CVSS: 9.3EPSS: 51%CPEs: 1EXPL: 0CVE-2015-6949 – ASUS TM-AC1900 httpd Stack Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-6949
Stack-based buffer overflow in the ASUS TM-AC1900 router allows remote attackers to execute arbitrary code via crafted HTTP header values. Desbordamiento del buffer basado en pila en el router ASUS TM-AC1900, permite a atacantes remotos ejecutar código arbitrario a través de valores de cabecera HTTP manipulados. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the ASUS TM-1900. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HTTP header parsing routine. The issue lies in the failure to check the size of header values. • http://www.securitytracker.com/id/1033560 http://www.zerodayinitiative.com/advisories/ZDI-15-409 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 3CVE-2015-2676
https://notcve.org/view.php?id=CVE-2015-2676
Cross-site request forgery (CSRF) vulnerability in the ASUS RT-G32 routers with firmware 2.0.2.6 and 2.0.3.2 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request to start_apply.htm. Vulnerabilidad de CSRF en los routers ASUS RT-G32 con firmware 2.0.2.6 y 2.0.3.2 permite a atacantes remotos secuestrar la autenticación de administradores por peticiones que cambian la contraseña de administrador a través de una petición a start_apply.htm. • http://packetstormsecurity.com/files/130724/ASUS-RT-G32-Cross-Site-Request-Forgery-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2015/Mar/42 http://websecurity.com.ua/7644 http://www.securityfocus.com/bid/73294 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 3CVE-2015-2681
https://notcve.org/view.php?id=CVE-2015-2681
Multiple cross-site scripting (XSS) vulnerabilities in the ASUS RT-G32 routers with firmware 2.0.2.6 and 2.0.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) next_page, (2) group_id, (3) action_script, or (4) flag parameter to start_apply.htm. Múltiples vulnerabilidades de XSS en los routers ASUS RT-G32 con firmware 2.0.2.6 y 2.0.3.2 permiten a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través del parámetro (1) next_page, (2) group_id, (3) action_script, o (4) flag en start_apply.htm. • http://packetstormsecurity.com/files/130724/ASUS-RT-G32-Cross-Site-Request-Forgery-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2015/Mar/42 http://websecurity.com.ua/7644 http://www.securityfocus.com/bid/73296 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 1CVE-2015-1437
https://notcve.org/view.php?id=CVE-2015-1437
Multiple cross-site scripting (XSS) vulnerabilities in Asus RT-N10+ D1 router with firmware 2.1.1.1.70 allow remote attackers to inject arbitrary web script or HTML via the flag parameter to (1) result_of_get_changed_status.asp or (2) error_page.htm. Múltiples vulnerabilidades de XSS en el router Asus RT-N10+ D1 con firmware 2.1.1.1.70 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro flag en (1) result_of_get_changed_status.asp o (2) error_page.htm. • http://packetstormsecurity.com/files/130187/Asus-RT-N10-Plus-Cross-Site-Scripting.html http://www.securityfocus.com/archive/1/534579/100/0/threaded http://www.securityfocus.com/archive/1/534580/100/0/threaded http://www.securityfocus.com/archive/1/534612/100/0/threaded http://www.securityfocus.com/bid/72369 https://exchange.xforce.ibmcloud.com/vulnerabilities/100563 https://exchange.xforce.ibmcloud.com/vulnerabilities/100566 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 10EXPL: 0CVE-2014-7270
https://notcve.org/view.php?id=CVE-2014-7270
Cross-site request forgery (CSRF) vulnerability on ASUS JAPAN RT-AC87U routers with firmware 3.0.0.4.378.3754 and earlier, RT-AC68U routers with firmware 3.0.0.4.376.3715 and earlier, RT-AC56S routers with firmware 3.0.0.4.376.3715 and earlier, RT-N66U routers with firmware 3.0.0.4.376.3715 and earlier, and RT-N56U routers with firmware 3.0.0.4.376.3715 and earlier allows remote attackers to hijack the authentication of arbitrary users. Vulnerabilidad de CSRF en los routers ASUS JAPAN RT-AC87U con firmware 3.0.0.4.378.3754 y anteriores, los routers RT-AC68U con firmware 3.0.0.4.376.3715 y anteriores, los routers RT-AC56S con firmware 3.0.0.4.376.3715 y anteriores, los routers RT-N66U con firmware 3.0.0.4.376.3715 y anteriores, y los routers RT-N56U con firmware 3.0.0.4.376.3715 y anteriores permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios. • http://jvn.jp/en/jp/JVN32631078/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2015-000012 http://www.asus.com/jp/News/PNzPd7vkXtrKWXHR • CWE-352: Cross-Site Request Forgery (CSRF) •