EUVD-2019-5015

Malware in sbrugna...

EUVD-2019-5018

Malware in sbrugna...

CVE-2019-13562

D-Link DIR-655 C devices before 3.02B05 BETA03 allow XSS, as demonstrated by the /www/pingresponse.cgi pingipaddr parameter, the /www/ping6response.cgi ping6ipaddr parameter, and the /www/applysec.cgi htmlresponsereturnpage parameter...

CVE-2019-13561

D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metacharacters in the onlinefirmwarecheck.cgi checkfwurl parameter...

CVE-2019-13560

D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to force a blank password via the applysec.cgi setupwizard parameter...

CVE-2019-13563

D-Link DIR-655 C devices before 3.02B05 BETA03 allow CSRF for the entire management console...

CVE-2019-13561

The CVE affects D-Link DIR-655 C devices prior to version 3.02B05 BETA03, where an attacker can remotely execute arbitrary commands via shell metacharacters in the online_firmware_check.cgi check_fw_url parameter. Affected component is the firmware check URL handling in DIR-655 C; root cause is u...

CVE-2019-13561: Improper Neutralization of Special Elements used in an OS Command

D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metacharacters in the onlinefirmwarecheck.cgi checkfwurl parameter...

PT-2019-13422

Name of the Vulnerable Software and Affected Versions D-Link DIR-655 C devices before version 3.02B05 BETA03 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the "check fw url" parameter of the "online firmware check.cgi" endpoint...

CVE-2019-13560: Undefined Security Weakness

D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to force a blank password via the applysec.cgi setupwizard parameter...

PT-2019-13424

Name of the Vulnerable Software and Affected Versions D-Link DIR-655 C devices before version 3.02B05 BETA03 Description The issue allows for Cross-Site Request Forgery CSRF attacks on the entire management console. This means an attacker could potentially trick a user into performing unintended...

PT-2019-13423

Name of the Vulnerable Software and Affected Versions D-Link DIR-655 C devices before version 3.02B05 BETA03 Description The issue allows for XSS, as demonstrated by the "/www/ping response.cgi" API endpoint with the ping ipaddr parameter, the "/www/ping6 response.cgi" API endpoint with the ping6...

CVE-2019-13563: Cross-Site Request Forgery (CSRF)

D-Link DIR-655 C devices before 3.02B05 BETA03 allow CSRF for the entire management console...

PT-2019-13421

Name of the Vulnerable Software and Affected Versions D-Link DIR-655 C versions prior to 3.02B05 BETA03 Description The issue allows remote attackers to force a blank password. This is achieved through the apply sec.cgi API endpoint, specifically by manipulating the setup wizard parameter...

CVE-2019-13562: Improper Neutralization of Input During Web Page Generation

D-Link DIR-655 C devices before 3.02B05 BETA03 allow XSS, as demonstrated by the /www/pingresponse.cgi pingipaddr parameter, the /www/ping6response.cgi ping6ipaddr parameter, and the /www/applysec.cgi htmlresponsereturnpage parameter...