CVE-2019-7389: Missing Authentication for Critical Function

An issue was discovered in /bin/goahead on D-Link DIR-823G devices with the firmware 1.02B03. There is incorrect access control allowing remote attackers to reset the router without authentication via the SetFactoryDefault HNAP API. Consequently, an attacker can achieve a denial-of-service attack...

Command injection

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 request. This occurs when any HNAP API function triggers a call to the system function with untrusted input fr...

CVE-2019-7298

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 request. This occurs when any HNAP API function triggers a call to the system function with untrusted input fr...

CVE-2019-7298

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 request. This occurs when any HNAP API function triggers a call to the system function with untrusted input fr...

CVE-2019-7298

Summary: CVE-2019-7298 affects the D-Link DIR-823G family (firmware up to 1.02B03). The vulnerability is an OS command injection in HNAP processing: any HNAP API function can trigger a call to the system() function using untrusted input from the request body, enabling remote command execution. An...

CVE-2019-7298

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 request. This occurs when any HNAP API function triggers a call to the system function with untrusted input fr...

PT-2019-2535

Name of the Vulnerable Software and Affected Versions D-Link DIR-823G firmware 1.02B03 Description The issue is related to incorrect access control in the /bin/goahead executable, allowing remote attackers to hijack the DNS service configuration of all clients in the WLAN without authentication...

PT-2019-1516

Name of the Vulnerable Software and Affected Versions D-Link DIR-823G versions through 1.02B03 Description The issue exists due to the lack of measures to neutralize special elements used in the operating system command. Exploitation of this issue may allow a remote attacker to execute arbitrary...

CVE-2019-7298: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 request. This occurs when any HNAP API function triggers a call to the system function with untrusted input fr...

CVE-2019-7297

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system...

Command injection

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system...

CVE-2019-7297

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system...

CVE-2019-7297

CVE-2019-7297 affects D-Link DIR-823G devices with firmware up to 1.02B03. A command-injection vulnerability exists in the /HNAP1 interface: GetNetworkTomographyResult calls system with an untrusted Address input, allowing remote attackers to execute arbitrary OS commands via crafted requests. Ex...

CVE-2019-7297

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system...

CVE-2018-19040

The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocatorgetdir action to the wp-admin/admin-ajax.php URI...

CVE-2018-19041

The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocatorgetdir action to the wp-admin/admin-ajax.php URI...

PT-2019-1345 · D Link · D-Link Dir-823G

Name of the Vulnerable Software and Affected Versions: D-Link DIR-823G devices with firmware through 1.02B03 Description: An issue allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls...

PT-2019-9722

Name of the Vulnerable Software and Affected Versions Media File Manager plugin version 1.4.2 Description The issue allows for XSS via the dir parameter of an mrelocator getdir action to the "wp-admin/admin-ajax.php" API endpoint. Recommendations For Media File Manager plugin version 1.4.2, avoid...

PT-2019-9724

Name of the Vulnerable Software and Affected Versions Media File Manager plugin version 1.4.2 Description The issue allows for arbitrary file renaming by exploiting a directory traversal vulnerability in the dir parameter of the mrelocator rename action. This can be achieved by sending a request ...

CVE-2018-19041: Improper Neutralization of Input During Web Page Generation

The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocatorgetdir action to the wp-admin/admin-ajax.php URI...