CVE-2021-20115

A reflected cross-site scripting vulnerability exists in TCExam = 14.8.3. The paths provided in the f, d, and dir parameters in tcefilemanager.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious link...

CVE-2021-20115: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting vulnerability exists in TCExam = 14.8.3. The paths provided in the f, d, and dir parameters in tcefilemanager.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious link...

CVE-2021-20116: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting vulnerability exists in TCExam = 14.8.4. The paths provided in the f, d, and dir parameters in tceselectmediafile.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious lin...

D-Link DIR-3040 < 1.13B03 Hotfix Multiple Vulnerabilities - Active Check

D-Link DIR-3040 devices are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPEPREFIX = "cpe:/o:dlink"; if...

Cross site request forgery (csrf)

On Crestron DM-NVX-DIR, DM-NVX-DIR80, and DM-NVX-ENT devices before the DM-XIO/1-0-3-802 patch, the password can be changed by sending an unauthenticated WebSocket request...

多款 Crestron 设备授权问题漏洞

Crestron Electronics Crestron DM-NVX-DIR and DM-NVX-ENT are both virtual switching devices from Crestron Electronics, Inc. An authorization issue vulnerability exists in multiple Crestron devices where an attacker can send an unauthenticated Websocket request to change a password because the devi...

CVE-2020-16839

On Crestron DM-NVX-DIR, DM-NVX-DIR80, and DM-NVX-ENT devices before the DM-XIO/1-0-3-802 patch, the password can be changed by sending an unauthenticated WebSocket request...

CVE-2020-16839

This CVE affects Crestron DM-NVX-DIR, DM-NVX-DIR80, and DM-NVX-ENT devices prior to patch DM-XIO/1-0-3-802. The root issue is an unauthenticated WebSocket request that allows changing the device password, indicating a lack of proper permission validation on the WebSocket API. The vulnerability is...

CVE-2020-16839: Improper Authentication

On Crestron DM-NVX-DIR, DM-NVX-DIR80, and DM-NVX-ENT devices before the DM-XIO/1-0-3-802 patch, the password can be changed by sending an unauthenticated WebSocket request...

PT-2021-10075

Name of the Vulnerable Software and Affected Versions: Crestron DM-NVX-DIR versions prior to DM-XIO/1-0-3-802 patch Crestron DM-NVX-DIR80 versions prior to DM-XIO/1-0-3-802 patch Crestron DM-NVX-ENT versions prior to DM-XIO/1-0-3-802 patch Description: The issue allows the password to be changed ...

D-LINK DIR-3040 Libcli 命令注入漏洞(CVE-2021-21819)

The DIR-3040 is an AC3000-based wireless internet router. As discussed in TALOS-2021-1285, a hidden telnet service can be started without authentication by visiting https:///starttelnet This service presents the user with a login prompt for their “libcli test environment”: $ telnet 192.168.0.1...

D-LINK DIR-3040 Zebra IP 路由管理器信息泄露漏洞(CVE-2021-21817)

The DIR-3040 is an AC3000-based wireless internet router. Zebra is an IP routing manager that provides kernel routing table updates, interface lookups, and redistribution of routes between different routing protocols. The DIR-3040 runs this service by default on TCP port 2601 and can be accessed ...

D-LINK DIR-3040 服务组件使用默认密码（CVE-2021-21818）

The DIR-3040 is an AC3000-based wireless internet router. Zebra is an IP routing manager that provides kernel routing table updates, interface lookups, and redistribution of routes between different routing protocols. The DIR-3040 runs this service by default on TCP port 2601 and can be accessed ...

PT-2021-4033

Name of the Vulnerable Software and Affected Versions TCExam versions prior to 14.8.4 Description A reflected cross-site scripting issue exists due to improper validation of the paths provided in the f, d, and dir parameters in tce filemanager.php. This could cause reflected XSS via the unsanitiz...

PT-2021-4018

Name of the Vulnerable Software and Affected Versions TCExam versions prior to 14.8.5 Description A reflected cross-site scripting issue exists due to improper validation of paths provided in the f, d, and dir parameters in tce select mediafile.php. This could cause reflected XSS via unsanitized...

D-LINK DIR-3040 Trust Management Issue Vulnerability (CNVD-2021-53335)

D-LINK DIR-3040 is a router from D-Link, Taiwan, China. A trust management issue vulnerability exists in the D-LINK DIR-3040, which stems from the product's Zebra IP Routing Manager feature.The lack of an effective trust management mechanism in the Zebra IP Routing Manager feature of the D-LINK...

D-LINK DIR-3040 Trust Management Issue Vulnerability

The D-Link DIR-3040 is a router from AUO D-Link of Taiwan, China. It provides the function of connecting to a network. A trust management issue vulnerability exists in Libcli for D-LINK DIR-3040 1.13B03, which stems from a specially designed network request can lead to code execution. No detailed...

D-LINK DIR-3040 Information Disclosure Vulnerability (CNVD-2021-53338)

The D-LINK DIR-3040 is a router from D-Link, a Taiwan-based company that provides connectivity to the Internet.The D-LINK DIR-3040 is vulnerable to an information disclosure vulnerability that could be exploited by an attacker to send HTTP requests resulting in the disclosure of sensitive...

CVE-2021-21820

A hard-coded password vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to code execution. An attacker can send a sequence of requests to trigger this vulnerability...

CVE-2021-21819

A code execution vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability...