CVE-2018-19612: Unrestricted Upload of File with Dangerous Type

The /uploadfile? functionality in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allows remote users to upload malicious file types and execute ASP code...

PT-2019-9877

Name of the Vulnerable Software and Affected Versions Westermo DR-250 versions Pre-5162 Westermo DR-260 versions Pre-5162 Description The issue allows for Cross-Site Request Forgery CSRF attacks. Recommendations For Westermo DR-250 version Pre-5162, update to a version post-5162 to resolve the...

CVE-2018-19613: Cross-Site Request Forgery (CSRF)

Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allow CSRF...

Westermo DR-260, DR-250 and MR-260 Cross-Site Request Forgery Vulnerabilities

Westermo DR-260 and others are products of the Swedish company Westermo.Westermo DR-260 is a DSL router.Westermo DR-250 is a DSL router.Westermo MR-260 is a 3G multimedia router.Westermo MR-260 is a 3G multimedia router.Westermo MR-260 is a 3G multimedia router.Westermo MR-260 is a 3G multimedia...

Cross site scripting

XSS exists in the /cmdexec/cmdexe?cmd= function in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers...

CVE-2018-19614

XSS exists in the /cmdexec/cmdexe?cmd= function in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers...

CVE-2018-19614

XSS exists in the /cmdexec/cmdexe?cmd= function in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers...

CVE-2018-19614

Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers are affected by a Cross‑Site Scripting (XSS) vulnerability in the web UI path /cmdexec/cmdexe?cmd=, arising from insufficient validation of client data in the web application. The issue can allow an attacker to inject and execute client‑side co...

PT-2019-9878

Name of the Vulnerable Software and Affected Versions Westermo DR-250 versions Pre-5162 Westermo DR-260 versions Pre-5162 Description A security issue exists in the /cmdexec/cmdexe?cmd= function, allowing for potential exploitation. Recommendations For Westermo DR-250 version Pre-5162, update to ...

CVE-2018-19614: Improper Neutralization of Input During Web Page Generation

XSS exists in the /cmdexec/cmdexe?cmd= function in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers...

Rockwell Automation 1771-DR General Purpose Analog I/O

Binary data 753452.prm...

Dr.Web Enterprise Security Suite Access Disclosure

The vulnerability of the Agent component in the Dr.Web anti-virus protection software, Dr.Web Enterprise Security Suite, is related to deficiencies in access control to named communication channels. Exploiting this vulnerability can allow attackers to gain access to information about user...

Dr.Web Enterprise Security Suite Protocol Error File Replacement

The vulnerability of the Dr.Web Enterprise Security Suite antivirus protection lies in errors in the proprietary protocol used to connect the antivirus components to the server. Exploiting this vulnerability allows a malicious actor to create a fake “Dr.Web Enterprise Security Suite” server withi...

Security Management Center XSS

The vulnerability of the “Security Management Center” component of the Dr.Web Enterprise Security Suite exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTML code into the user’s browser by placin...

Dr.Web Agent DoS

The vulnerability of the Agent component in the Dr.Web anti-virus security tool, Dr.Web Enterprise Security Suite, exists due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to cause failures in named communication channels with user applications by...

dwprot.sys Driver Failure

The vulnerability of the dwprot.sys driver in the Dr.Web Enterprise Security Suite antivirus software is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure using specially crafted IOCTLs...

Dr.Web Enterprise Security Suite Code Execution

The vulnerability of the Dr.Web Enterprise Security Suite antivirus protection lies in errors in processing the relative path to the catalog during the export of repository content into an archive. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the server by...

Security Management Center XSS

The vulnerability of the “Security Management Center” component of the Dr.Web Enterprise Security Suite exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTML code into the user’s browser by placin...

Dr.Web Enterprise Security Suite File Restriction Lua Execution

The vulnerability of the Dr.Web Enterprise Security Suite antivirus protection lies in the absence of restrictions on writing, reading, and creating files within the server’s directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary Lua scripts without the need for th...

Counter-Strike 1.6 game client 0-day exploited to spread Belonard trojan

By Waqas Dr. Web’s cybersecurity researchers have identified an attacker is trying to exploit zero-day vulnerabilities in Counter-Strike 1.6 game specifically to distribute Belonard Trojan. Reportedly, about 39% of all the active servers of the game on Steam have been manipulated and compromised ...