Indico Insecure Access

A Broken Object Level Authorization BOLA vulnerability in Indico v3.2.9 allows attackers to access sensitive information via sending a crafted POST request to the component /api/principals...

CVE-2025-0473

Vulnerability in the PMB platform that allows an attacker to persist temporary files on the server, affecting versions 4.0.10 and above. This vulnerability exists in the file upload functionality on the ‘/pmb/authorities/import/iimportauthorities’ endpoint. When a file is uploaded via this...

CVE-2025-0473 Incomplete Cleanup vulnerability in PMB platform

Vulnerability in the PMB platform that allows an attacker to persist temporary files on the server, affecting versions 4.0.10 and above. This vulnerability exists in the file upload functionality on the ‘/pmb/authorities/import/iimportauthorities’ endpoint. When a file is uploaded via this...

D-Link DIR-816 security vulnerabilities

The D-Link DIR-816A2 is a router from China's AUO D-Link. The D-Link DIR-816A2 suffers from an Access Control Error vulnerability that stems from improper access control of the formDMZ.cgi component, which can be exploited by an attacker to set up the DMZ service via a specially crafted POST...

CVE-2024-57683: Incorrect Authorization

An access control issue in the component websURLFilterAddDel of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the filter settings of the device via a crafted POST request...

CVE-2024-57684: Incorrect Default Permissions

An access control issue in the component formDMZ.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the DMZ service of the device via a crafted POST request...

CVE-2024-57680: Incorrect Authorization

An access control issue in the component form2PortriggerRule.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the port trigger of the device via a crafted POST request...

CVE-2024-57682: Missing Authorization

An information disclosure vulnerability in the component dstatus.asp of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to access sensitive information via a crafted POST request...

CVE-2024-57678: Incorrect Authorization

An access control issue in the component form2WlAc.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G mac access control list of the device via a crafted POST request...

CVE-2024-57681: Incorrect Authorization

An access control issue in the component form2alg.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the agl service of the device via a crafted POST request...

CVE-2024-50633: Insertion of Sensitive Information Into Sent Data

A Broken Object Level Authorization BOLA vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals. NOTE: this is disputed by the Supplier because the product intentionally lets all users retrieve certain...

CVE-2024-57676: Incorrect Authorization

An access control issue in the component form2WlanBasicSetup.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G wlan service of the device via a crafted POST request...

CVE-2024-57677: Incorrect Authorization

An access control issue in the component form2Wan.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the wan service of the device via a crafted POST request...

CVE-2024-57679: Incorrect Authorization

An access control issue in the component form2RepeaterSetup.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G repeater service of the device via a crafted POST request...

CVE-2024-57682

An information disclosure vulnerability in the component dstatus.asp of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to access sensitive information via a crafted POST request...

CVE-2024-57681

An access control issue in the component form2alg.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the agl service of the device via a crafted POST request...

CVE-2024-57682

The D-Link DIR-816A2 router (specifically firmware 816A2_FWv1.10CNB05_R1B011D88210 ) is susceptible to an information disclosure vulnerability in the d_status.asp component. This flaw arises from insufficient protection of sensitive information , which allows an unauthenticated attacker to obtain...

CVE-2024-57681

The D-Link DIR-816A2 router, specifically the 816A2_FWv1.10CNB05_R1B011D88210 firmware, contains an access control issue within the form2alg.cgi component. This vulnerability allows unauthenticated attackers to set the agl service of the device by sending a specially crafted HTTP POST request . A...

CVE-2024-57679

The D-Link DIR-816A2 router, specifically running firmware 816A2_FWv1.10CNB05_R1B011D88210 , contains an access control deficiency in the form2RepeaterSetup.cgi component. This vulnerability allows unauthenticated attackers to set the 2.4G and 5G repeater services via a crafted HTTP POST request ...

CVE-2024-57680

The D-Link DIR-816A2 router is vulnerable to an access control error within the form2PortriggerRule.cgi component (firmware version 816A2_FWv1.10CNB05_R1B011D88210 ). An unauthenticated attacker can send a crafted POST request to manipulate the device's port trigger settings. Additional reports i...