1143 matches found
Cross site scripting
A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to inject a JavaScript or HTML payload inside the ACL page. The injected payload would be executed in a user's browser when "/cgi-bin/NewGUI/Acl.asp" is request...
CVE-2018-17990
An issue was discovered on D-Link DSL-3782 devices with firmware 1.01. An OS command injection vulnerability in Acl.asp allows a remote authenticated attacker to execute arbitrary OS commands via the ScrIPaddrEndTXT parameter...
CVE-2018-17990
CVE-2018-17990 affects D-Link DSL-3782 devices running firmware 1.01. The vulnerability is an OS command injection in Acl.asp that allows a remote authenticated attacker to execute arbitrary OS commands via the ScrIPaddrEndTXT parameter. No exploitation details are provided in the connected docum...
CVE-2018-17989
A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to inject a JavaScript or HTML payload inside the ACL page. The injected payload would be executed in a user's browser when "/cgi-bin/NewGUI/Acl.asp" is request...
CVE-2018-17989
CVE-2018-17989 affects D-Link DSL-3782 devices (firmware 1.01). A stored XSS vulnerability exists in the device’s web interface, allowing an authenticated attacker to inject a JavaScript/HTML payload into the ACL page. The payload executes when the browser requests "/cgi-bin/New_GUI/Acl.asp". Acc...
[SECURITY] Fedora 28 Update: php-twig-1.38.2-2.fc28
The flexible, fast, and secure template engine for PHP. Fast: Twig compiles templates down to plain optimized PHP code. The overhead compared to regular PHP code was reduced to the very minimum. Secure: Twig has a sandbox mode to evaluate untrusted template code. This allows Twig to be used as a...
CVE-2019-1003034
A flaw was found in the Jenkins Job DSL plugin. Parsing, compilation, and script instantiations provided by a crafted Groovy script could escape the sandbox allowing users to execute arbitrary code on the Jenkins master. The highest risk from this vulnerability is to data confidentiality and...
CVE-2019-7391
CVE-2019-7391 concerns a CSRF vulnerability in ZyXEL VMG3312-B10B (DSL-491HNU-B1B v2) devices. The PoC shows a cross-site request forgery on the login-page.cgi endpoint, enabling an attacker to submit a login request with admin credentials (e.g., AuthName=admin, AuthPassword=1234) from a maliciou...
CVE-2019-1003034
A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy,...
Security feature bypass
A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy,...
CVE-2019-1003034
A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy,...
CVE-2019-1003034
A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy,...
CVE-2019-1003034
CVE-2019-1003034 is a sandbox bypass in the Jenkins Job DSL Plugin (affected in 1.71 and earlier) that can let attackers with control over Job DSL definitions execute arbitrary code on the Jenkins master JVM. The connected advisories (GHSA-5R74-PGMQ-92MM and Red Hat RHSA-2019:0739) confirm a sand...
PT-2019-2302 · Jenkins · Jenkins Job Dsl Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Job DSL Plugin versions 1.71 and earlier Description: A sandbox bypass issue exists that allows attackers with control over Job DSL definitions to execute arbitrary code on the Jenkins master JVM. The vulnerability is related to error...
Zyxel VMG3312-B10B DSL-491HNU-B1 V2 Cross Site Request Forgery
Exploit Title: Zyxel VMG3312-B10B DSL-491HNU-B1B v2 modem CSRF Exploit Version: Zyxel VMG3312-B10B Tested on : Parrot Os Author: Yusuf Furkan Twitter: h1yusuf CVE: CVE-2019-7391 model name: DSL-491HNU-B1B v2 history.pushState'', '', '/'...
Zyxel VMG3312-B10B DSL-491HNU-B1B v2 Modem - Cross-Site Request Forgery Vulnerability
Exploit for hardware platform in category web applications Exploit Title: Zyxel VMG3312-B10B DSL-491HNU-B1B v2 modem CSRF Exploit Version: Zyxel VMG3312-B10B Tested on : Parrot Os Author: Yusuf Furkan Twitter: h1yusuf CVE: CVE-2019-7391 model name: DSL-491HNU-B1B v2 history.pushState'', '', '/'...
D-Link DSL-2770L Credential Disclosure
Vendor us.dlink.com Product D-Link DSL-2770L version ME1.01, ME1.02, AU1.06 Vulnerability Type admin credentials disclosure Affected Component Web Interface CVE Reference CVE-2018-18007 Security Issue An authenticated user can visit the page atbox.htm, for example, http://victimeip/atbox.htm, and...
CVE-2018-18007
atbox.htm on D-Link DSL-2770L devices allows remote unauthenticated attackers to discover admin credentials...
CVE-2018-18007
The CVE-2018-18007 issue affects D‑Link DSL‑2770L devices (web interface) via atbox.htm, enabling remote unauthenticated disclosure of the admin password. Publicly documented affected software versions include ME_1.01, ME_1.02 and AU_1.06. The root cause is exposure of the admin credential flow i...