PT-2017-14547

Name of the Vulnerable Software and Affected Versions D-Link DWR-933 version 1.00WWB17 Description A cross-site scripting XSS issue exists, allowing potential exploitation via the "cgi-bin/gui.cgi" API endpoint. Recommendations For D-Link DWR-933 version 1.00WWB17, consider restricting access to...

petcabaret.com XSS vulnerability

Open Bug Bounty ID: OBB-401689 Description| Value ---|--- Affected Website:| petcabaret.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

Citrix Provisioned Target Fails To PXE Boot With Infoblox DHCP

When trying to PXE boot provisioning service target Virtual machines, it was failing with the following error Could not start download: operation not supported' Target Virtual Machine able to receive the DHCP IP from Infoblox Appliancebut not able to download ARDBP32.bin from the TFTP server...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF in the Basic Settings screen on Vonage Grandstream HT802 devices allows attackers to modify settings, related to cgi-bin/update...

CVE-2017-16563

Cross-Site Request Forgery CSRF in the Basic Settings screen on Vonage Grandstream HT802 devices allows attackers to modify settings, related to cgi-bin/update...

CVE-2017-16564

Stored Cross-site scripting XSS vulnerability in /cgi-bin/config2 on Vonage Grandstream HT802 devices allows remote authenticated users to inject arbitrary web script or HTML via the DHCP vendor class ID field P148...

CVE-2017-16563

Cross-Site Request Forgery CSRF in the Basic Settings screen on Vonage Grandstream HT802 devices allows attackers to modify settings, related to cgi-bin/update...

CVE-2017-16564: Improper Neutralization of Input During Web Page Generation

Stored Cross-site scripting XSS vulnerability in /cgi-bin/config2 on Vonage Grandstream HT802 devices allows remote authenticated users to inject arbitrary web script or HTML via the DHCP vendor class ID field P148...

CVE-2017-16563: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF in the Basic Settings screen on Vonage Grandstream HT802 devices allows attackers to modify settings, related to cgi-bin/update...

PT-2017-14448

Name of the Vulnerable Software and Affected Versions Vonage Grandstream HT802 devices affected versions not specified Description The issue concerns a Cross-Site Request Forgery CSRF in the Basic Settings screen. This allows attackers to modify settings related to the cgi-bin/update endpoint...

PT-2017-14449

Name of the Vulnerable Software and Affected Versions Vonage Grandstream HT802 devices affected versions not specified Description A stored Cross-site scripting XSS issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via the DHCP vendor class ID field,...

MitraStar GPT-2541GNAC (HGU) and DSL-100HN-T1 Elevation of Privilege Vulnerability

The MitraStar GPT-2541GNAC HGU and DSL-100HN-T1 are both MitraStar router products. An elevation of privilege vulnerability exists in the MitraStar GPT-2541GNAC HGU version 1.00VNJ0b1 and DSL-100HN-T1 ES113WJY0b16. An attacker can exploit this vulnerability to gain root access by specifying /bin/...

PT-2017-14450

Name of the Vulnerable Software and Affected Versions Vonage Grandstream HT802 devices affected versions not specified Description The issue concerns a Cross-Site Request Forgery CSRF in the /cgi-bin/login API endpoint. This allows attackers to authenticate a user via the login screen using the...

CVE-2017-16565: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF in /cgi-bin/login on Vonage Grandstream HT802 devices allows attackers to authenticate a user via the login screen using the default password of 123 and submit arbitrary requests...

CVE-2017-16522: Incorrect Default Permissions

MitraStar GPT-2541GNAC HGU 1.00VNJ0b1 and DSL-100HN-T1 ES113WJY0b16 devices allow remote authenticated users to obtain root access by specifying /bin/sh as the command to execute...

Debian DLA-1158-1 : bchunk security update

Several vulnerabilities were discovered in bchunk, a tool to convert a CD image in .bin/.cue format into a set of .iso and .cdr/.wav tracks. It was possible to trigger a heap-based buffer overflow with an resultant invalid free when processing a malformed CUE .cue file that may lead to the...

Unspecified vulnerability in radare

radare is a set of libraries and tools for working with binary files. A security vulnerability exists in the 'stringscanrange' function in the libr/bin/bin.c file in radare version 2.0.1. No details of the vulnerability are provided at this time...

Out-of-bounds

In radare 2.0.1, an out-of-bounds read vulnerability exists in stringscanrange in libr/bin/bin.c when doing a string search...

UBUNTU-CVE-2017-16358

In radare 2.0.1, an out-of-bounds read vulnerability exists in stringscanrange in libr/bin/bin.c when doing a string search...

Memory corruption

In radare 2.0.1, a memory corruption vulnerability exists in storeversioninfognuverdef and storeversioninfognuverneed in libr/bin/format/elf/elf.c, as demonstrated by an invalid free. This error is due to improper shsize validation when allocating memory...