CVE-2018-20597: Improper Neutralization of Input During Web Page Generation

UCMS 1.4.7 has XSS via the dir parameter in an index.php sadminfileedit action...

PT-2018-15461

Name of the Vulnerable Software and Affected Versions UCMS version 1.4.7 Description The issue is related to a security problem where an attacker can inject malicious code. This is achieved by exploiting the dir parameter in the "index.php" sadmin fileedit action, allowing for malicious script...

D-Link DIR-140L and DIR-640L Information Disclosure Vulnerability

The D-Link DIR-140L and DIR-640L are both wireless router products from AUO D-Link. An information disclosure vulnerability exists in the dirary0.js file in the D-Link DIR-140L version 1.02 and DIR-640L version 1.01RU, which can be exploited by remote attackers to disclose admin credentials...

CVE-2018-18009

dirary0.js on D-Link DIR-140L, DIR-640L devices allows remote unauthenticated attackers to discover admin credentials...

CVE-2018-18009

The CVE-2018-18009 entry affects D-Link DIR-140L and DIR-640L routers (DIR-140L v1.02; DIR-640L v1.01RU). The vulnerability lies in dirary0.js, which allows remote unauthenticated attackers to disclose the admin password by reading the web interface file (example: http://victim_ip/dirary0.js). Im...

PT-2018-2106

Name of the Vulnerable Software and Affected Versions D-Link DIR-140L and DIR-640L devices Description The issue is related to the storage of credentials in an open manner, allowing remote unauthenticated attackers to discover admin credentials. This can enable a remote attacker to reveal protect...

CVE-2018-18009: Use of Hard-coded Credentials

dirary0.js on D-Link DIR-140L, DIR-640L devices allows remote unauthenticated attackers to discover admin credentials...

CVE-2018-20305

D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpass parameter. In the /goform/form2userconfig.cgi handler function, a long password may lead to a stack-based buffer overflow and overwrite a return address...

CVE-2018-20305: Out-of-bounds Write

D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpass parameter. In the /goform/form2userconfig.cgi handler function, a long password may lead to a stack-based buffer overflow and overwrite a return address...

CVE-2018-20305

CVE-2018-20305 affects D-Link DIR-816 A2 with firmware 1.10 B05. The /goform/form2userconfig.cgi handler accepts a long password in the newpass parameter, causing a stack-based buffer overflow that can overwrite a return address and allows arbitrary remote code execution without authentication. N...

PT-2018-2065 · D Link · D-Link Dir-816

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.10 B05 Description: The issue allows for arbitrary remote code execution without authentication via the newpass parameter. In the "/goform/form2userconfig.cgi" handler function, a long password may lead to a...

CVE-2018-18248

Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, or the /icingaweb2/setup query string...

CVE-2018-18248

Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, or the /icingaweb2/setup query string...

CVE-2018-20056

An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. There is a stack-based buffer overflow allowing remote attackers to execute arbitrary code without authentication via the goform/formLanguageChange currTime parameter...

Stack overflow

An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. There is a stack-based buffer overflow allowing remote attackers to execute arbitrary code without authentication via the goform/formLanguageChange currTime parameter...

CVE-2018-20057

An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter...

PT-2018-3890 · D Link · D-Link Dir-605L +1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L version 2.06B1 D-Link DIR-605L version 2.12B1 Description: An issue was discovered in the /bin/boa component of D-Link DIR-619L and DIR-605L devices. The goform/formSysCmd endpoint allows remote authenticated users to execute...

CVE-2018-20057: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter...

CVE-2018-20056: Out-of-bounds Write

An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. There is a stack-based buffer overflow allowing remote attackers to execute arbitrary code without authentication via the goform/formLanguageChange currTime parameter...

CVE-2018-20057

An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value:...