Page 39 of 351 results (0.009 seconds)

CVSS: 4.8EPSS: 0%CPEs: 4EXPL: 1

CVE-2020-14965

https://notcve.org/view.php?id=CVE-2020-14965

On TP-Link TL-WR740N v4 and TL-WR740ND v4 devices, an attacker with access to the admin panel can inject HTML code and change the HTML context of the target pages and stations in the access-control settings via targets_lists_name or hosts_lists_name. The vulnerability can also be exploited through a CSRF, requiring no authentication as an administrator. En los dispositivos TP-Link TL-WR740N versión v4 y TL-WR740ND versión v4, un atacante con acceso al panel de administración puede inyectar código HTML y cambiar el contexto HTML de las páginas y estaciones de destino en la configuración de control de acceso por medio de Target_lists_name o hosts_lists_name. La vulnerabilidad también puede ser explotada por medio de un ataque de tipo CSRF, que no requiere autenticación como administrador • https://github.com/g-rubert/CVE-2020-14965 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.0EPSS: 0%CPEs: 14EXPL: 1

CVE-2020-13224 – TP-LINK Cloud Cameras NCXXX Stack Overflow

https://notcve.org/view.php?id=CVE-2020-13224

TP-LINK NC200 devices through 2.1.10 build 200401, NC210 devices through 1.0.10 build 200401, NC220 devices through 1.3.1 build 200401, NC230 devices through 1.3.1 build 200401, NC250 devices through 1.3.1 build 200401, NC260 devices through 1.5.3 build_200401, and NC450 devices through 1.5.4 build 200401 have a Buffer Overflow Dispositivos TP-LINK NC200 versiones hasta 2.1.10 build 200401, dispositivos NC210 versiones hasta 1.0.10 build 200401, dispositivos NC220 versiones hasta 1.3.1 build 200401, dispositivos NC230 versiones hasta 1.3.1 build 200401, dispositivos NC250 versiones hasta 1.3.1 build 200401, dispositivos NC260 versiones hasta 1.5.3 build_200401, y los dispositivos NC450 versiones hasta 1.5.4 build 200401, presentan un desbordamiento de búfer TP-LINK Cloud Cameras NCXXX suffer from a DelMultiUser stack overflow vulnerability. • http://packetstormsecurity.com/files/158115/TP-LINK-Cloud-Cameras-NCXXX-Stack-Overflow.html https://www.tp-link.com/us/security • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •

CVSS: 7.8EPSS: 0%CPEs: 220EXPL: 1

CVE-2020-12695 – hostapd: UPnP SUBSCRIBE misbehavior in WPS AP

https://notcve.org/view.php?id=CVE-2020-12695

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue. La especificación UPnP de Open Connectivity Foundation antes del 17-04-2020 no prohíbe la aceptación de una petición de suscripción con una URL de entrega en un segmento de red diferente a la URL de suscripción de evento totalmente calificada, también se conoce como el problema de CallStranger • https://github.com/yunuscadirci/CallStranger http://packetstormsecurity.com/files/158051/CallStranger-UPnP-Vulnerability-Checker.html http://www.openwall.com/lists/oss-security/2020/06/08/2 https://corelight.blog/2020/06/10/detecting-the-new-callstranger-upnp-vulnerability-with-zeek https://github.com/corelight/callstranger-detector https://lists.debian.org/debian-lts-announce/2020/08/msg00011.html https://lists.debian.org/debian-lts-announce/2020/08/msg00013.html https://lists.debian.org/debian-l • CWE-276: Incorrect Default Permissions CWE-918: Server-Side Request Forgery (SSRF) •

CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1

CVE-2020-12475

https://notcve.org/view.php?id=CVE-2020-12475

TP-Link Omada Controller Software 3.2.6 allows Directory Traversal for reading arbitrary files via com.tp_link.eap.web.portal.PortalController.getAdvertiseFile in /opt/tplink/EAPController/lib/eap-web-3.2.6.jar. TP-Link Omada Controller Software versión 3.2.6, permite un Salto de Directorio para leer archivos arbitrarios por medio de la función com.tp_link.eap.web.portal.PortalController.getAdvertiseFile en el archivo /opt/tplink/EAPController/lib/eap-web-3.2.6.jar. • https://sovietw0rm.wordpress.com/2020/04/29/tp-link-omada-controller-directory-traversal-vulnerability • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 9.0EPSS: 8%CPEs: 11EXPL: 2

CVE-2020-12111 – TP-LINK Cloud Cameras NCXXX SetEncryptKey Command Injection

https://notcve.org/view.php?id=CVE-2020-12111

Certain TP-Link devices allow Command Injection. This affects NC260 1.5.2 build 200304 and NC450 1.5.3 build 200304. Determinados dispositivos TP-Link permiten una inyección de comandos. Esto afecta a NC260 versión 1.5.2 build 200304 y NC450 versión 1.5.3 build 200304. TP-LINK Cloud Cameras including products NC260 and NC450 suffer from a command injection vulnerability. • http://packetstormsecurity.com/files/157533/TP-LINK-Cloud-Cameras-NCXXX-SetEncryptKey-Command-Injection.html https://seclists.org/fulldisclosure/2020/May/4 https://www.tp-link.com/us/security • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •