D-Link DIR-850L < 1.14B07 BETA Multiple Vulnerabilities

D-Link DIR-850L is prone to multiple vulnerabilities. This vulnerability was known to be exploited by the IoT Botnet SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

PT-2017-12602

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 7.0.0 through 7.0.80 Description The issue allows bypassing security constraints and/or viewing the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request. This is possible wh...

PT-2017-12167

Name of the Vulnerable Software and Affected Versions ZenCart version 1.5.5e Description The issue arises from the traverseStrictSanitize function in admin dir/includes/classes/AdminRequestSanitizer.php, which mishandles key strings. This allows remote authenticated users to execute arbitrary PHP...

CVE-2017-10676

On D-Link DIR-600M devices before C1v3.05ENB01beta20170306, XSS was found in the form2userconfig.cgi username parameter...

CVE-2017-10676

On D-Link DIR-600M devices before C1v3.05ENB01beta20170306, XSS was found in the form2userconfig.cgi username parameter...

Design/Logic Flaw

On D-Link DIR-600M devices before C1v3.05ENB01beta20170306, XSS was found in the form2userconfig.cgi username parameter...

CVE-2017-10676

On D-Link DIR-600M devices before C1v3.05ENB01beta20170306, XSS was found in the form2userconfig.cgi username parameter...

CVE-2017-10676

The CVE-2017-10676 entry concerns a cross-site scripting (XSS) vulnerability in D-Link DIR-600M devices, specifically in the form2userconfig.cgi endpoint’s username parameter. Affects firmware versions prior to C1_v3.05ENB01_beta_20170306. The root cause is an XSS flaw in handling the username in...

PT-2017-11428 · D Link · Dir-600M

Name of the Vulnerable Software and Affected Versions: D-Link DIR-600M versions prior to C1 v3.05ENB01 beta 20170306 Description: A security issue was discovered in the form2userconfig.cgi endpoint, specifically in the username parameter, which is vulnerable to cross-site scripting XSS. This allo...

CVE-2017-10676: Improper Neutralization of Input During Web Page Generation

On D-Link DIR-600M devices before C1v3.05ENB01beta20170306, XSS was found in the form2userconfig.cgi username parameter...

Code injection

D-Link DIR-615 before v20.12PTb04 has a second admin account with a 0x1 BACKDOOR value, which might allow remote attackers to obtain access via a TELNET connection...

CVE-2017-11436

D-Link DIR-615 before v20.12PTb04 has a second admin account with a 0x1 BACKDOOR value, which might allow remote attackers to obtain access via a TELNET connection...

CVE-2017-11436

D-Link DIR-615 before v20.12PTb04 has a second admin account with a 0x1 BACKDOOR value, which might allow remote attackers to obtain access via a TELNET connection...

CVE-2017-11436

CVE-2017-11436 affects the D-Link DIR-615 router (pre-20.12PTb04) with a second admin account containing a 0x1 BACKDOOR value, which could allow remote attackers to gain administrator access via TELNET. The vulnerability is documented across multiple sources (NVD/CNVD) with impact described as re...

CVE-2017-11436

D-Link DIR-615 before v20.12PTb04 has a second admin account with a 0x1 BACKDOOR value, which might allow remote attackers to obtain access via a TELNET connection...

PT-2017-12010

Name of the Vulnerable Software and Affected Versions D-Link DIR-615 versions prior to 20.12PTb04 Description The issue allows remote attackers to obtain access via a TELNET connection, potentially due to a second admin account with a BACKDOOR value of 0x1. Recommendations For versions prior to...

CVE-2017-11436: Use of Hard-coded Credentials

D-Link DIR-615 before v20.12PTb04 has a second admin account with a 0x1 BACKDOOR value, which might allow remote attackers to obtain access via a TELNET connection...

Cross site request forgery (csrf)

On the D-Link DIR-615 before v20.12PTb04, if a victim logged in to the Router's Web Interface visits a malicious site from another Browser tab, the malicious site then can send requests to the victim's Router without knowing the credentials CSRF. An attacker can host a page that sends a POST...

CVE-2017-7404

On the D-Link DIR-615 before v20.12PTb04, if a victim logged in to the Router's Web Interface visits a malicious site from another Browser tab, the malicious site then can send requests to the victim's Router without knowing the credentials CSRF. An attacker can host a page that sends a POST...

CVE-2017-7406

The D-Link DIR-615 device before v20.12PTb04 doesn't use SSL for any of the authenticated pages. Also, it doesn't allow the user to generate his own SSL Certificate. An attacker can simply monitor network traffic to steal a user's credentials and/or credentials of users being added while sniffing...