GHSA-79JV-5226-783F OpenRefine has a reflected cross-site scripting vulnerability (XSS) from POST request in ExportRowsCommand

Summary The export-rows command can be used in such a way that it reflects part of the request verbatim, with a Content-Type header also taken from the request. An attacker could lead a user to a malicious page that submits a form POST that contains embedded JavaScript code. This code would then ...

OpenRefine has a reflected cross-site scripting vulnerability (XSS) from POST request in ExportRowsCommand

Summary The export-rows command can be used in such a way that it reflects part of the request verbatim, with a Content-Type header also taken from the request. An attacker could lead a user to a malicious page that submits a form POST that contains embedded JavaScript code. This code would then ...

The vulnerability of the SetVLANSettings() function in D-Link DIR-878 and DIR-882 router microprogramming software allows a hacker to execute arbitrary operating system commands.

The vulnerability of the SetVLANSettings function in D-Link DIR-878 and DIR-882 router microprogramming systems exists because measures are not taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitra...

The vulnerability of the PopupSiteSurveyRpm component (/userRpm/popupSiteSurveyRpm.htm) in the TP-Link TL-WR740N router software allows a hacker to execute arbitrary code.

The vulnerability of TP-Link TL-WR740N router’s microprogramming software is related to buffer overflow in the stack. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially crafted POST request...

The vulnerability of the SetMACFilters2() function in the prog.cgi script of D-Link DIR-878 and DIR-882 router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the SetMACFilters2 function in the prog.cgi script of D-Link DIR-878 and DIR-882 routers exists due to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrar...

The vulnerability of the SetVLANSettings() function in the prog.cgi script of D-Link DIR-878 and DIR-882 routers allows a hacker to execute arbitrary commands.

The vulnerability of the SetVLANSettings function in the prog.cgi script of D-Link DIR-878 and DIR-882 routers exists due to the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary...

The vulnerability of the SetWLanRadioSecurity() function in the prog.cgi script of D-Link DIR-878 and DIR-882 router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the SetWLanRadioSecurity function in the prog.cg scenario of D-Link DIR-878 and DIR-882 router microprogramming software exists due to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a...

The vulnerability of the SetVLANSettings() function in the prog.cgi script of D-Link DIR-878 and DIR-882 routers allows a hacker to execute arbitrary commands.

The vulnerability of the SetVLANSettings function in the prog.cgi script of D-Link DIR-878 and DIR-882 routers exists due to the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary...

D-Link DIR-878 and D-Link DIR-882 Command Injection Vulnerability (CNVD-2024-41693)

The D-Link DIR-878 is a wireless router.The D-Link DIR-882 is a dual-band wireless router. A command injection vulnerability exists in the D-Link DIR-878 and D-Link DIR-882, which can be exploited by an attacker to execute arbitrary operating system commands via a constructed POST request...

D-Link DIR-878 and D-Link DIR-882 Command Injection Vulnerability (CNVD-2024-41701)

The D-Link DIR-878 is a wireless router.The D-Link DIR-882 is a dual-band wireless router. A command injection vulnerability exists in the D-Link DIR-878 and D-Link DIR-882, which can be exploited by an attacker to execute arbitrary operating system commands via a constructed POST request...

D-Link DIR-878 and D-Link DIR-882 Command Injection Vulnerability (CNVD-2024-41694)

The D-Link DIR-878 is a wireless router.The D-Link DIR-882 is a dual-band wireless router. A command injection vulnerability exists in the D-Link DIR-878 and D-Link DIR-882, which can be exploited by an attacker to execute arbitrary operating system commands via a constructed POST request...

The vulnerability of TP-Link WR941ND router’s microprogramming software, related to the execution of operations outside the buffer in memory, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of TP-Link WR941ND router’s microprogramming software lies in the fact that the operation exceeds the buffer limits in memory when processing the page /userRpm/popupSiteSurveyRpm.htm with the parameter ssid. Exploiting this vulnerability allows a remote attacker to compromise th...

The vulnerability of the formSetWizardSelectMode (/goform/formSetWizardSelectMode) function in the D-Link DIR-619L router’s microprogramming software allows a hacker to induce a service failure.

The vulnerability of the formSetWizardSelectMode /goform/formSetWizardSelectMode function in the D-Link DIR-619L router’s microprogramming system is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to cause a...

The vulnerability of the formSetPortTr function (/goform/formSetPortTr) in D-Link DIR-619L router software allows a hacker to trigger a service failure.

The vulnerability of the formSetPortTr function /goform/formSetPortTr in D-Link DIR-619L router microprogramming software is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to cause a service failure by sending a...

The vulnerability of the formVirtualServ function (/goform/formVirtualServ) in D-Link DIR-619L router software allows a hacker to trigger a service failure.

The vulnerability of the formVirtualServ function /goform/formVirtualServ in D-Link DIR-619L router microprogramming software is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to cause a service failure by sendi...

The vulnerability of the formSetPassword function (/goform/formSetPassword) in D-Link DIR-619L router software allows a hacker to trigger a service failure.

The vulnerability of the formSetPassword function /goform/formSetPassword in D-Link DIR-619L router microprogramming software lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to cause a service failure by sending a...

The vulnerability of the formEasySetTimezone function (/goform/formEasySetTimezone) in the D-Link DIR-619L router software allows a hacker to trigger a service failure.

The vulnerability of the formEasySetTimezone function /goform/formEasySetTimezone of the D-Link DIR-619L router’s software lies in the copying of buffer without checking the size of the input data during the processing of the curTime parameter. Exploiting this vulnerability could allow an attacke...

CVE-2024-48630

D-Link DIR882FW130B06 and DIR878 DIR878FW130B08 were discovered to contain a command injection vulnerability via the MacAddress parameter in the SetMACFilters2 function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request...

CVE-2024-48631

D-Link DIR882FW130B06 and DIR878 DIR878FW130B08 were discovered to contain a command injection vulnerability via the SSID parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request...

CVE-2024-48632

D-Link DIR882FW130B06 and DIR878 DIR878FW130B08 were discovered to contain multiple command injection vulnerabilities via the LocalIPAddress, TCPPorts, and UDPPorts parameters in the SetPortForwardingSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a...