10353 matches found
CVE-2018-17068
An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction in the handler function of the /goform/Diagnosis route. This could lead to command injection via shell metacharacters in the sendNum parameter...
CVE-2018-17065
An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/DDNS route, a very long password could lead to a stack-based buffer overflow and overwrite the return address...
CVE-2018-17068
An explicit vulnerability entry exists for D-Link DIR-816 A2 with firmware 1.10 B05 (DIR-816) where the HTTP /goform/Diagnosis handler builds a command string using the sendNum parameter, enabling command injection via shell metacharacters. Connected CNVD/CVEs reiterate that this is a command-inj...
CVE-2018-17067
An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. A very long password to /goform/formLogin could lead to a stack-based buffer overflow and overwrite the return address...
CVE-2018-17065: Out-of-bounds Write
An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/DDNS route, a very long password could lead to a stack-based buffer overflow and overwrite the return address...
CVE-2018-17063: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/NTPSyncWithHost route. This could lead to command injection via shell metacharacters...
PT-2018-3884 · D Link · D-Link Dir-816 A2
Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.10 B05 Description: An issue exists in the handler function of the "/goform/NTPSyncWithHost" route, where an HTTP request parameter is used in command string construction. This could lead to command injection via...
PT-2018-3879 · D Link · Dir-816
Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.10 B05 Description: The issue exists due to the lack of neutralization of special elements used in the operating system command. This could allow a remote attacker to execute arbitrary commands through shell...
CVE-2018-17066: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction in the handler function of the /goform/form2systime.cgi route. This could lead to command injection via shell metacharacters in the datetime parameter...
CVE-2018-17064: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/sylogapply route. This could lead to command injection via the syslogIp parameter after /goform/clearlog is invoked...
PT-2018-3881 · D Link · D-Link Dir-816 A2
Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.10 B05 Description: An issue exists in the handler function of the "/goform/form2systime.cgi" route, where an HTTP request parameter is used in command string construction. This could lead to command injection via...
PT-2018-3880 · D Link · D-Link Dir-816 A2
Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.10 B05 Description: The issue is related to a stack-based buffer overflow that can occur when a very long password is sent to the /goform/formLogin endpoint. This can lead to overwriting the return address. The...
CVE-2018-17068: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction in the handler function of the /goform/Diagnosis route. This could lead to command injection via shell metacharacters in the sendNum parameter...
CVE-2018-17067: Out-of-bounds Write
An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. A very long password to /goform/formLogin could lead to a stack-based buffer overflow and overwrite the return address...
CVE-2018-16605
D-Link DIR-600M devices allow XSS via the Hostname and Username fields in the Dynamic DNS Configuration page...
Design/Logic Flaw
D-Link DIR-600M devices allow XSS via the Hostname and Username fields in the Dynamic DNS Configuration page...
CVE-2018-16605
The CVE-2018-16605 entry pertains to D-Link DIR-600M devices where an XSS vulnerability exists in the Dynamic DNS Configuration page, specifically via the Hostname and Username fields. The vulnerability allows remote attackers to inject arbitrary web script or HTML when interacting with these fie...
PT-2018-13644
Name of the Vulnerable Software and Affected Versions D-Link DIR-600M affected versions not specified Description The issue allows for cross-site scripting XSS attacks through the Hostname and Username fields in the Dynamic DNS Configuration page. This can potentially lead to malicious script...
CVE-2018-16605: Improper Neutralization of Input During Web Page Generation
D-Link DIR-600M devices allow XSS via the Hostname and Username fields in the Dynamic DNS Configuration page...
