D-Link DIR-615 Cross Site Scripting

Exploit Title: D-Link DIR-615 Wireless Router - Persistent Cross Site Scripting XSS Date: 14.04.2018 Exploit Author: Sayan Chatterjee Vendor Homepage: http://www.dlink.co.in Hardware Link: http://www.dlink.co.in/products/?pid=678 Category: Hardware Wi-fi Router Hardware Version: T1 Firmware...

D-Link DIR-615 Wireless Router - Persistent Cross Site Scripting

Exploit Title: D-Link DIR-615 Wireless Router - Persistent Cross Site Scripting XSS Date: 14.04.2018 Exploit Author: Sayan Chatterjee Vendor Homepage: http://www.dlink.co.in Hardware Link: http://www.dlink.co.in/products/?pid=678 Category: Hardware Wi-fi Router Hardware Version: T1 Firmware...

CVE-2018-10108

D-Link DIR-815 REV. B with firmware through DIR-815REVBFIRMWAREPATCH2.07.B01 devices have XSS in the Treturn parameter to /htdocs/webinc/js/bscsmsinbox.php...

CVE-2018-10107

D-Link DIR-815 REV. B with firmware through DIR-815REVBFIRMWAREPATCH2.07.B01 devices have XSS in the RESULT parameter to /htdocs/webinc/js/info.php...

CVE-2018-10107

D-Link DIR-815 REV. B with firmware through DIR-815REVBFIRMWAREPATCH2.07.B01 devices have XSS in the RESULT parameter to /htdocs/webinc/js/info.php...

CVE-2018-10106

D-Link DIR-815 REV. B with firmware through DIR-815REVBFIRMWAREPATCH2.07.B01 devices have permission bypass and information disclosure in /htdocs/web/getcfg.php, as demonstrated by a /getcfg.php?a=%0aPOSTSERVICES%3DDEVICE.ACCOUNT%0aAUTHORIZEDGROUP%3D1 request...

CVE-2018-10108

D-Link DIR-815 REV. B with firmware through DIR-815REVBFIRMWAREPATCH2.07.B01 devices have XSS in the Treturn parameter to /htdocs/webinc/js/bscsmsinbox.php...

CVE-2018-10106

D-Link DIR-815 REV. B with firmware through DIR-815REVBFIRMWAREPATCH2.07.B01 devices have permission bypass and information disclosure in /htdocs/web/getcfg.php, as demonstrated by a /getcfg.php?a=%0aPOSTSERVICES%3DDEVICE.ACCOUNT%0aAUTHORIZEDGROUP%3D1 request...

Information disclosure

D-Link DIR-815 REV. B with firmware through DIR-815REVBFIRMWAREPATCH2.07.B01 devices have permission bypass and information disclosure in /htdocs/web/getcfg.php, as demonstrated by a /getcfg.php?a=%0aPOSTSERVICES%3DDEVICE.ACCOUNT%0aAUTHORIZEDGROUP%3D1 request...

Design/Logic Flaw

D-Link DIR-815 REV. B with firmware through DIR-815REVBFIRMWAREPATCH2.07.B01 devices have XSS in the Treturn parameter to /htdocs/webinc/js/bscsmsinbox.php...

Design/Logic Flaw

D-Link DIR-815 REV. B with firmware through DIR-815REVBFIRMWAREPATCH2.07.B01 devices have XSS in the RESULT parameter to /htdocs/webinc/js/info.php...

CVE-2018-10108

The CVE-2018-10108 entry covers a cross-site scripting (XSS) vulnerability in D-Link DIR-815 REV. B devices, reported to affect firmware up to DIR-815_REVB_FIRMWARE_PATCH_2.07.B01, specifically in the Treturn parameter of /htdocs/webinc/js/bsc_sms_inbox.php. Public sources in the connected data c...

CVE-2018-10106

D-Link DIR-815 REV. B with firmware through DIR-815REVBFIRMWAREPATCH2.07.B01 devices have permission bypass and information disclosure in /htdocs/web/getcfg.php, as demonstrated by a /getcfg.php?a=%0aPOSTSERVICES%3DDEVICE.ACCOUNT%0aAUTHORIZEDGROUP%3D1 request...

CVE-2018-10107

D-Link DIR-815 REV. B with firmware through DIR-815REVBFIRMWAREPATCH2.07.B01 devices have XSS in the RESULT parameter to /htdocs/webinc/js/info.php...

CVE-2018-10107

Affected product: D-Link DIR-815 Rev. B (firmware through 2.07.B01). Vulnerable component: /htdocs/webinc/js/info.php, specifically the RESULT parameter, due to inadequate input/page protection that enables cross-site scripting. Impact: an attacker could exploit the XSS to obtain authentication c...

CVE-2018-10106

CVE-2018-10106 affects D-Link DIR-815 Rev. B (firmware up to DIR-815_REVB_FIRMWARE_PATCH_2.07.B01). The vulnerability is a permission bypass and information disclosure in /htdocs/web/getcfg.php, demonstrated by a crafted request to /getcfg.php?a=%0a_POST_SERVICES%3DDEVICE.ACCOUNT%0aAUTHORIZED_GRO...

CVE-2018-10108

D-Link DIR-815 REV. B with firmware through DIR-815REVBFIRMWAREPATCH2.07.B01 devices have XSS in the Treturn parameter to /htdocs/webinc/js/bscsmsinbox.php...

CVE-2018-10108: Improper Neutralization of Input During Web Page Generation

D-Link DIR-815 REV. B with firmware through DIR-815REVBFIRMWAREPATCH2.07.B01 devices have XSS in the Treturn parameter to /htdocs/webinc/js/bscsmsinbox.php...

D-Link DIR-815 Cross-Site Scripting Vulnerability (CNVD-2018-08947)

D-Link DIR-815 REV.B is a wireless router product from AUO D-Link. A cross-site scripting vulnerability exists in the D-Link DIR-815 REV. B using firmware DIR-815REVBFIRMWAREPATCH2.07.B01 and prior versions. A remote attacker can exploit this vulnerability by sending the 'RESULT' parameter to the...

PT-2018-9684 · D Link · D-Link Dir-815

Name of the Vulnerable Software and Affected Versions: D-Link DIR-815 REV. B versions through DIR-815 REVB FIRMWARE PATCH 2.07.B01 Description: The issue concerns a problem with the Treturn parameter in the /htdocs/webinc/js/bsc sms inbox.php API endpoint, which can be exploited. Recommendations:...