CVE-2017-3191

CVE-2017-3191 affects D-Link DIR-130 (firmware 1.23) and DIR-330 (firmware 1.12); a POST manipulation on the remote management login page enables authentication bypass to access admin pages (e.g., tools_admin.asp) without credentials. Related CVE-2017-3192 covers credential exposure on tools_admi...

PT-2017-15702 · D Link · D-Link Dir-330 +1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-130 version 1.23 D-Link DIR-330 version 1.12 Description: The issue concerns insufficient protection of administrator credentials. Specifically, the tools admin.asp page returns the administrator password in base64 encoding, allowi...

PT-2017-15701 · D Link · D-Link Dir-330 +1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-130 version 1.23 D-Link DIR-330 version 1.12 Description: The issue allows a remote attacker to bypass authentication on the remote login page. By manipulating the POST request, an attacker can access administrator-only pages, such...

D-Link DIR-605L Model B Denial of Service Vulnerability

D-Link DIR-605L Model B is a wireless router product from AUO D-Link. A denial of service vulnerability exists in versions prior to D-Link DIR-605L Model B FW2.11betaB06hbrf. An attacker could exploit this vulnerability by sending an HTTP request with a password field with a long string in the HT...

Cross site request forgery (csrf)

An issue was discovered on D-Link DIR-605L Model B before FW2.11betaB06hbrf devices, related to the code that handles the authentication values for HNAP. An attacker can cause a denial of service device crash or possibly have unspecified other impact by sending a sufficiently long string in the...

CVE-2017-17065

An issue was discovered on D-Link DIR-605L Model B before FW2.11betaB06hbrf devices, related to the code that handles the authentication values for HNAP. An attacker can cause a denial of service device crash or possibly have unspecified other impact by sending a sufficiently long string in the...

CVE-2017-17065

An issue was discovered on D-Link DIR-605L Model B before FW2.11betaB06hbrf devices, related to the code that handles the authentication values for HNAP. An attacker can cause a denial of service device crash or possibly have unspecified other impact by sending a sufficiently long string in the...

CVE-2017-17065

An issue was discovered on D-Link DIR-605L Model B before FW2.11betaB06hbrf devices, related to the code that handles the authentication values for HNAP. An attacker can cause a denial of service device crash or possibly have unspecified other impact by sending a sufficiently long string in the...

CVE-2017-17065

CVE-2017-17065 affects D-Link DIR-605L Model B prior to FW2.11betaB06_hbrf. The issue stems from the HNAP authentication code, where sending a password field with a long string in the HTTP Basic Authentication section can cause a device crash (denial of service) and potentially other unspecified ...

PT-2017-14693 · D Link · D-Link Dir-605L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-605L Model B versions prior to FW2.11betaB06 hbrf Description: An issue was discovered related to the code that handles the authentication values for HNAP. An attacker can cause a denial of service device crash or possibly have...

CVE-2017-17065: Improper Input Validation

An issue was discovered on D-Link DIR-605L Model B before FW2.11betaB06hbrf devices, related to the code that handles the authentication values for HNAP. An attacker can cause a denial of service device crash or possibly have unspecified other impact by sending a sufficiently long string in the...

transmission-daemon -- vulnerable to dns rebinding attacks

Google Project Zero reports: The transmission bittorrent client uses a client/server architecture, the user interface is the client which communicates to the worker daemon using JSON RPC requests. As with all HTTP RPC schemes like this, any website can send requests to the daemon listening on...

D-Link DIR-850L Credential Disclosure Exploit

D-Link DIR-850L remote code execution variant exploit that extracts username and password for the device. !/bin/bash Derped together by Raphael de la Vienne A.K.A. Hackdwerg Original exploit https://www.rapid7.com/db/modules/exploit/linux/http/dlinkdir850lunauthexec Just in case if you dont have...

[SECURITY] Fedora 26 Update: mediawiki-1.28.3-1.fc26

MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances...

D-Link DIR-850L Credential Disclosure

!/bin/bash Derped together by Raphael de la Vienne A.K.A. Hackdwerg Original exploit https://www.rapid7.com/db/modules/exploit/linux/http/dlinkdir850lunauthexec Just in case if you dont have metasploit, or are to lazy to install it. here is a bash variant. Exploit Title:...

CVE-2017-16903: Improper Limitation of a Pathname to a Restricted Directory

LvyeCMS through 3.1 allows remote attackers to upload and execute arbitrary PHP code via directory traversal sequences in the dir parameter, in conjunction with PHP code in the content parameter, within a template Style add request to index.php...

PT-2017-14630

Name of the Vulnerable Software and Affected Versions LvyeCMS versions prior to 3.1 Description The issue allows remote attackers to upload and execute arbitrary PHP code. This can be achieved through directory traversal sequences in the dir parameter, combined with PHP code in the content...

CVE-2017-1000234

I, Librarian version =4.6 & 4.7 is vulnerable to Directory Enumeration in the jqueryFileTree.php resulting in attacker enumerating directories simply by navigating through the "dir" parameter...

CVE-2017-1000234: Exposure of Sensitive Information to an Unauthorized Actor

I, Librarian version =4.6 & 4.7 is vulnerable to Directory Enumeration in the jqueryFileTree.php resulting in attacker enumerating directories simply by navigating through the "dir" parameter...

PT-2017-10928

Name of the Vulnerable Software and Affected Versions I, Librarian versions prior to 4.8 Description The issue allows an attacker to enumerate directories by navigating through the dir parameter in the jqueryFileTree.php. This enables the attacker to list directories, potentially revealing...