10240 matches found
CVE-2020-10214
Affected product: D-Link DIR-825 Rev.B (firmware 2.10). Vulnerability: stack-based buffer overflow in the httpd binary that can be triggered by a POST to ntp_sync.cgi with a sufficiently long ntp_server parameter. Impact: allows an authenticated user to execute arbitrary code on the device. Root ...
CVE-2020-10215
The D-Link DIR-825 Rev.B 2.10 and TRENDnet TEW-632BRP 1.010B32 routers are vulnerable to a command injection flaw in the dns_query.cgi component. This vulnerability exists because the software fails to properly neutralize special elements used in operating system commands when processing the dns_...
CVE-2020-10215
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the dnsqueryname parameter in a dnsquery.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected...
CVE-2020-10216
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the date parameter in a systemtime.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected...
CVE-2020-10216
The CVE-2020-10216 entry documents a command-injection vulnerability affecting D-Link DIR-825 Rev.B 2.10 and TRENDnet TEW-632BRP 1.010B32. A remote attacker can exploit the vulnerability by sending a crafted date parameter in a system_time.cgi POST request to execute arbitrary commands. Impact is...
CVE-2020-10213
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the wpsstaenrolleepin parameter in a setstaenrolleepin.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected...
CVE-2020-10213
The CVE-2020-10213 entry documents a command-injection vulnerability affecting D-Link DIR-825 Rev.B devices running 2.10 and TRENDnet TEW-632BRP (1.010B32). The flaw allows remote attackers to execute arbitrary commands through the wps_sta_enrollee_pin parameter in a set_sta_enrollee_pin.cgi POST...
CVE-2020-10214: Out-of-bounds Write
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is a stack-based buffer overflow in the httpd binary. It allows an authenticated user to execute arbitrary code via a POST to ntpsync.cgi with a sufficiently long parameter ntpserver...
CVE-2020-10213: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the wpsstaenrolleepin parameter in a setstaenrolleepin.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected...
CVE-2020-10216: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the date parameter in a systemtime.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected...
CVE-2020-10215: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the dnsqueryname parameter in a dnsquery.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected...
PT-2020-2772
Name of the Vulnerable Software and Affected Versions D-Link DIR-825 version 2.10 TRENDnet TEW-632BRP version 1.010B32 Description An issue exists in the dns query.cgi component of the affected devices, allowing remote attackers to execute arbitrary commands. This is possible via the dns query na...
PT-2020-2773
Name of the Vulnerable Software and Affected Versions D-Link DIR-825 version 2.10 TRENDnet TEW-632BRP version 1.010B32 Description An issue exists that allows remote attackers to execute arbitrary commands via the date parameter in a "system time.cgi" POST request. The vulnerability is due to the...
PT-2020-2771
Name of the Vulnerable Software and Affected Versions D-Link DIR-825 Rev.B version 2.10 TRENDnet TEW-632BRP version 1.010B32 Description An issue exists that allows remote attackers to execute arbitrary commands via the wps sta enrollee pin parameter in a "set sta enrollee pin.cgi" POST request...
PT-2020-2774
Name of the Vulnerable Software and Affected Versions D-Link DIR-825 version 2.10 Description The issue is related to a stack-based buffer overflow in the httpd binary, specifically in the ntp sync.cgi component. This allows an authenticated user to execute arbitrary code via a POST to "ntp...
Buffer Overflow Vulnerability in D-Link DIR-842
The D-Link DIR-842 is a 2.4GHz & 5GHz dual band router. The D-Link DIR-842 suffers from a buffer overflow vulnerability that can be exploited by an attacker to cause a program crash...
ruby: Unintentional directory traversal by poisoned NULL byte in Dir
It was found that the methods from the Dir class did not properly handle strings containing the NULL byte. An attacker, able to inject NULL bytes in a path, could possibly trigger an unspecified behavior of the ruby script...
CVE-2020-9534
fmwlan.c on D-Link DIR-615Jx10 devices has a stack-based buffer overflow via the formWlanSetup webpage parameter when fradiusip1 is malformed...
