7019 matches found
CVE-2017-15654
CVE-2017-15654 affects AsusWRT's HTTPd in Asus routers (versions up to 3.0.0.4.380.7743). The vulnerability stems from highly predictable session tokens generated by reseeding the RNG with time(), enabling an attacker to infer or guess a valid administrator session and gain router admin access. C...
CVE-2017-15653
CVE-2017-15653 concerns AsusWRT routers with the HTTPd web interface. It describes an improper administrator IP validation after login, allowing an unauthorized user who has a valid administrator session token to perform any action by sending a crafted User-Agent string. Affected versions are all...
CVE-2017-15655: Improper Restriction of Operations within the Bounds of a Memory Buffer
Multiple buffer overflow vulnerabilities exist in the HTTPd server in Asus asuswrt version =3.0.0.4.376.X. All have been fixed in version 3.0.0.4.378, but this vulnerability was not previously disclosed. Some end-of-life routers have this version as the newest and thus are vulnerable at this time...
PT-2018-5961
Name of the Vulnerable Software and Affected Versions: Asus asuswrt versions prior to 3.0.0.4.380.7743 Description: The issue concerns highly predictable session tokens in the HTTPd server, which can be exploited to gain administrative access to the router. Recommendations: For versions prior to...
CVE-2017-15656: Insufficiently Protected Credentials
Password are stored in plaintext in nvram in the HTTPd server in all current versions = 3.0.0.4.380.7743 of Asus asuswrt...
CVE-2017-15654: Use of Insufficiently Random Values
Highly predictable session tokens in the HTTPd server in all current versions = 3.0.0.4.380.7743 of Asus asuswrt allow gaining administrative router access...
CVE-2017-15653: Insufficient Session Expiration
Improper administrator IP validation after his login in the HTTPd server in all current versions = 3.0.0.4.380.7743 of Asus asuswrt allows an unauthorized user to execute any action knowing administrator session token by using a specific User-Agent string...
PT-2018-5960
Name of the Vulnerable Software and Affected Versions: Asus asuswrt versions = 3.0.0.4.380.7743 Description: The issue is related to improper administrator IP validation after login in the HTTPd server, allowing an unauthorized user to execute actions knowing the administrator session token by...
PT-2018-5963
Name of the Vulnerable Software and Affected Versions: Asus asuswrt versions prior to 3.0.0.4.380.7743 Description: The HTTPd server in Asus asuswrt stores passwords in plaintext in nvram. Recommendations: For versions prior to 3.0.0.4.380.7743, update to a version that fixes the issue of storing...
PT-2018-5962
Name of the Vulnerable Software and Affected Versions: Asus asuswrt versions prior to 3.0.0.4.378 Description: The issue is related to multiple buffer overflow vulnerabilities in the HTTPd server. These vulnerabilities can be exploited to achieve remote code execution RCE with administrator right...
GoAhead Web Server 2.5 < 3.6.5 - HTTPd LD_PRELOAD Arbitrary Module Load Exploit
This Metasploit module triggers an arbitrary shared library load vulnerability in GoAhead web server versions between 2.5 and that have the CGI module enabled. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...
GoAhead Web Server 2.5 < 3.6.5 - HTTPd 'LD_PRELOAD' Arbitrary Module Load (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'GoAhead Web Server LDPRELOAD Arbitrary Module Load', 'Description' = %q This module triggers an arbitrary shared library load vulnerability in...
Apache Httpd < 2.4.33 : Possible out of bound read in mod_cache_socache
A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.33 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of modcachesocache...
Apache Httpd < 2.4.33 : Possible write of after free on HTTP/2 stream shutdown
When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.33 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerabilty hard to trigger in usual configurations, the reporter...
CVE-2018-6000: Missing Authorization
An issue was discovered in AsusWRT before 3.0.0.4.38410007. The dovpnuploadpost function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon or enable infosvr command mode,...
CVE-2018-5999: Undefined Security Weakness
An issue was discovered in AsusWRT before 3.0.0.4.38410007. In the handlerequest function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails...
PT-2018-17282
Name of the Vulnerable Software and Affected Versions: AsusWRT versions prior to 3.0.0.4.384 10007 Description: An issue was discovered where the handle request function in router/httpd/httpd.c continues processing of POST requests even if authentication fails. Recommendations: For versions prior...
CVE-2017-15111
keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link...
