10240 matches found
CVE-2020-15895
An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. In the file webinc/js/info.php, no output filtration is applied to the RESULT parameter, before it's printed on the webpage...
CVE-2020-15895
D-Link DIR-816L devices (2.x) before 1.10b04Beta02 contain an XSS in webinc/js/info.php where the RESULT parameter is printed without output filtration. An attacker can inject arbitrary script in a victim’s browser, potentially enabling cookie-based credential theft and other browser-based attack...
PT-2020-5981 · D Link · D-Link Dir-816L
Name of the Vulnerable Software and Affected Versions: D-Link DIR-816L versions 2.x before 1.10b04Beta02 Description: An issue exists in the Universal Plug and Play UPnP component of the D-Link DIR-816L device, where UPnP is enabled by default on port 1900. This allows an attacker to perform...
CVE-2020-15894: Missing Authentication for Critical Function
An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utilized by an attacker to retrieve various sensitive information, such as admin login credentials, by...
CVE-2020-15895: Improper Neutralization of Input During Web Page Generation
An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. In the file webinc/js/info.php, no output filtration is applied to the RESULT parameter, before it's printed on the webpage...
CVE-2020-15893: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. Universal Plug and Play UPnP is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target ST field of the SSDP M-SEARCH discover packet...
D-Link DIR-867, DIR-878 and DIR-882 Authentication Bypass Vulnerabilities
The D-Link DIR-878 and D-Link DIR-867 are both a wireless router from AUO D-Link of Taiwan, China. A security vulnerability exists in the HNAP request handling in the DIR-867-US using firmware version 1.20B10 and earlier and the DIR-878 using firmware version 1.20B05 and earlier, which stems from...
D-Link DIR-842 Authentication Vulnerability
The D-Link DIR-842 is a wireless router from AUO D-Link of Taiwan, China. A security vulnerability exists in the HNAP GetCAPTCHAsetting request processing in the D-Link DIR-842. The vulnerability originates from a network system or product that does not properly authenticate a user's identity. An...
D-Link DIR-842 HNAP GetCAPTCHAsetting Authentication Bypass Vulnerability
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HNAP GetCAPTCHAsetting requests. The issue results fro...
PT-2020-14555
Name of the Vulnerable Software and Affected Versions D-Link DIR-842 version 3.13B05 Description This issue allows network-adjacent attackers to bypass authentication on affected installations. The specific flaw exists within the processing of HNAP GetCAPTCHAsetting requests, resulting from the...
D-Link DIR-610 Remote Code Execution Vulnerability
The D-Link DIR-610 is a wireless router from AUO D-Link of Taiwan, China. A remote code execution vulnerability exists in the D-Link DIR-610, which arises from a failure of a network system or product to properly filter specific elements of externally entered data during the construction of a cod...
D-Link DIR-610 Information Disclosure Vulnerability
The D-Link DIR-610 is a wireless router from AUO D-Link of Taiwan, China. An information disclosure vulnerability exists in the D-Link DIR-610, which arises from errors in the configuration of a network system or product during operation, and can be exploited by sending...
CVE-2020-9377
D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
CVE-2020-9376
D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZEDGROUP=1 to getcfg.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
Command injection
D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
Information disclosure
D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZEDGROUP=1 to getcfg.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
CVE-2020-9376
D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZEDGROUP=1 to getcfg.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
CVE-2020-9376
D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZEDGROUP=1 to getcfg.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
CVE-2020-9376
D-Link DIR-610 devices have an information disclosure vulnerability exposed through the getcfg.php endpoint by passing SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1. The issue is described consistently across CVE-2020-9376 references and related scans (e.g., NVD, Nuclei template) as affecting devi...