Multiple CSRF and XSS vulnerabilities in D-Link DAP 1150

Hello 3APA3A! In 2011 and beginning of 2012 I wrote about multiple vulnerabilities http://securityvulns.ru/docs27440.html, http://securityvulns.ru/docs27677.html, http://securityvulns.ru/docs27676.html in D-Link DAP 1150 several dozens. That time I wrote about vulnerabilities in admin panel in...

CSRF, AoF and XSS vulnerabilities in D-Link DAP 1150

Hello 3APA3A! In 2011 and beginning of 2012 I wrote about multiple vulnerabilities http://securityvulns.ru/docs27440.html, http://securityvulns.ru/docs27677.html, http://securityvulns.ru/docs27676.html in D-Link DAP 1150 several dozens. That time I wrote about vulnerabilities in admin panel in...

CVE-2014-3872

The CVE-2014-3872 affects D-Link DAP-1350 (Rev. A1) with firmware 1.14 and earlier, where multiple SQL injection vulnerabilities in the administration login page allow remote attackers to execute arbitrary SQL via the username or password. The issue is documented with a high-severity CVSS v2 scor...

CVE-2014-3872

Multiple SQL injection vulnerabilities in the administration login page in D-Link DAP-1350 Rev. A1 with firmware 1.14 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password...

CVE-2014-3872

Multiple SQL injection vulnerabilities in the administration login page in D-Link DAP-1350 Rev. A1 with firmware 1.14 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password...

Sql injection

Multiple SQL injection vulnerabilities in the administration login page in D-Link DAP-1350 Rev. A1 with firmware 1.14 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password...

PT-2014-5567 · D Link · D-Link Dap-1350

Name of the Vulnerable Software and Affected Versions: D-Link DAP-1350 versions 1.14 and earlier Description: The issue concerns SQL injection vulnerabilities in the administration login page. Remote attackers can execute arbitrary SQL commands via the username or password variables...

CVE-2014-3872: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the administration login page in D-Link DAP-1350 Rev. A1 with firmware 1.14 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password...

CVE-2014-3760

Multiple cross-site request forgery CSRF vulnerabilities in D-Link DAP 1150 with firmware 1.2.94 allow remote attackers to hijack the authentication of administrators for requests that 1 enable or 2 disable the DMZ in the Firewall/DMZ section via a request to index.cgi or 3 add, 4 modify, or 5...

CVE-2014-3761

Cross-site scripting XSS vulnerability in D-Link DAP 1150 with firmware 1.2.94 allows remote attackers to inject arbitrary web script or HTML via the resbuf parameter to index.cgi in the Control/URL-filter section...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in D-Link DAP 1150 with firmware 1.2.94 allow remote attackers to hijack the authentication of administrators for requests that 1 enable or 2 disable the DMZ in the Firewall/DMZ section via a request to index.cgi or 3 add, 4 modify, or 5...

Cross site scripting

Cross-site scripting XSS vulnerability in D-Link DAP 1150 with firmware 1.2.94 allows remote attackers to inject arbitrary web script or HTML via the resbuf parameter to index.cgi in the Control/URL-filter section...

CVE-2014-3761

The CVE-2014-3761 entry describes a Cross-site scripting (XSS) vulnerability in the D-Link DAP-1150, affected firmware 1.2.94. The issue is triggered by a crafted value in the res_buf parameter sent to index.cgi within the Control/URL-filter section, enabling remote attackers to inject arbitrary ...

CVE-2014-3761

Cross-site scripting XSS vulnerability in D-Link DAP 1150 with firmware 1.2.94 allows remote attackers to inject arbitrary web script or HTML via the resbuf parameter to index.cgi in the Control/URL-filter section...

CVE-2014-3760

Multiple cross-site request forgery CSRF vulnerabilities in D-Link DAP 1150 with firmware 1.2.94 allow remote attackers to hijack the authentication of administrators for requests that 1 enable or 2 disable the DMZ in the Firewall/DMZ section via a request to index.cgi or 3 add, 4 modify, or 5...

CVE-2014-3760

CVE-2014-3760 applies to D-Link DAP-1150 firmware 1.2.94, where multiple CSRF flaws allow remote attackers to hijack administrator sessions and perform actions via index.cgi in the Firewall/DMZ and Control/URL-filter sections (e.g., enabling/disabling DMZ or adding/modifying/deleting URL-filter r...

CVE-2014-3761: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in D-Link DAP 1150 with firmware 1.2.94 allows remote attackers to inject arbitrary web script or HTML via the resbuf parameter to index.cgi in the Control/URL-filter section...

PT-2014-5486 · D Link · D-Link Dap 1150

Name of the Vulnerable Software and Affected Versions: D-Link DAP 1150 version 1.2.94 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the res buf parameter to "index.cgi" in the Control/URL-filter section. Recommendations: For D-Lin...

PT-2014-5485 · D Link · D-Link Dap 1150

Name of the Vulnerable Software and Affected Versions: D-Link DAP 1150 version 1.2.94 Description: The issue allows remote attackers to hijack the authentication of administrators for various requests, including enabling or disabling the DMZ in the Firewall/DMZ section via a request to "index.cgi...

CVE-2014-3760: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in D-Link DAP 1150 with firmware 1.2.94 allow remote attackers to hijack the authentication of administrators for requests that 1 enable or 2 disable the DMZ in the Firewall/DMZ section via a request to index.cgi or 3 add, 4 modify, or 5...