CVE-2019-6275

Command injection vulnerability in firmwarecgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code...

CVE-2019-6273

downloadfile in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to download arbitrary files...

CVE-2019-6274

Directory traversal vulnerability in storagecgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to have unspecified impact via directory traversal sequences...

Code injection

downloadfile in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to download arbitrary files...

Directory traversal

Directory traversal vulnerability in storagecgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to have unspecified impact via directory traversal sequences...

Command injection

Command injection vulnerability in firmwarecgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code...

Command injection

Command injection vulnerability in logincgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code...

CVE-2019-6275

GL-AR300M-Lite (firmware 2.27) is affected by CVE-2019-6275 due to a command injection vulnerability in the firmware_cgi component, enabling arbitrary code execution. Affected product: GL.iNet GL-AR300M-Lite; vulnerability source: CVE entry and corroborating exploit listings. Technical details ac...

CVE-2019-6275

Command injection vulnerability in firmwarecgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code...

CVE-2019-6274

Directory traversal vulnerability in storagecgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to have unspecified impact via directory traversal sequences...

CVE-2019-6274

CVE-2019-6274 affects GL.iNet GL-AR300M-Lite devices with firmware 2.27, due to a directory traversal vulnerability in storage_cgi. The issue allows remote attackers to influence the system via directory traversal sequences (reported impact as unspecified in the CVE description), with exploit ref...

CVE-2019-6273

downloadfile in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to download arbitrary files...

CVE-2019-6273

CVE-2019-6273 affects GL.iNet GL-AR300M-Lite devices running firmware 2.27. Affected component: download_file handling in the device’s UI/ CGI flow. Root cause and exact code path are not detailed in the provided documents, but multiple sources describe an arbitrary file download vulnerability, w...

CVE-2019-6272

GL-AR300M-Lite devices (firmware 2.27) are affected by CVE-2019-6272 due to a vulnerability in login_cgi that enables authenticated command injection, potentially allowing arbitrary code execution. The issue is triggered after an attacker with prior login access sends crafted requests to login_cg...

CVE-2019-6272

Command injection vulnerability in logincgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code...

Design/Logic Flaw

In IoTivity through 1.3.1, the CoAP server interface can be used for Distributed Denial of Service attacks using source IP address spoofing and UDP-based traffic amplification. The reflected traffic is 6 times bigger than spoofed requests. This occurs because the construction of a "4.01...

WordPress Abandoned Cart Lite plugin <= 5.1.3 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability found in WordPress Abandoned Cart Lite plugin versions = 5.1.3. Solution Update the WordPress Abandoned Cart Lite plugin to the latest available version at least 5.2.0...

VulnCheck KEV: CVE-2019-25152

The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping...

The vulnerability of the Vijeo Designer Lite software lies in its insufficient control over memory boundaries, allowing a malicious actor to cause system failures in the application.

The vulnerability of the Vijeo Designer Lite software is related to insufficient control over memory boundaries during operation. Exploiting this vulnerability can allow an attacker to cause a malfunction of the application upon opening a DOP project file...

X (Formerly Twitter): Twitter lite(Android): Vulnerable to local file steal, Javascript injection, Open redirect

Summary: com.twitter.android.lite.TwitterLiteActivity is set to exported and doesn't validate data pass to intent due to which this activity vulnerable to steal users local files, javascript injection and open redirect. Description: com.twitter.android.lite.TwitterLiteActivity is set to exported ...