VulnCheck KEV: CVE-2018-13317

Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password for the admin user by making a GET request for password.htm...

CVE-2018-13313 Admin Password returned in password.htm

In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript...

PT-2020-8530

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002RU version 1.0.8 Description: The issue concerns a page, password.htm, that allows users to change their account name and password. This page contains JavaScript that confirms the user's current password before allowing changes...

CVE-2018-13313: Insecure Storage of Sensitive Information

In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript...

TOTOLINK A3002RU cross-site scripting vulnerability (CNVD-2018-24106)

TOTOLINK A3002RU is a wireless router product from Gion Electronics TOTOLINK. A cross-site scripting vulnerability exists in the password.htm page in TOTOLINK A3002RU version 1.0.8. A remote attacker can exploit this vulnerability by setting a user's password to execute arbitrary JavaScript code...

TOTOLINK A3002RU Password Disclosure Vulnerability

The TOTOLINK A3002RU is an AC1200 wireless dual-band Gigabit router. A password disclosure vulnerability exists in password.htm in TOTOLINK A3002RU version 1.0.8, which can be exploited to obtain an administrator user's password in plaintext by sending a GET request to password.htm...

Cross site scripting

Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password...

CVE-2018-13310

Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username...

CVE-2018-13310

Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username...

CVE-2018-13317

Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password for the admin user by making a GET request for password.htm...

CVE-2018-13309

Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password...

CVE-2018-13310

Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username...

CVE-2018-13317

Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password for the admin user by making a GET request for password.htm...

Cross site scripting

Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username...

CVE-2018-13310

TOTOLINK A3002RU (firmware version 1.0.8) is affected by CVE-2018-13310. The vulnerability is a cross-site scripting flaw in the password.htm page that allows an attacker to cause arbitrary JavaScript execution via the user’s username. Multiple connected sources (NVD entry and CNVD-2018-24105) co...

CVE-2018-13309

CVE-2018-13309 affects the TOTOLINK A3002RU router (version 1.0.8). A cross-site scripting flaw exists in the password.htm page, allowing a remote attacker to cause arbitrary JavaScript execution via the user’s password. Public documents (CNVD-2018-24106 and NVD entry) confirm the affected produc...

CVE-2018-13310: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username...

CVE-2018-13317: Improper Neutralization of Input During Web Page Generation

Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password for the admin user by making a GET request for password.htm...

PT-2018-11740

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8 Description The issue allows attackers to obtain the plaintext password for the admin user by making a GET request for "password.htm". This affects the security of the device as it potentially exposes the admin...

CVE-2018-13309: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password...