3428 matches found
CVE-2018-20057: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter...
CVE-2018-20056: Out-of-bounds Write
An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. There is a stack-based buffer overflow allowing remote attackers to execute arbitrary code without authentication via the goform/formLanguageChange currTime parameter...
Moxa NPort W2x50A Operating System Command Injection Vulnerability
Moxa NPort W2x50A is a Moxa serial communication server for connecting industrial serial devices to a network. An operating system command injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware prior to version 2.2 Build18082311. An attacker can...
CVE-2018-19926
Zenitel Norway IP-StationWeb before 4.2.3.9 allows reflected XSS via the goform/ PATHINFO...
Cross site scripting
Zenitel Norway IP-StationWeb before 4.2.3.9 allows stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zFormsavechanges sipnick parameter. The password of alphaadmin for the admin account may be used for authentication in some cases...
PT-2018-15171
Name of the Vulnerable Software and Affected Versions Zenitel Norway IP-StationWeb versions prior to 4.2.3.9 Description The issue allows for stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zForm save changes sip nick parameter. In some cases, the...
CVE-2018-19660: Improper Neutralization of Special Elements used in an OS Command
An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Build18082311. A specially crafted HTTP POST request to /goform/webSettingProfileSecurity can result in running OS commands as the root user...
PT-2018-15035
Name of the Vulnerable Software and Affected Versions Moxa NPort W2x50A products with firmware prior to 2.2 Build 18082311 Description An exploitable authenticated command-injection issue exists in the web server functionality. A specially crafted HTTP POST request to...
PT-2018-15034
Name of the Vulnerable Software and Affected Versions Moxa NPort W2x50A products with firmware prior to 2.2 Build 18082311 Description An exploitable authenticated command-injection issue exists in the web server functionality. A specially crafted HTTP POST request to "/goform/net WebPingGetValue...
CVE-2018-19927: Improper Neutralization of Input During Web Page Generation
Zenitel Norway IP-StationWeb before 4.2.3.9 allows stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zFormsavechanges sipnick parameter. The password of alphaadmin for the admin account may be used for authentication in some cases...
CVE-2018-19659: Improper Neutralization of Special Elements used in an OS Command
An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Build18082311. A specially crafted HTTP POST request to /goform/netWebPingGetValue can result in running OS commands as the root user. This is...
CVE-2018-19926: Improper Neutralization of Input During Web Page Generation
Zenitel Norway IP-StationWeb before 4.2.3.9 allows reflected XSS via the goform/ PATHINFO...
PT-2018-15170
Name of the Vulnerable Software and Affected Versions Zenitel Norway IP-StationWeb versions prior to 4.2.3.9 Description The issue allows for reflected XSS via the goform/ API endpoint, specifically through the PATH INFO. Recommendations For versions prior to 4.2.3.9, update to version 4.2.3.9 or...
CVE-2018-14558: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44CNAC7, AC9 devices with firmware through V15.03.05.196318CNAC9, and AC10 devices with firmware through V15.03.06.23CNAC10. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a craft...
Design/Logic Flaw
goform/getWlanClientInfo in Orange AirBox Y858FL01.1604 allows remote attackers to discover information about currently connected devices hostnames, IP addresses, MAC addresses, and connection time via the rand parameter...
CVE-2018-18377
goform/setReset on Orange AirBox Y858FL01.1604 devices allows attackers to reset a router to factory settings, which can be used to login using the default admin:admin credentials...
CVE-2018-18377
goform/setReset on Orange AirBox Y858FL01.1604 devices allows attackers to reset a router to factory settings, which can be used to login using the default admin:admin credentials...
CVE-2018-18376
goform/getWlanClientInfo in Orange AirBox Y858FL01.1604 allows remote attackers to discover information about currently connected devices hostnames, IP addresses, MAC addresses, and connection time via the rand parameter...
CVE-2018-18375: Use of Insufficiently Random Values
goform/getProfileList in Orange AirBox Y858FL01.1604 allows attackers to extract APN data name, number, username, and password via the rand parameter...