CVE-2021-28961

The CVE-2021-28961 vulnerability affects OpenWrt’s luci-app-ddns, specifically the detail.lua in the DDNS package. The issue allows remote authenticated users to inject arbitrary commands via POST requests to the OpenWrt 19.07 range, due to unvalidated input in detail.lua. Multiple connected sour...

CVE-2021-28961

applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07 allows remote authenticated users to inject arbitrary commands via POST requests...

CVE-2021-28961

applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07 allows remote authenticated users to inject arbitrary commands via POST requests...

CVE-2021-28961: Improper Neutralization of Special Elements used in an OS Command

applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07 allows remote authenticated users to inject arbitrary commands via POST requests...

OpenWrt 操作系统命令注入漏洞

OpenWrt is a Linux distribution for embedded devices. A command injection vulnerability exists in applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07. A remote authenticated user can exploit this vulnerability to inject arbitrary commands via a POST...

PT-2021-2490 · Openwrt · Openwrt

Name of the Vulnerable Software and Affected Versions: OpenWrt 19.07 Description: The issue is related to the DDNS package in OpenWrt 19.07, where the detail.lua file allows remote authenticated users to inject arbitrary commands via POST requests to the /cgi-bin/luci API endpoint, specifically t...

CVE-2020-26733

Cross Site Scripting XSS in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated attacker to inject their own script into the page via DDNS Configuration Section...

CVE-2020-26733

Cross Site Scripting XSS in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated attacker to inject their own script into the page via DDNS Configuration Section...

Cross site scripting

Cross Site Scripting XSS in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated attacker to inject their own script into the page via DDNS Configuration Section...

CVE-2020-26733

CVE-2020-26733: XSS in the Configuration page of SKYWORTH GN542VF (HW 2.0 / SW 2.0.0.16). The vulnerability resides in the DDNS Configuration section, allowing an authenticated attacker to inject script via that page. Documented impact is Cross Site Scripting with partial integrity impact and low...

CVE-2020-26733

Cross Site Scripting XSS in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated attacker to inject their own script into the page via DDNS Configuration Section...

CVE-2020-26733: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated attacker to inject their own script into the page via DDNS Configuration Section...

PT-2021-11267

Name of the Vulnerable Software and Affected Versions: SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 Description: The issue allows an authenticated attacker to inject their own script into the Configuration page via the DDNS Configuration Section. This is a Cross Site...

CVE-2020-14102

There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaomi router AX1800rom version 1.0.336 and Xiaomi route RM1800 root version 1.0.26...

CVE-2020-14102: Improper Neutralization of Special Elements used in a Command

There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaomi router AX1800rom version 1.0.336 and Xiaomi route RM1800 root version 1.0.26...

Design/Logic Flaw

Cleartext transmission of sensitive information vulnerability in DDNS in Synology Router Manager SRM before 1.2.4-8081 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors...

CVE-2020-27657

CVE-2020-27657 is associated with Synology SRM where a DNSExit DDNS update over SRM’s DDNS feature transmits credentials in cleartext. The TALOS analysis (TALOS-2020-1071) describes an information disclosure in the dnsExit DDNS provider: SRM 1.2.3 RT2600ac 8017-5 uses a PHP script dnsexit.php tha...

CVE-2020-27656: Cleartext Transmission of Sensitive Information

Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager DSM before 6.2.3-25426-2 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors...

CVE-2020-27657: Cleartext Transmission of Sensitive Information

Cleartext transmission of sensitive information vulnerability in DDNS in Synology Router Manager SRM before 1.2.4-8081 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors...

PT-2020-16751

Name of the Vulnerable Software and Affected Versions Synology Router Manager SRM versions prior to 1.2.4-8081 Description A cleartext transmission of sensitive information issue in DDNS allows man-in-the-middle attackers to eavesdrop on authentication information of DNSExit. Recommendations For...