D-Link DIR-615 Wireless Router  -  Persistent Cross-Site Scripting

D-Link DIR-615 Wireless Router - Persistent Cross-Site Scripting Exploit Title: D-Link DIR-615 Wireless Router - Persistent Cross-Site Scripting Date: 2019-12-13 Exploit Author: Sanyam Chawla Vendor Homepage: http://www.dlink.co.in Category: Hardware Wi-fi Router Hardware Link:...

D-Link DIR-615 - Privilege Escalation

Exploit Title: D-Link DIR-615 - Privilege Escalation Date: 2019-12-10 Exploit Author: Sanyam Chawla Vendor Homepage: http://www.dlink.co.in Category: Hardware Wi-fi Router Hardware Link: http://www.dlink.co.in/products/?pid=678 Hardware Version: T1 Firmware Version: 20.07 Tested on: Windows 10 an...

D-Link DIR-615 - Privilege Escalation Vulnerability

Exploit for hardware platform in category web applications Exploit Title: D-Link DIR-615 - Privilege Escalation Exploit Author: Sanyam Chawla Vendor Homepage: http://www.dlink.co.in Category: Hardware Wi-fi Router Hardware Link: http://www.dlink.co.in/products/?pid=678 Hardware Version: T1 Firmwa...

D-Link DIR-615 Privilege Escalation

Exploit Title: D-Link DIR-615 - Privilege Escalation Date: 2019-12-10 Exploit Author: Sanyam Chawla Vendor Homepage: http://www.dlink.co.in Category: Hardware Wi-fi Router Hardware Link: http://www.dlink.co.in/products/?pid=678 Hardware Version: T1 Firmware Version: 20.07 Tested on: Windows 10 an...

D-Link DIR-615 Wireless Router  -  Persistent Cross-Site Scripting

Exploit Title: D-Link DIR-615 Wireless Router - Persistent Cross-Site Scripting Date: 2019-12-13 Exploit Author: Sanyam Chawla Vendor Homepage: http://www.dlink.co.in Category: Hardware Wi-fi Router Hardware Link: http://www.dlink.co.in/products/?pid=678 Hardware Version: T1 Firmware Version:...

PT-2019-15942

Name of the Vulnerable Software and Affected Versions D-Link DIR-615 devices affected versions not specified Description A security issue allows a normal user to create a root admin user from the D-Link portal, potentially leading to unauthorized access and control. Recommendations At the moment,...

CVE-2019-19743: Undefined Security Weakness

On D-Link DIR-615 devices, a normal user is able to create a rootadmin user from the D-Link portal...

D-Link DIR-615 - Privilege Escalation

D-Link DIR-615 - Privilege Escalation Exploit Title: D-Link DIR-615 - Privilege Escalation Date: 2019-12-10 Exploit Author: Sanyam Chawla Vendor Homepage: http://www.dlink.co.in Category: Hardware Wi-fi Router Hardware Link: http://www.dlink.co.in/products/?pid=678 Hardware Version: T1 Firmware...

DEVICE.TIME.php Code Execution

The vulnerability of the DEVICE.TIME.php component in D-Link DIR-859 A3 and D-Link DIR-850L A wireless router microprogramming software is related to the lack of measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote...

D-Link DIR-816 A1 Management Page Unauthorized Access

The vulnerability of the Management Page component in the microprogramming software of D-Link DIR-816 A1 relates to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2019-4530

Name of the Vulnerable Software and Affected Versions D-Link DIR-818Lx versions not specified D-Link DIR-822 versions not specified D-Link DIR-823 versions not specified D-Link DIR-859 versions 1.05 through 1.06B01 Beta01 D-Link DIR-865L versions not specified D-Link DIR-868L versions not specifi...

D-Link DIR-615 CVE-2019-19743 Privilege Escalation Vulnerability

Description D-Link DIR-615 is prone to a privilege-escalation vulnerability. An attacker may exploit this issue to gain elevated privileges. Technologies Affected D-Link DIR-615 Recommendations Block external access at the network boundary, unless external parties require service. If applicable,...

Forma LMS 2.2.1 ajax.adm_server.php dir parameter SQL injections

Summary Exploitable SQL injection vulnerabilities exists in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowin...

Unauthorized Access Vulnerability in D-link DIR-629

AUO D-Link DIR-629 450M Wireless Router 3 High Power Blade Antenna Home Broadband Router. An unauthorized access vulnerability exists in the D-link DIR-629, which can be exploited by attackers to gain unauthorized access to sensitive information...

UBUNTU-CVE-2019-19037

ext4emptydir in fs/ext4/namei.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because ext4readdirblockinode,0,DIRENTHTREE can be zero...

Linux kernel null pointer dereference vulnerability (CNVD-2019-42387)

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A null pointer dereference vulnerability exists in ext4emptydir in fs/ext4/namei.c in Linux kernel 5.3.12 and earlier...

D-Link DIR-615 Authorization Issues Vulnerability

The D-Link DIR-615 is a wireless router from AUO D-Link of Taiwan, China. An authorization issue vulnerability exists in the D-Link DIR-615 using firmware version 20.05 and firmware version 20.07. The vulnerability stems from a lack of authentication measures or insufficient authentication streng...

PT-2019-4254

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 5.3.12 Description The issue is related to a NULL pointer dereference in the ext4 empty dir function in the Linux kernel. This can occur because ext4 read dirblockinode,0,DIRENT HTREE can return zero. The problem...

Ruby Dir Methods Unauthenticated Access

The vulnerability of the Dir.open, Dir.new, Dir.entries, and Dir.empty methods in the Ruby programming language exists due to incorrect path name restrictions for restricted-access directories. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected data or...

CVE-2019-18852

Certain D-Link devices have a hardcoded Alphanetworks user account with TELNET access because of /etc/config/imagesign or /etc/alphaconfig/imagesign. This affects DIR-600 B1 V2.01 for WW, DIR-890L A1 v1.03, DIR-615 J1 v100 for DCN, DIR-645 A1 v1.03, DIR-815 A1 v1.01, DIR-823 A1 v1.01, and DIR-842...