks wrote this! Exploits...

DD-WRT v24-sp1 (XSRF) Cross Site Reference Forgery Exploit

No description provided by source. Remote root dd-wrt -------------------------------------------------------------------------------- Written by Michael Brooks Special thanks to str0ke Exploits tested on the newist stable version: Firmware: DD-WRT v24-sp1 07/27/08 micro Product Homepage:...

DD-WRT v24-sp1 - Cross-Site Reference Forgery

DD-WRT v24-sp1 - Cross-Site Reference Forgery Remote root dd-wrt -------------------------------------------------------------------------------- Written by Michael Brooks Special thanks to str0ke Exploits tested on the newist stable version: Firmware: DD-WRT v24-sp1 07/27/08 micro Product...

Buffer overflow

Multiple buffer overflows in Client Software WinCom LPD Total 3.0.2.623 and earlier allow remote attackers to execute arbitrary code via 1 a long 0x02 command to the remote administration service on TCP port 13500 or 2 a long invalid control filename to LPDService.exe on TCP port 515...

Integer overflow

Integer overflow in the remote administration protocol processing in Client Software WinCom LPD Total 3.0.2.623 and earlier allows remote attackers to cause a denial of service crash via a large string length argument, which triggers memory corruption...

CVE-2008-5159

Integer overflow in the remote administration protocol processing in Client Software WinCom LPD Total 3.0.2.623 and earlier allows remote attackers to cause a denial of service crash via a large string length argument, which triggers memory corruption...

CVE-2008-5159

CVE-2008-5159 affects WinComLPD Total (Client Software WinCom LPD Total) up to version 3.0.2.623. The remote admin protocol processing suffers an integer overflow when handling a large string length, leading to memory corruption and remote denial of service. Public references describe a stack/rem...

CVE-2008-5159

Integer overflow in the remote administration protocol processing in Client Software WinCom LPD Total 3.0.2.623 and earlier allows remote attackers to cause a denial of service crash via a large string length argument, which triggers memory corruption...

sg-overflow.txt

SecurityGateway 1.0.1 Remote Buffer Overflow username Vendor: http://www.altn.com/ risk : critical SecurityGateway open port 4000 for remote administration/managment, EIP get owned when the username field is filled with 720 chars eax=00000000 ebx=00000000 ecx=63636363 edx=7c9137d8 esi=00000000...

SecurityGateway 1.0.1 (username) Remote Buffer Overflow PoC

No description provided by source. SecurityGateway 1.0.1 Remote Buffer Overflow username Vendor: http://www.altn.com/ risk : critical SecurityGateway open port 4000 for remote administration/managment, EIP get owned when the username field is filled with 720 chars eax=00000000 ebx=00000000...