1123 matches found
TP-Link TL-WR840N / TL-WR841N Authentication Bypass
Title: TP-Link Multiple RouterTL-WR840N and TL-WR841N Unauthenticated Router Access Vulnerability Author: BlackFog Team Date: 27 May 2018 Website: SecureLayer7.net Contact: [email protected] Version: 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n Hardware: TL-WR841N v13 00000013 Version : Firmwar...
TP-Link TL-WR840N/TL-WR841N - Authenticaton Bypass
Title: TP-Link Multiple RouterTL-WR840N and TL-WR841N Unauthenticated Router Access Vulnerability Author: BlackFog Team Date: 27 May 2018 Website: SecureLayer7.net Contact: [email protected] Version: 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n Hardware: TL-WR841N v13 00000013 Version : Firmwar...
WordPress WP Statistics plugin cross-site scripting vulnerability (CNVD-2018-04482)
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL server set up a personal blog site.WP Statistics is one of the website statistical analysis plugin. A cross-site scripting vulnerability exists in...
Ed: Oauth flow on the comments widget login can lead to the access code leakage
Description Hello. Here is a keyword: frog I discovered an little Oauth flow in the comments widget authentication process using redirecturi manipulations. The widget located on the all blogposts, which have URL https://edoverflow.com/2017/post-title/ Upon authentication, it appeared that code...
Cross site request forgery (csrf)
D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of the HTTP Referer header...
CVE-2017-7851
D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of the HTTP Referer header...
CVE-2017-7851
D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of the HTTP Referer header...
PT-2017-17953 · D Link · Dcs-936L
Name of the Vulnerable Software and Affected Versions: D-Link DCS-936L versions prior to 1.05.07 Description: The issue is related to an inadequate CSRF protection mechanism. It requires the device's IP address to be a substring of the HTTP Referer header. Recommendations: For versions prior to...
CVE-2017-7851: Cross-Site Request Forgery (CSRF)
D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of the HTTP Referer header...
The vulnerability of the login_mgrc.i program component in the DNR-320L, DNS-320LW, DNR-322L, DNR-326, and DNS-327L routers’ software allows a hacker to execute arbitrary code.
The vulnerability of the loginmgrc.cgi component of the DNR-320L, DNS-320LW, DNR-322L, DNR-326, and DNS-327L router microprogramming systems arises due to buffer overflows in the stack. Exploitation of this vulnerability allows an attacker to execute arbitrary code by creating specially crafted...
Avito: CSS injection in avito.ru via IE11
Hi Team Security @avito I discovered CSS Injection on avito.ru in form search via IE11 Description CSS injection vulnerabilities arise when an application imports a style sheet from a user-supplied URL, or embeds user input in CSS blocks without adequate escaping. They are closely related to...
CVE-2016-6806: Cross-Site Request Forgery (CSRF)
Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided...
CVE-2015-7391
Multiple cross-site scripting XSS vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the 1 selectedenddate or 2 selectedstartdate parameter to lib/results/tcCreatedPerUserOnTestProject.php; the 3 containerType parameter to...
CVE-2015-7391
Multiple cross-site scripting XSS vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the 1 selectedenddate or 2 selectedstartdate parameter to lib/results/tcCreatedPerUserOnTestProject.php; the 3 containerType parameter to...
Student Result or Employee Database <= 1.6.3 - Auth Bypass
The Student Result or Employee Database WordPress plugin was affected by an Auth Bypass security vulnerability. curl -i -s -k -X 'POST' -H 'User-Agent: Mozilla/5.0' -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H 'X-Requested-With: XMLHttpRequest' -H 'Referer:...
vBulletin VBSEO 'visitormessage.php' Remote Code Injection Vulnerability
vBulletin is the United States Internet Brands and vBulletin Solutions, Inc. jointly developed an open source commercial Web forum program. vBulletin VBSEO module is one of the SEO management module . A security vulnerability exists in the functionsvbseohook.php file in the vBulletin VBSEO module...
CVE-2014-9463: Improper Control of Generation of Code
functionsvbseohook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer header to visitormessage.php...
CVE-2017-14194
The out function in controllers/member/Login.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer...