PT-2019-11392

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.11 Description: The issue concerns the authorization process of the router, where it only checks a random token when authorizing a goform request. This allows an attacker to obtain the token from dir login.asp and...

CVE-2019-10039: Missing Authentication for Critical Function

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use an API URL /goform/setSysAdm to edit the web or system account without authentication...

CVE-2019-10041: Missing Authentication for Critical Function

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use an API URL /goform/form2userconfig.cgi to edit the system account without authentication...

CVE-2019-10042: Missing Authentication for Critical Function

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use an API URL /goform/LoadDefaultSettings to reset the router without authentication...

PT-2019-11391

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.11 Description: The issue allows an attacker to edit the web or system account without authentication by exploiting the fact that the router only checks the random token when authorizing a goform request. This toke...

CVE-2019-10040: Missing Authentication for Critical Function

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use a hidden API URL /goform/SystemCommand to execute a system command without authentication...

PT-2019-11394

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.11 Description: The issue concerns the authorization process for goform requests, where the router only checks a random token. This token can be obtained from dir login.asp, allowing an attacker to use the "API URL...

CVE-2018-20305: Out-of-bounds Write

D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpass parameter. In the /goform/form2userconfig.cgi handler function, a long password may lead to a stack-based buffer overflow and overwrite a return address...

Xiaomi Mi A2 Lite and RedMi6 pro Goodix GT9xx Touchscreen Driver Code Issue Vulnerability

The Xiaomi Mi A2 Lite and RedMi6 pro are both smartphones from Chinese company Xiaomi Technology Xiaomi. A code issue vulnerability exists in the Goodix GT9xx touchscreen driver used to customize the Goodix GT9xx in the Xiaomi Mi A2 Lite and RedMi6 pro 2018-08-27 and prior versions. The...

CVE-2018-19939

The Goodix GT9xx touchscreen driver for custom Linux kernels on Xiaomi daisy-o-oss and daisy-p-oss as used in Mi A2 Lite and RedMi6 pro devices through 2018-08-27 has a NULL pointer dereference in kfree after a kmalloc failure in gtpreadColor in drivers/input/touchscreen/gt917d/gt9xx.c...

CVE-2018-19939

The Goodix GT9xx touchscreen driver for custom Linux kernels on Xiaomi daisy-o-oss and daisy-p-oss as used in Mi A2 Lite and RedMi6 pro devices through 2018-08-27 has a NULL pointer dereference in kfree after a kmalloc failure in gtpreadColor in drivers/input/touchscreen/gt917d/gt9xx.c...

CVE-2018-19939

The CVE-2018-19939 entry concerns the Goodix GT9xx touchscreen driver used in Xiaomi Mi A2 Lite and RedMi6 pro on custom Linux kernels up to 2018-08-27. Root cause: NULL pointer dereference in kfree following a kmalloc failure in gtp_read_Color within drivers/input/touchscreen/gt917d/gt9xx.c. Imp...

PT-2018-15175 · Goodix · Goodix Gt9Xx Touchscreen Driver

Name of the Vulnerable Software and Affected Versions: Goodix GT9xx touchscreen driver versions prior to the version that fixes the NULL pointer dereference issue Description: The issue is related to a NULL pointer dereference in the kfree function after a kmalloc failure in the gtp read Color...

Liberapay: Broken Authentication and session management OWASP A2

Hello @liberapay, Description: It seems now if attacker has csrf token & victim cookies then attacker can easily login to victim account without any login details. No need Of Any Username/Password Theory Proof-Of-Concept: - Go to https://liberapay.com/admin.101/edit/username any username/Self...

a2.jor.br XSS vulnerability

Open Bug Bounty ID: OBB-687530 Description| Value ---|--- Affected Website:| a2.jor.br Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...

D-Link DIR-816 A2 Buffer Overflow Vulnerability

D-Link DIR-816 A2 is a wireless router product from AUO D-Link. A stack buffer overflow vulnerability exists in the D-Link DIR-816 A2 version 1.10 B05, which can be exploited by an attacker to overwrite the returned address with the help of a longer password...

Command injection

An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction in the handler function of the /goform/form2systime.cgi route. This could lead to command injection via shell metacharacters in the datetime parameter...

Stack overflow

An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/DDNS route, a very long password could lead to a stack-based buffer overflow and overwrite the return address...

CVE-2018-17064

An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/sylogapply route. This could lead to command injection via the syslogIp parameter after /goform/clearlog is invoked...

CVE-2018-17063

An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/NTPSyncWithHost route. This could lead to command injection via shell metacharacters...