An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18 2.8.12 and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5 3.5.6 and 3.6.4 as well as previous versions are affected.

...

PT-2020-11202 · D Link · D-Link Dir-822

Name of the Vulnerable Software and Affected Versions: D-Link DIR-822 Rev.Bx devices with firmware version 202KRb06 and older Description: The issue concerns a buffer overflow that can occur when handling long MacAddress data in a "HNAP1/SetClientInfo" HNAP protocol message. This message is...

CVE-2019-6258: Buffer Copy without Checking Size of Input

D-Link DIR-822 Rev.Bx devices with firmware v.202KRb06 and older allow a buffer overflow via long MacAddress data in a /HNAP1/SetClientInfo HNAP protocol message, which is mishandled in /usr/sbin/udhcpd during reading of the /var/servd/LAN-1-udhcpd.conf file...

D-Link DIR-816L Devices Multiple Vulnerabilities (2020 - 2025)

D-Link DIR-816L is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:dlink:dir-816lfirmware"; if...

D-Link DIR-816L Information Disclosure Vulnerability (CVE-2020-15894)

The D-Link DIR-816L is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPEPREFIX =...

HawkScan - Security Tool For Reconnaissance And Information Gathering On A Website

Security Tool for Reconnaissance and Information Gathering on a website. python 2.x & 3.x This script use "WafW00f" to detect the WAF in the first step https://github.com/EnableSecurity/wafw00f This script use "Sublist3r" to scan subdomains https://github.com/aboul3la/Sublist3r This script use...

CVE-2020-15632

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HNAP GetCAPTCHAsetting requests. The issue...

CVE-2020-15632

CVE-2020-15632 affects D-Link DIR-842 routers (3.13B05). The flaw lies in the HNAP GetCAPTCHAsetting request processing, caused by improper session handling, allowing network-adjacent attackers to bypass authentication and execute arbitrary code in the device context. Exploitation details and adv...

CVE-2020-15633

CVE-2020-15633 affects D-Link DIR-867-US, DIR-878, and DIR-882-US routers with firmware 1.20B10_BETA. The root cause is incorrect string matching in the handling of HNAP requests, enabling network-adjacent attackers to bypass authentication and potentially escalate privileges to execute code in t...

CVE-2020-15884

A SQL injection vulnerability in TableQuery.php in MunkiReport before 5.6.3 allows attackers to execute arbitrary SQL commands via the order0dir field on POST requests to /datatables/data...

PT-2020-14685

Name of the Vulnerable Software and Affected Versions MunkiReport versions prior to 5.6.3 Description A SQL injection issue allows attackers to execute arbitrary SQL commands. This is achieved via the order0dir field on POST requests to the "/datatables/data" API endpoint. Recommendations For...

D-Link DIR-816L Command Injection Vulnerability

The D-Link DIR-816L is a wireless router from AUO D-Link of Taiwan, China. An operating system command injection vulnerability exists in version 2.x of the D-Link DIR-816L prior to 1.10b04Beta02. An attacker can exploit this vulnerability to inject arbitrary commands...

D-Link DIR-816L Cross-Site Scripting Vulnerability

The D-Link DIR-816L is a wireless AC750 dual-band cloud router. A cross-site scripting vulnerability exists in the D-Link DIR-816L. The vulnerability stems from the webinc/js/info.php file printing the RESULT parameter on a web page without applying any output filter. An attacker can exploit this...

D-Link DIR-816L Information Disclosure Vulnerability

The D-Link DIR-816L is a wireless router from AUO D-Link of Taiwan, China. An information disclosure vulnerability exists in version 2.x of the D-Link DIR-816L prior to 1.10b04Beta02. The vulnerability can be exploited by an attacker to retrieve various sensitive information, such as administrato...

CVE-2020-15884: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in TableQuery.php in MunkiReport before 5.6.3 allows attackers to execute arbitrary SQL commands via the order0dir field on POST requests to /datatables/data...

CVE-2020-15633: Authentication Bypass Using an Alternate Path or Channel

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.20B10BETA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP...

CVE-2020-15632: Incorrect Implementation of Authentication Algorithm

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HNAP GetCAPTCHAsetting requests. The issue...

CVE-2020-15893

An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. Universal Plug and Play UPnP is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target ST field of the SSDP M-SEARCH discover packet...

CVE-2020-15894

An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utilized by an attacker to retrieve various sensitive information, such as admin login credentials, by...

CVE-2020-15895

An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. In the file webinc/js/info.php, no output filtration is applied to the RESULT parameter, before it's printed on the webpage...