CVE-2019-7298: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 request. This occurs when any HNAP API function triggers a call to the system function with untrusted input fr...

PT-2019-1516

Name of the Vulnerable Software and Affected Versions D-Link DIR-823G versions through 1.02B03 Description The issue exists due to the lack of measures to neutralize special elements used in the operating system command. Exploitation of this issue may allow a remote attacker to execute arbitrary...

CVE-2019-7297

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system...

Command injection

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system...

CVE-2019-7297

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system...

CVE-2019-7297

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system...

CVE-2019-7297

CVE-2019-7297 affects D-Link DIR-823G devices with firmware up to 1.02B03. A command-injection vulnerability exists in the /HNAP1 interface: GetNetworkTomographyResult calls system with an untrusted Address input, allowing remote attackers to execute arbitrary OS commands via crafted requests. Ex...

CVE-2018-19040

The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocatorgetdir action to the wp-admin/admin-ajax.php URI...

CVE-2018-19041

The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocatorgetdir action to the wp-admin/admin-ajax.php URI...

CVE-2018-19041: Improper Neutralization of Input During Web Page Generation

The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocatorgetdir action to the wp-admin/admin-ajax.php URI...

PT-2019-9722

Name of the Vulnerable Software and Affected Versions Media File Manager plugin version 1.4.2 Description The issue allows for XSS via the dir parameter of an mrelocator getdir action to the "wp-admin/admin-ajax.php" API endpoint. Recommendations For Media File Manager plugin version 1.4.2, avoid...

CVE-2019-7297: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system...

PT-2019-1345 · D Link · D-Link Dir-823G

Name of the Vulnerable Software and Affected Versions: D-Link DIR-823G devices with firmware through 1.02B03 Description: An issue allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls...

PT-2019-9724

Name of the Vulnerable Software and Affected Versions Media File Manager plugin version 1.4.2 Description The issue allows for arbitrary file renaming by exploiting a directory traversal vulnerability in the dir parameter of the mrelocator rename action. This can be achieved by sending a request ...

CVE-2019-7236

An issue was discovered in idreamsoft iCMS 7.0.13. editor/editor.admincp.php allows admincp.php?app=editor&do=fileManager dir=../ Directory Traversal...

PT-2019-18477

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0.13 Description An issue was discovered in idreamsoft iCMS, where the editor/editor.admincp.php file allows directory traversal via the dir parameter in the "app=editor&do=fileManager" API endpoint. Recommendations F...

D-Link DIR-818LW DIR-860L Router Command Execution

The vulnerability of the soapcgimain function in the soap.cgi script /htdocs/cgibin/soap.cgi of the D-Link DIR-818LW and DIR-860L router software is caused by privilege management errors. Exploiting this vulnerability allows an attacker to execute arbitrary operating system commands using the...

Command Execution Vulnerability in Multiple D-Link Products

D-Link DIR-822 C1 and others are wireless router products from AUO D-Link. A command execution vulnerability exists in multiple D-Link products, which can be exploited by remote attackers to execute commands...

D-Link DIR-620 Router RCE

The vulnerability of D-Link DIR-620 router microprogramming software is related to the use of pre-installed registration data. Exploiting this vulnerability allows a remote attacker to enhance their privileges and execute arbitrary code...

D-Link DIR-816 Router Code Execution

The vulnerability of the /goform/form2userconfig.cgi component in D-Link DIR-816 router microprogramming software is caused by an overflow in the stack buffer. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...