Cross site request forgery (csrf)

On Netis DL4323 devices, CSRF exists via form2logaction.cgi to delete all logs...

Design/Logic Flaw

On Netis DL4323 devices, XSS exists via the urlFQDN parameter to form2url.cgi aka the Keyword field of the URL Blocking Configuration...

Design/Logic Flaw

On Netis DL4323 devices, XSS exists via the form2userconfig.cgi username parameter User Account Configuration...

Netis DL4323 Cross-Site Request Forgery Vulnerability

NETCORE Netis DL4323 is a multi-function modem from China's NETCORE. A cross-site request forgery vulnerability exists in the NETCORE Netis DL4323. The vulnerability arises from a WEB application that does not adequately verify that a request is from a trusted user. An attacker could exploit this...

Netis DL4323 Cross-Site Scripting Vulnerability (CNVD-2020-02549)

NETCORE Netis DL4323 is a multi-function modem from China's NETCORE. A cross-site scripting vulnerability exists in the pingrttv6.html page in the NETCORE Netis DL4323. The vulnerability stems from the WEB application lacking proper validation of client data. An attacker can exploit the...

CVE-2019-20070

CVE-2019-20070 affects Netis DL4323 devices. The vulnerability is a cross-site scripting (XSS) flaw exploitable via the urlFQDN parameter of form2url.cgi (the Keyword field in URL Blocking Configuration). The root cause, as described in connected sources, is insufficient input validation in the d...

CVE-2019-20070

On Netis DL4323 devices, XSS exists via the urlFQDN parameter to form2url.cgi aka the Keyword field of the URL Blocking Configuration...

CVE-2019-20071

CVE-2019-20071 affects Netis DL4323 devices. The issue is a cross-site request forgery (CSRF) vulnerability in the web interface, specifically via the form2logaction.cgi endpoint, which can be abused to delete all logs. The vulnerability is documented across multiple sources (NVD, Red Hat, CVE li...

CVE-2019-20071

On Netis DL4323 devices, CSRF exists via form2logaction.cgi to delete all logs...

CVE-2019-20072

CVE-2019-20072 corresponds to a cross-site scripting vulnerability in Netis DL4323 devices, exploitable via the hostname parameter in form2Ddns.cgi used for Dynamic DNS configuration. The issue stems from insufficient input validation in the web application, enabling execution of arbitrary client...

CVE-2019-20072

On Netis DL4323 devices, XSS exists via the form2Ddns.cgi hostname parameter Dynamic DNS Configuration...

CVE-2019-20073

On Netis DL4323 devices, XSS exists via the form2userconfig.cgi username parameter User Account Configuration...

CVE-2019-20073

CVE-2019-20073 affects Netis DL4323 devices and is described as a Cross-Site Scripting (XSS) vulnerability via the form2userconfig.cgi username parameter in User Account Configuration. The root cause cited is lack of proper validation of client data by the WEB application. The connected records c...

CVE-2019-20074

CVE-2019-20074 affects Netis/DL4323 devices. The vulnerability allows any user role to view sensitive information (e.g., user password, FTP password) via the form2saveConf.cgi page, indicating an information disclosure weakness in the device UI. Reported CVSS metrics from NVD indicate network acc...

CVE-2019-20074

On Netis DL4323 devices, any user role can view sensitive information, such as a user password or the FTP password, via the form2saveConf.cgi page...

CVE-2019-20075

On Netis DL4323 devices, pingrttv6.html has XSS Ping6 Diagnostic...

CVE-2019-20075

Netis DL4323 devices expose a cross-site scripting (XSS) vulnerability in the pingrtt_v6.html page (Ping6 Diagnostic). The issue arises from insufficient input validation in the WEB application, permitting crafted data to execute client-side code. Affected component: pingrtt_v6.html on Netis DL43...

CVE-2019-20076

CVE-2019-20076 concerns the Netis DL4323 modem, where a stored/reflected cross-site scripting (XSS) vulnerability exists in the DynDns settings page due to the username parameter in form2Ddns.cgi. The issue stems from insufficient input validation in the WEB application, enabling an attacker to i...

CVE-2019-20076

On Netis DL4323 devices, XSS exists via the form2Ddns.cgi username parameter DynDns settings of the Dynamic DNS Configuration...

NETCORE Netis DL4323 Cross-Site Scripting Vulnerability

NETCORE Netis DL4323 is a multi-function modem from China's NETCORE. A cross-site scripting vulnerability exists in the NETCORE Netis DL4323, which stems from the lack of proper validation of client data by the WEB application, and can be exploited by an attacker to execute client code...