CVE-2019-15655

D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management server. This request doesn't require any authentication and will lead to saving the configuration file. The password is stored in cleartext...

Design/Logic Flaw

Comba AC2400 devices are prone to password disclosure via a simple crafted /09/business/upgrade/upcfgAction.php?download=true request to the web management server. The request doesn't require any authentication and will lead to saving the DBconfig.cfg file. At the end of the file, the login...

Information disclosure

D-Link DSL-2875AL and DSL-2877AL devices through 1.00.05 are prone to information disclosure via a simple crafted request to index.asp on the web management server because of usernamev and passwordv variables...

Design/Logic Flaw

D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management server. This request doesn't require any authentication and will lead to saving the configuration file. The password is stored in cleartext...

CVE-2019-15656

D-Link DSL-2875AL and DSL-2877AL devices through 1.00.05 are prone to information disclosure via a simple crafted request to index.asp on the web management server because of usernamev and passwordv variables...

CVE-2019-15655

D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management server. This request doesn't require any authentication and will lead to saving the configuration file. The password is stored in cleartext...

CVE-2019-15654

Comba AC2400 devices are prone to password disclosure via a simple crafted /09/business/upgrade/upcfgAction.php?download=true request to the web management server. The request doesn't require any authentication and will lead to saving the DBconfig.cfg file. At the end of the file, the login...

PT-2020-4209 · D Link · D-Link Dsl-2875Al +1

Name of the Vulnerable Software and Affected Versions: D-Link DSL-2875AL and DSL-2877AL devices through 1.00.05 Description: The issue is related to information disclosure via a crafted request to "index.asp" on the web management server. This is due to the username v and password v variables. Th...

Unspecified vulnerability in cPanel (CNVD-2021-37214)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A security vulnerability exists in versions of cPanel prior to 84.0.20. No detailed vulnerability details are provided at this ti...

Unspecified Vulnerability in WAGO PFC100 and WAGO PFC 200 (CNVD-2020-17497)

The WAGO PFC 200 and WAGO PFC 100 are both programmable logic controllers PLCs from WAGO Germany. A security vulnerability exists in the Web-Based Management web application in the WAGO PFC 200 with firmware versions 03.00.3912 and 03.01.0713 and the PFC100 with firmware version 03.00.3912. The...

AsyncOS Input Validation Error Vulnerability in Multiple Cisco Products

Cisco Content Security Management Appliance SMA and so on are the products of the American Cisco Cisco company.Cisco Content Security Management Appliance is a set of content security management equipment. The appliance is mainly used to manage all the policies, reports, audit information, etc. o...

CVE-2019-20487

An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the WNR1000V4 web management console are vulnerable to an unauthenticated GET request exploitable directly or through CSRF, as demonstrated by the setup.cgi?todo=savehtpaccount URI...

CVE-2019-20488

An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the web management interface setup.cgi are vulnerable to command injection, allowing remote attackers to execute arbitrary commands, as demonstrated by shell metacharacters in the sysDNSHost parameter...

CVE-2019-20486

An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple pages setup.cgi and advindex.htm within the web management console are vulnerable to stored XSS, as demonstrated by the configuration of the UI language...

Authentication flaw

An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. The web management interface setup.cgi has an authentication bypass and other problems that ultimately allow an attacker to remotely compromise the device from a malicious webpage. The attacker sends an FWremote.htm&todo=cfginit reque...

Cross site scripting

An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple pages setup.cgi and advindex.htm within the web management console are vulnerable to stored XSS, as demonstrated by the configuration of the UI language...

CVE-2019-20486

An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple pages setup.cgi and advindex.htm within the web management console are vulnerable to stored XSS, as demonstrated by the configuration of the UI language...

CVE-2019-20488

The CVE-2019-20488 entry affects NETGEAR WNR1000V4 devices (firmware 1.1.0.54). The web management interface (setup.cgi) is vulnerable to command injection via shell metacharacters in the sysDNSHost parameter, enabling remote execution of arbitrary commands. The current sources confirm the vulner...

CVE-2019-20487

CVE-2019-20487 affects NETGEAR WNR1000V4 devices running firmware 1.1.0.54. A vulnerability in the web management console allows an unauthenticated GET request (exploitable directly or via CSRF) via the URI setup.cgi?todo=save_htp_account, enabling actions without authentication. Red Hat/NVD entr...

Cisco Data Center Network Manager Cross-Site Request Forgery Vulnerability (CNVD-2020-10707)

Cisco Data Center Network Manager DCNM is a suite of data center network managers from Cisco that provides multiprotocol management of the network and troubleshooting of switch operating conditions and performance. A cross-site request forgery CSRF vulnerability exists in the Web management...