CVE-2019-5123: Improper Neutralization of Special Elements used in an SQL Command

Specially crafted web requests can cause SQL injections in YouPHPTube 7.6. An attacker can send a web request with Parameter dir in /objects/pluginSwitch.json.php...

D-Link DIR Devices Information Disclosure Vulnerability (Oct 2019)

Multiple D-Link DIR devices are prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Multiple D-Link routers vulnerable to remote command execution

Overview Multiple D-Link routers are vulnerable to unauthenticated remote command execution. Description Several D-Link routers contain CGI capability that is exposed to users as /applysec.cgi, and dispatched on the device by the binary /www/cgi/ssi. This CGI code contains two flaws: 1. The...

D-Link DIR-817LW and D-Link DIR-868L License Issue Vulnerability

The D-Link DIR-817LW and the D-Link DIR-868L are both wireless routers from AUO D-Link of Taiwan, China. A security vulnerability exists in the D-Link DIR-868L version B1-2.03 and the DIR-817LW version A1-1.04, which stems from the fact that some web interfaces do not require authentication. The...

D-Link DIR-866L Cross-Site Scripting Vulnerability

The D-Link DIR-866L is a wireless router from AUO D-Link of Taiwan, China. A cross-site scripting vulnerability exists in the D-Link DIR-866L version 1.03B04. A remote attacker can exploit this vulnerability to execute arbitrary code via the device's common gateway interface...

CVE-2019-17512

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can clear the router's log file via act=clear&logtype=sysact to logclear.php, which could be used to erase attack traces...

CVE-2019-17512

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can clear the router's log file via act=clear&logtype=sysact to logclear.php, which could be used to erase attack traces...

CVE-2019-17512

CVE-2019-17512 affects D-Link DIR-412 devices (A1-1.14WW). The issue arises from web interfaces that allow unauthenticated users to clear the router’s log by invoking log_clear.php with act=clear&logtype=sysact, which could erase attack traces. The NVD entry notes a base score of 6.4 (CVSS2) and ...

CVE-2019-17512

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can clear the router's log file via act=clear&logtype=sysact to logclear.php, which could be used to erase attack traces...

CVE-2019-17663

D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection...

CVE-2019-17663

D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection...

Design/Logic Flaw

D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection...

CVE-2019-17663

D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection...

CVE-2019-17663

The CVE-2019-17663 entries describe a cross-site scripting vulnerability in D-Link DIR-866L firmware (version 1.03B04) where HtmlResponseMessage in the device’s common gateway interface can be abused to perform a common injection. Root cause centers on how input data is processed by HtmlResponseM...

PT-2019-15178

Name of the Vulnerable Software and Affected Versions D-Link DIR-412 A1 version 1.14WW Description The issue concerns the presence of unauthenticated web interfaces on the affected router. An attacker can exploit this by accessing the "log clear.php" endpoint with specific parameters, such as...

CVE-2019-17512: Missing Authentication for Critical Function

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can clear the router's log file via act=clear&logtype=sysact to logclear.php, which could be used to erase attack traces...

CVE-2019-17663: Improper Neutralization of Input During Web Page Generation

D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection...

D-Link DIR-880L and DIR-895 L/R Buffer Overflow Vulnerability

The D-Link DIR-880L is a wireless AC1900 dual-band Gigabit cloud router.The D-Link DIR-895 L/R is an AC5300 Wi-Fi tri-band router. A buffer overflow vulnerability exists in the htdocs/fileaccess.cgi component in the D-Link DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. An attacker can exploit this...

CVE-2017-14948

Certain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The impact is: execute arbitrary code remote. The component is: htdocs/fileaccess.cgi. The attack vector is: A crafted HTTP request handled by fileacces.cgi could allow an attacker to...

Buffer overflow

Certain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The impact is: execute arbitrary code remote. The component is: htdocs/fileaccess.cgi. The attack vector is: A crafted HTTP request handled by fileacces.cgi could allow an attacker to...