D-Link Central WiFi Manager CWM(100) RCE

This module exploits a PHP code injection vulnerability in D-Link Central WiFi Manager CWM100 versions below v1.03R0100BETA6. The vulnerability exists in the username cookie, which is passed to eval without being sanitized. Dangerous functions are not disabled by default, which makes it possible ...

D-Link Central WiFi Manager (CWM-100) SQL Injection Vulnerability

D-Link Central WiFi Manager CWM-100 is a Web-based wireless access point management tool. A SQL injection vulnerability exists in the index.php/Pay/passcodeAuth passcode parameter in PayAction.class.php in versions prior to D-Link Central WiFi Manager CWM-100 1.03R0100BETA6. An attacker can explo...

D-Link Central WiFi Manager (CWM-100) Cross-Site Scripting Vulnerability

D-Link Central WiFi Manager CWM-100 is a Web-based wireless access point management tool. A cross-site scripting vulnerability exists in the resource view in PayAction.class.php in D-Link Central WiFi Manager CWM-100 versions prior to 1.03R0100BETA6. A remote attacker can exploit this vulnerabili...

D-Link Central WiFi Manager (CWM-100) Remote Code Execution Vulnerability

D-Link Central WiFi Manager CWM-100 is a Web-based wireless access point management tool that enables you to create and manage multi-site, multi-tenant wireless networks. A remote code execution vulnerability exists in /web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM-100...

D-Link Central WiFi Manager (CWM-100) Arbitrary SQL Command Query Vulnerability

D-Link Central WiFi Manager CWM-100 is a Web-based wireless access point management tool. An arbitrary SQL command query vulnerability exists in D-Link Central WiFi Manager CWM-100 versions prior to 1.03R0100BETA6. The vulnerability stems from a failure to validate input. An attacker can exploit...

CVE-2019-13373

An issue was discovered in the D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6. Input does not get validated and arbitrary SQL statements can be executed in the database via the /web/Public/Conn.php parameter dbSQL...

CVE-2019-13372

/web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6 allows remote attackers to execute arbitrary PHP code via a cookie because a cookie's username field allows eval injection, and an empty password bypasses authentication...

CVE-2019-13375

A SQL Injection was discovered in D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6 in PayAction.class.php with the index.php/Pay/passcodeAuth parameter passcode. The vulnerability does not need any authentication...

CVE-2019-13372

/web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6 allows remote attackers to execute arbitrary PHP code via a cookie because a cookie's username field allows eval injection, and an empty password bypasses authentication...

Input validation

An issue was discovered in the D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6. Input does not get validated and arbitrary SQL statements can be executed in the database via the /web/Public/Conn.php parameter dbSQL...

Cross site scripting

A cross-site scripting XSS vulnerability in resource view in PayAction.class.php in D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6 allows remote attackers to inject arbitrary web script or HTML via the index.php/Pay/passcodeAuth passcode parameter...

Design/Logic Flaw

/web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6 allows remote attackers to execute arbitrary PHP code via a cookie because a cookie's username field allows eval injection, and an empty password bypasses authentication...

Sql injection

A SQL Injection was discovered in D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6 in PayAction.class.php with the index.php/Pay/passcodeAuth parameter passcode. The vulnerability does not need any authentication...

CVE-2019-13375

CVE-2019-13375 relates to a SQL injection in the D-Link Central WiFi Manager CWM-100 (pre-1.03R0100_BETA6). The flaw resides in PayAction.class.php via the index.php/Pay/passcodeAuth parameter passcode, exploitable without authentication to leak data and modify the database. Connected Red Hat and...

CVE-2019-13374

A cross-site scripting XSS vulnerability in resource view in PayAction.class.php in D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6 allows remote attackers to inject arbitrary web script or HTML via the index.php/Pay/passcodeAuth passcode parameter...

CVE-2019-13373

Summary (CVE-2019-13373) : A vulnerability in D-Link Central WiFi Manager CWM-100 (versions before v1.03R0100_BETA6) where input is not validated, allowing arbitrary SQL commands via the /web/Public/Conn.php?dbSQL parameter. This can lead to database compromise, including retrieval of usernames/p...

CVE-2019-13372

D-Link Central WiFi Manager CWM(100) is affected by a remote code execution vulnerability in /web/Lib/Action/IndexAction.class.php. Before v1.03R0100_BETA6, a crafted cookie can trigger eval injection via the cookie’s username field, and an empty password bypasses authentication, enabling unauthe...

D-Link Central WiFiManager SQL injection

This module exploits a SQLi vulnerability found in D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6. The vulnerability is an exposed API endpoint that allows the execution of SQL queries without authentication, using this vulnerability, it's possible to retrieve usernames and password...

The vulnerability of the McAfee ePO Cloud platform for centralized policy management lies in the lack of protection against cross-site request substitution. This allows attackers to perform arbitrary actions on vulnerable devices and gain access to vulnerable applications.

The vulnerability of the McAfee ePO Cloud platform for centralized policy management is related to the lack of protection against Cross-Site Request Forgery CSRF attacks. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable device remotely and gain...

The vulnerability of the central server of the VMware Connection server in the virtualization system of VMware Horizon allows a hacker to gain unauthorized access to protected information.

The vulnerability of the central server of the VMware Connection server in the VMware Horizon workstation virtualization system is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to...