CVE-2021-46456: Improper Neutralization of Special Elements used in a Command

D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetWLanACLSettings. This vulnerability allows attackers to execute arbitrary commands via the wl0.0maclist parameter...

D-Link Dir-823-Pro 命令注入漏洞

D-Link Dir-823-Pro is a dual-band smart wireless router from China Youxun D-Link. D-Link DIR-823-Pro v1.0.2 has a command injection vulnerability, which can be exploited by attackers to execute arbitrary commands via the ApCliKeyStr parameter...

D-Link Dir-823-Pro 命令注入漏洞

D-Link Dir-823-Pro is a dual-band smart wireless router from China Youxun D-Link. D-Link DIR-823-Pro v1.0.2 contains a command injection vulnerability, which can be exploited by attackers to execute arbitrary commands via the stationaccessenable parameter...

D-Link DIR-882 命令注入漏洞

The D-Link DIR-882 is a gigabit enterprise router from China Youxun D-Link. The D-Link DIR-882 suffers from a command injection vulnerability, which can be exploited by attackers to execute arbitrary commands via crafted HNAP1 POST requests...

CVE-2021-46452: Improper Neutralization of Special Elements used in a Command

D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetNetworkTomographySettings. This vulnerability allows attackers to execute arbitrary commands via the tomographypingaddress, tomographypingnumber, tomographypingsize,...

D-Link Dir-823-Pro 命令注入漏洞

D-Link Dir-823-Pro is a dual-band smart wireless router from China Youxun D-Link. D-Link DIR-823-Pro v1.0.2 is vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands via the wl0. 0 maclist parameter to execute arbitrary commands...

D-Link DIR-882 命令注入漏洞

D-Link DIR-882 is a wireless router from D-Link Taiwan, China. The D-Link DIR-882 suffers from an operating system command injection vulnerability, which can be exploited by attackers to execute arbitrary commands via crafted HNAP1 POST requests...

PT-2022-15950 · Mozilo · Mozilo

Name of the Vulnerable Software and Affected Versions: mozilo version 2.0 Description: The issue allows directory traversal attacks via the curent dir parameter. Recommendations: For version 2.0, consider restricting access to the curent dir parameter to minimize the risk of exploitation...

PT-2022-1550

Name of the Vulnerable Software and Affected Versions D-Link DIR-823-Pro version 1.0.2 Description The issue is related to a command injection vulnerability in the SetWLanACLSettings function. This vulnerability allows attackers to execute arbitrary commands via the wl0.0 maclist parameter. The...

PT-2022-1554

Name of the Vulnerable Software and Affected Versions D-Link DIR-823-Pro version 1.0.2 Description The issue is related to a command injection vulnerability in the SetNetworkTomographySettings function. This vulnerability allows attackers to execute arbitrary commands via the tomography ping...

PT-2022-1548

Name of the Vulnerable Software and Affected Versions D-Link DIR-823-Pro version 1.0.2 Description The issue is related to a command injection vulnerability in the SetStaticRouteSettings function. This vulnerability allows attackers to execute arbitrary commands via the staticroute list parameter...

PT-2022-1555

Name of the Vulnerable Software and Affected Versions D-Link DIR-823-Pro version 1.0.2 Description The issue is related to a command injection vulnerability in the SetWLanApcliSettings function. This vulnerability allows attackers to execute arbitrary commands via the ApCliKeyStr parameter. The...

PT-2022-1549

Name of the Vulnerable Software and Affected Versions D-Link DIR-823-Pro version 1.0.2 Description The issue is related to the implementation of the SetStationSettings function in the D-Link DIR-823-Pro wireless router's firmware, which is associated with insufficient input data sanitization when...

PT-2022-1553

Name of the Vulnerable Software and Affected Versions D-Link DIR-823-Pro version 1.0.2 Description The issue is related to a command injection vulnerability in the ChgSambaUserSettings function. This vulnerability allows attackers to execute arbitrary commands via the samba name parameter. The...

CVE-2022-21658 Race condition in std::fs::remove_dir_all in rustlang

Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the std::fs::removedirall standard library function is vulnerable a race condition enabling symlink following CWE-363. A...

PT-2022-2440

Name of the Vulnerable Software and Affected Versions D-Link DIR-825AC G1 affected versions not specified Description The issue is related to the incorrect handling of the cmd parameter in the cgi-bin/webupg component of the D-Link DIR-825AC G1 router's firmware. This can allow an attacker to...

CVE-2022-21658 Race condition in std::fs::remove_dir_all in rustlang

Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the std::fs::removedirall standard library function is vulnerable a race condition enabling symlink following CWE-363. A...

PT-2022-2439

Name of the Vulnerable Software and Affected Versions D-Link DIR-825 G1 Description The issue is related to the "webupg" binary, where attackers can bypass authentication through the autoupgrade.asp parameter. This allows them to perform unauthorized actions, such as downloading configuration fil...

PT-2022-2086 · D Link · D-Link Dir-850L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-850 versions ET850-1.08TRb03 Description: The issue is related to insufficient access control in the router's firmware, which can be exploited by a remote attacker to redirect users to an arbitrary URL. This can potentially lead to...

Improper validation of Windows paths could lead to directory traversal attack

Path resolution in warp::filters::fs::dir didn't correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem. Th...