Design/Logic Flaw

OpenWrt 18.06.4 allows XSS via the "New port forward" Name field to the cgi-bin/luci/admin/network/firewall/forwards URI this can occur, for example, on a TP-Link Archer C7 device...

CVE-2019-18992

OpenWrt 18.06.4 allows XSS via these Name fields to the cgi-bin/luci/admin/network/firewall/rules URI: "Open ports on router" and "New forward rule" and "New Source NAT" this can occur, for example, on a TP-Link Archer C7 device...

CVE-2019-18992

CVE-2019-18992 is an XSS vulnerability in OpenWrt 18.06.4. It affects the /cgi-bin/luci/admin/network/firewall/rules API, where the Name fields (e.g., “Open ports on router”, “New forward rule”, “New Source NAT”) can be crafted to inject script. The issue is demonstrated on devices such as TP-Lin...

CVE-2019-18993

OpenWrt 18.06.4 allows XSS via the "New port forward" Name field to the cgi-bin/luci/admin/network/firewall/forwards URI this can occur, for example, on a TP-Link Archer C7 device...

CVE-2019-18993

OpenWrt 18.06.4 is affected by a stored/reflected XSS vulnerability in the web UI, allowing an attacker to inject scripts via the New port forward Name field targeting the cgi-bin/luci/admin/network/firewall/forwards URI (e.g., on TP-Link Archer C7). The issue stems from insufficient input valida...

PT-2019-15743 · Tp Link +1 · Tp-Link Archer C7 +1

Name of the Vulnerable Software and Affected Versions: OpenWrt version 18.06.4 Description: The issue allows for XSS via the Name fields in the /cgi-bin/luci/admin/network/firewall/rules API endpoint, specifically in the "Open ports on router", "New forward rule", and "New Source NAT" fields. Thi...

PT-2019-15744 · Tp Link +1 · Tp-Link Archer C7 +1

Name of the Vulnerable Software and Affected Versions: OpenWrt version 18.06.4 Description: The issue allows for XSS via the "New port forward" Name field to the "cgi-bin/luci/admin/network/firewall/forwards" URI. This can occur on devices such as the TP-Link Archer C7. Recommendations: For OpenW...

TP-Link Archer VR300 Cross-Site Scripting Vulnerability

The TP-Link Archer VR300 is is a modem router from China's Universal Link TP-Link. The TP-Link Archer VR300 suffers from a cross-site scripting vulnerability that can be exploited by an attacker to obtain cookies or redirect to a malicious website...

TP-Link Archer VR300 1 Cross Site Scripting

I. VULNERABILITY ------------------------- Stored XSS Vulnerability on TP-Link Archer VR300 v1 - firmware version: 1.3.0 0.8.0 v007b.1 build 180905 Rel.55344n II. CVE REFERENCE ------------------------- - III. VENDOR ------------------------- https://www.tp-link.com/ IV. TIMELINE...

CVE-2019-3756

RSA Archer, versions prior to 6.6 P3 6.6.0.3, contain an information disclosure vulnerability. Information relating to the backend database gets disclosed to low-privileged RSA Archer users' UI under certain error conditions...

CVE-2019-3756

RSA Archer, versions prior to 6.6 P3 6.6.0.3, contain an information disclosure vulnerability. Information relating to the backend database gets disclosed to low-privileged RSA Archer users' UI under certain error conditions...

CVE-2019-3758

RSA Archer, versions prior to 6.6 P2 6.6.0.2, contain an improper authentication vulnerability. The vulnerability allows sysadmins to create user accounts with insufficient credentials. Unauthenticated attackers could gain unauthorized access to the system using those accounts...

CVE-2019-3758

RSA Archer, versions prior to 6.6 P2 6.6.0.2, contain an improper authentication vulnerability. The vulnerability allows sysadmins to create user accounts with insufficient credentials. Unauthenticated attackers could gain unauthorized access to the system using those accounts...

Information disclosure

RSA Archer, versions prior to 6.6 P3 6.6.0.3, contain an information disclosure vulnerability. Information relating to the backend database gets disclosed to low-privileged RSA Archer users' UI under certain error conditions...

Authentication flaw

RSA Archer, versions prior to 6.6 P2 6.6.0.2, contain an improper authentication vulnerability. The vulnerability allows sysadmins to create user accounts with insufficient credentials. Unauthenticated attackers could gain unauthorized access to the system using those accounts...

CVE-2019-3756

RSA Archer, versions prior to 6.6 P3 6.6.0.3, contain an information disclosure vulnerability. Information relating to the backend database gets disclosed to low-privileged RSA Archer users' UI under certain error conditions...

CVE-2019-3758

RSA Archer, versions prior to 6.6 P2 6.6.0.2, contain an improper authentication vulnerability. The vulnerability allows sysadmins to create user accounts with insufficient credentials. Unauthenticated attackers could gain unauthorized access to the system using those accounts...

CVE-2019-3758

CVE-2019-3758 affects RSA Archer prior to 6.6 P2 (6.6.0.2). The root cause is improper authentication that enables sysadmins to create user accounts with insufficient credentials, allowing unauthenticated attackers to gain unauthorized access to the system using those accounts. Exploitation detai...

CVE-2019-3756

RSA Archer

Dell EMC RSA Archer Authorization Issues Vulnerability

Dell EMC RSA Archer is an enterprise IT governance and compliance governance product from Dell USA. The product enables the development of eGRC programs for managing enterprise risk, automating business processes, and more. An authorization issue vulnerability exists in versions prior to Dell EMC...