CVE-2018-10823

CVE-2018-10823 affects several D-Link router models (DWR-116 up to 1.06, DWR-512 up to 2.02, DWR-712 up to 2.02, DWR-912 up to 2.02, DWR-921 up to 2.02, DWR-111 up to 1.01). An authenticated attacker can inject shell commands via the chkisg.htm Sip parameter, leading to arbitrary code execution a...

CVE-2018-10823: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. An authenticated attacker may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip...

CVE-2018-10823

An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. An authenticated attacker may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip...

CVE-2018-10822: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the web interface on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices allows remote attackers to read arbitrary...

CVE-2018-10824: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. The administrative password is stored in plaintext in the /tmp/csman/0...

D-Link Router Password Plaintext Storage Vulnerability

The DWR-116, DIR-140, and DIR-640 are all D-Link router products. A password plaintext storage vulnerability exists in several series of D-Link routers, which stems from the administrative password being stored in plaintext in the /tmp/XXX /0 file. An attacker with directory traversal or LFI can...

PT-2018-1746 · D Link · Dwr-116 +7

Name of the Vulnerable Software and Affected Versions: D-Link DWR-116 versions 1.06 and earlier D-Link DIR-140L versions 1.02 and earlier D-Link DIR-640L versions 1.02 and earlier D-Link DWR-512 versions 2.02 and earlier D-Link DWR-712 versions 2.02 and earlier D-Link DWR-912 versions 2.02 and...

PT-2018-1747 · D Link · Dwr-921 +5

Name of the Vulnerable Software and Affected Versions: D-Link DWR-116 versions 1.06 and earlier D-Link DWR-512 versions 2.02 and earlier D-Link DWR-712 versions 2.02 and earlier D-Link DWR-912 versions 2.02 and earlier D-Link DWR-921 versions 2.02 and earlier D-Link DWR-111 versions 1.01 and...

CVE-2018-14691: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Subsonic 6.1.1. The music tags feature is affected by three stored cross-site scripting vulnerabilities in the c0-param2, c0-param3, and c0-param4 parameters to dwr/call/plaincall/tagService.setTags.dwr that could be used to steal session information of a victim...

SUSE-SU-2018:1743-1 Security update for dwr

This update for dwr fixes the following issues: Security issue fixed: - CVE-2014-5326: Fix cross-site scripting XSS vulnerability bsc1085650...

SUSE-SU-2018:1745-1 Security update for dwr

This update for dwr fixes the following issues: Security issue fixed: - CVE-2014-5326: Fix cross-site scripting XSS vulnerability bsc1085650...

Security Bulletin: Rational Change is affected by vulnerabilities (CVE-2014-5325 and CVE-2014-5326) in Java Open Source Direct Web Remoting library.

Summary The DOMConverter, JDOMConverter, DOM4JConverter, and XOMConverter functions in Direct Web Remoting DWR through 2.0.10 and 3.x through 3.0.RC2 allow remote attackers to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity reference,...

D-Link DWR-933 Cross-Site Scripting Vulnerability

The D-Link DWR-933 is a portable wireless router from AUO D-Link. A cross-site scripting vulnerability exists in the D-Link DWR-933 version 1.00WWB17. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

Cross site scripting

XSS exists on D-Link DWR-933 1.00WWB17 devices via cgi-bin/gui.cgi...

CVE-2017-16765

XSS exists on D-Link DWR-933 1.00WWB17 devices via cgi-bin/gui.cgi...

CVE-2017-16765

XSS exists on D-Link DWR-933 1.00WWB17 devices via cgi-bin/gui.cgi...

CVE-2017-16765

XSS exists on D-Link DWR-933 1.00WWB17 devices via cgi-bin/gui.cgi...

CVE-2017-16765

Affected product: D-Link DWR-933 portable wireless router (firmware version 1.00(WW)B17). Vulnerable component: the web management interface CGI, specifically cgi-bin/gui.cgi. Issue: cross-site scripting (XSS) vulnerability described as XSS exists on the DWR-933 via the GUI CGI. Root cause: not e...

CVE-2017-16765: Improper Neutralization of Input During Web Page Generation

XSS exists on D-Link DWR-933 1.00WWB17 devices via cgi-bin/gui.cgi...

PT-2017-14547

Name of the Vulnerable Software and Affected Versions D-Link DWR-933 version 1.00WWB17 Description A cross-site scripting XSS issue exists, allowing potential exploitation via the "cgi-bin/gui.cgi" API endpoint. Recommendations For D-Link DWR-933 version 1.00WWB17, consider restricting access to...