Cross site scripting

Cross-site scripting XSS vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0RC3 build r6594 allows remote attackers to inject arbitrary web script or HTML via vectors involving home.asp...

CVE-2017-11649

Cross-site request forgery CSRF vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0RC3 build r6594 allows remote attackers to hijack the authentication of unspecified users for requests that enable SNMP on the remote device via vectors involving goform/setSnmp...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0RC3 build r6594 allows remote attackers to hijack the authentication of unspecified users for requests that enable SNMP on the remote device via vectors involving goform/setSnmp...

CVE-2017-11649

Cross-site request forgery CSRF vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0RC3 build r6594 allows remote attackers to hijack the authentication of unspecified users for requests that enable SNMP on the remote device via vectors involving goform/setSnmp...

CVE-2017-11650

Cross-site scripting XSS vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0RC3 build r6594 allows remote attackers to inject arbitrary web script or HTML via vectors involving home.asp...

DrayTek Vigor AP910C Cross-Site Scripting Vulnerability

DrayTek Vigor AP910C devices is a wireless router product with firewall function from DrayTek. A cross-site request forgery vulnerability exists in DrayTek Vigor AP910C devices using firmware version 1.2.0RC3 build r6594. A remote attacker can exploit this vulnerability to inject arbitrary web...

DrayTek Vigor AP910C Cross-Site Request Forgery Vulnerability

DrayTek Vigor AP910C devices is a wireless router product with firewall function from DrayTek. A cross-site request forgery vulnerability exists in DrayTek Vigor AP910C devices using firmware version 1.2.0RC3 build r6594. A remote attacker could exploit the vulnerability to open SNMP on a remote...

CVE-2017-11650

CVE-2017-11650 affects DrayTek Vigor AP910C devices running firmware 1.2.0_RC3 build r6594. The described vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via vectors involving home.asp. Exploitation details beyond the vulnerab...

CVE-2017-11650

Cross-site scripting XSS vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0RC3 build r6594 allows remote attackers to inject arbitrary web script or HTML via vectors involving home.asp...

CVE-2017-11649

Cross-site request forgery CSRF vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0RC3 build r6594 allows remote attackers to hijack the authentication of unspecified users for requests that enable SNMP on the remote device via vectors involving goform/setSnmp...

CVE-2017-11649

Affected product: DrayTek Vigor AP910C devices with firmware 1.2.0_RC3 build r6594. Vulnerability: Cross-site request forgery (CSRF) that lets an attacker hijack the authentication of an unspecified user to enable SNMP via requests to goform/setSnmp. Impact (as stated): enables SNMP on the remote...

Draytek Vigor ACS-SI multiple security vulnerabilities

Default account, unauthorized access, directory traversal...

Multiple Vulnerabilities in Draytek Vigor 2130

VIGOR 2130 firmware 1.5.4.9 1.1. Command injection in traceroute functionality A user can execute arbitrary commands RCE on the router by abusing the traceroute functionality. The interface expects an IP address as input, but does not validate the input. Just provide the input: ; id The above...

VIGOR 2130 Command Injection / Cross Site Request Forgery

VIGOR 2130 firmware 1.5.4.9 1.1. Command injection in traceroute functionality A user can execute arbitrary commands RCE on the router by abusing the traceroute functionality. The interface expects an IP address as input, but does not validate the input. Just provide the input: ; id The above...

Draytek Vigor 3900 1.06 - Privilege Escalation

No description provided by source...

CVE-2013-5703

The DrayTek Vigor 2700 router 2.8.3 allows remote attackers to execute arbitrary JavaScript code, and modify settings or the DNS cache, via a crafted SSID value that is not properly handled during insertion into the sWlessSurvey value in variables.js...

Code injection

The DrayTek Vigor 2700 router 2.8.3 allows remote attackers to execute arbitrary JavaScript code, and modify settings or the DNS cache, via a crafted SSID value that is not properly handled during insertion into the sWlessSurvey value in variables.js...

CVE-2013-5703

The DrayTek Vigor 2700 router 2.8.3 allows remote attackers to execute arbitrary JavaScript code, and modify settings or the DNS cache, via a crafted SSID value that is not properly handled during insertion into the sWlessSurvey value in variables.js...

CVE-2013-5703

CVE-2013-5703 affects the DrayTek Vigor 2700 router (notably v2.8.3) where a crafted SSID value is mishandled when inserted into the sWlessSurvey list in variables.js. This enables remote attackers to execute arbitrary JavaScript in the router’s web administration context and to modify settings o...

DrayTek Vigor 2700 ADSL router contains a command injection vulnerability

Overview DrayTek Vigor 2700 ADSL router version 2.8.3 and possibly earlier versions contain a command injection vulnerability via malicious SSID CWE-77. Description CWE-77: Improper Neutralization of Special Elements used in a Command 'Command Injection' DrayTek Vigor 2700 ADSL router version 2.8...