3669 matches found
CVE-2021-31757: Out-of-bounds Write
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104CN. A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request...
CVE-2021-31755: Out-of-bounds Write
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request...
CVE-2021-27114
An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/addassignment route, a very long text entry for the"'sip" and "smac" fields could lead to a Stack-Based Buffer Overflow and overwrite the return address...
CVE-2021-27114
An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/addassignment route, a very long text entry for the"'sip" and "smac" fields could lead to a Stack-Based Buffer Overflow and overwrite the return address...
CVE-2021-27113
An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/addRouting route. This could lead to Command Injection via Shell Metacharacters...
Stack overflow
An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/addassignment route, a very long text entry for the"'sip" and "smac" fields could lead to a Stack-Based Buffer Overflow and overwrite the return address...
CVE-2021-27113
An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/addRouting route. This could lead to Command Injection via Shell Metacharacters...
PT-2021-17251
Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.10 B05 Description: An issue was discovered that could lead to a Stack-Based Buffer Overflow. This occurs when a very long text entry is made for the s ip and s mac fields within the handler function of the...
PT-2021-17250
Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.10 B05 Description: An issue was discovered where an HTTP request parameter is used in command string construction within the handler function of the "/goform/addRouting" route. This could lead to command injection...
CVE-2021-27114: Out-of-bounds Write
An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/addassignment route, a very long text entry for the"'sip" and "smac" fields could lead to a Stack-Based Buffer Overflow and overwrite the return address...
CVE-2021-27113: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/addRouting route. This could lead to Command Injection via Shell Metacharacters...
VulnCheck KEV: CVE-2018-14558
Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request...
PT-2021-17144
Name of the Vulnerable Software and Affected Versions: D-link DIR-816 A2 version 1.10 Description: The issue is related to a remote code injection vulnerability. It involves the use of an HTTP request parameter in command string construction within the handler function of the "/goform/dir...
CVE-2020-19641: Undefined Security Weakness
An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. Authenticated attackers with the "Operator" Privilege can gain admin privileges via a crafted request to '/goform/formUserMng'...
PT-2021-10384
Name of the Vulnerable Software and Affected Versions: INSMA Wifi Mini Spy 1080P HD Security IP Camera version 1.9.7 B Description: The issue is related to a Cross Site Scripting XSS vulnerability. It affects the FTP settings page, specifically all fields, which then lead to the...
PT-2021-10382
Name of the Vulnerable Software and Affected Versions: INSMA Wifi Mini Spy 1080P HD Security IP Camera version 1.9.7 B Description: An issue allows authenticated attackers with the "Operator" Privilege to gain admin privileges via a crafted request to '/goform/formUserMng'. Recommendations: For...
CVE-2020-19643: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B via all fields in the FTP settings page to the "goform/formSetFtpCfg" settings page...
CVE-2021-26810: Improper Neutralization of Special Elements used in an OS Command
D-link DIR-816 A2 v1.10 is affected by a remote code injection vulnerability. An HTTP request parameter can be used in command string construction in the handler function of the /goform/dirsetWanWifi, which can lead to command injection via shell metacharacters in the statuscheckpppoeuser paramet...