CVE-2019-10041: Missing Authentication for Critical Function

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use an API URL /goform/form2userconfig.cgi to edit the system account without authentication...

PT-2019-2027

Name of the Vulnerable Software and Affected Versions D-Link DIR-817LW versions A1-1.04 D-Link DIR-816L versions B1-2.06 D-Link DIR-816 versions B1-2.06 D-Link DIR-850L versions A1-1.09 D-Link DIR-868L versions A1-1.10 Description The mydlink feature in D-Link routers has a vulnerability related ...

CVE-2019-10040: Missing Authentication for Critical Function

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use a hidden API URL /goform/SystemCommand to execute a system command without authentication...

The vulnerability of D-Link DIR-600M C1 router’s microprogramming software, related to deficiencies in authentication procedures, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the D-Link DIR-600M C1 router’s microprogramming software is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information by directly...

The vulnerability of D-Link DIR-823G router’s microprogramming software arises from the lack of measures taken to neutralize the special elements used in the operating system command set. This allows a hacker to execute arbitrary operating system commands.

The vulnerability of D-Link DIR-823G router microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary operating system commands...

SUSE SLED12 / SLES12 Security Update : audit (SUSE-SU-2019:0563-1)

This update for audit fixes the following issues : Audit on SUSE Linux Enterprise 12 SP4 was updated to 2.8.1 to bring new features and bugfixes. bsc1125535 FATE326346 Many features were added to auparsenormalize cli option added to auditd and audispd for setting config dir In auditd, restore the...

PT-2019-19749

Name of the Vulnerable Software and Affected Versions OFCMS versions prior to 1.1.3 Description An issue was discovered related to directory traversal. This issue is connected to the getTemplates function in TemplateController.java and can be exploited through the...

D-Link DIR-825 Default Credentials (HTTP)

D-Link DIR-825 devices use an empty default password for the accounts SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

D-Link DIR-825 Information Disclosure Vulnerability

D-Link DIR-825 devices are prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-9123

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. The "user" account has a blank password...

CVE-2019-9124

An issue was discovered on D-Link DIR-878 1.12B01 devices. At the /HNAP1 URI, an attacker can log in with a blank password...

CVE-2019-9125

An issue was discovered on D-Link DIR-878 1.12B01 devices. Because strncpy is misused, there is a stack-based buffer overflow vulnerability that does not require authentication via the HNAPAUTH HTTP header...

CVE-2019-9126

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is an information disclosure vulnerability via requests for the routerinfo.xml document. This will reveal the PIN code, MAC address, routing table, firmware version, update time, QOS information, LAN information, and WLAN...

CVE-2019-9125

An issue was discovered on D-Link DIR-878 1.12B01 devices. Because strncpy is misused, there is a stack-based buffer overflow vulnerability that does not require authentication via the HNAPAUTH HTTP header...

CVE-2019-9126

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is an information disclosure vulnerability via requests for the routerinfo.xml document. This will reveal the PIN code, MAC address, routing table, firmware version, update time, QOS information, LAN information, and WLAN...

CVE-2019-9123

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. The "user" account has a blank password...

CVE-2019-9124

An issue was discovered on D-Link DIR-878 1.12B01 devices. At the /HNAP1 URI, an attacker can log in with a blank password...

Information disclosure

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is an information disclosure vulnerability via requests for the routerinfo.xml document. This will reveal the PIN code, MAC address, routing table, firmware version, update time, QOS information, LAN information, and WLAN...

Default credentials

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. The "user" account has a blank password...

CVE-2019-9122

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the ntpserver parameter in an ntpsync.cgi POST request...