CVSS: 9.8EPSS: 3%CPEs: 2EXPL: 5CVE-2016-11014
https://notcve.org/view.php?id=CVE-2016-11014
NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because the ok value of the auth cookie is a special case. Los dispositivos NETGEAR JNR1010 versiones anteriores a 1.0.0.32, presenta un Control de Acceso Incorrecto porque el valor satisfactorio de la cookie de autenticación es un caso especial. • https://cybersecurityworks.com/zerodays/cve-2016-11014-netgear.html https://github.com/cybersecurityworks/Disclosed/issues/14 https://khalil-shreateh.com/khalil.shtml/it-highlights/593-Netgear-1.0.0.24-Bypass---Improper-Session-Management--.html https://lists.openwall.net/full-disclosure/2016/01/11/5 https://packetstormsecurity.com/files/135216/Netgear-1.0.0.24-Bypass-Improper-Session-Management.html • CWE-613: Insufficient Session Expiration •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 4CVE-2016-11015
https://notcve.org/view.php?id=CVE-2016-11015
NETGEAR JNR1010 devices before 1.0.0.32 allow cgi-bin/webproc CSRF via the :InternetGatewayDevice.X_TWSZ-COM_URL_Filter.BlackList.1.URL parameter. Los dispositivos NETGEAR JNR1010 versiones anteriores a 1.0.0.32, permiten un ataque de tipo CSRF del archivo cgi-bin/webproc por medio del parámetro :InternetGatewayDevice.X_TWSZ-COM_URL_Filter.BlackList.1.URL. • https://cybersecurityworks.com/zerodays/cve-2016-11015-netgear.html https://github.com/cybersecurityworks/Disclosed/issues/13 https://lists.openwall.net/full-disclosure/2016/01/11/4 https://packetstormsecurity.com/files/135215/Netgear-1.0.0.24-Cross-Site-Request-Forgery.html https://pmcg2k15.wordpress.com/2016/01/11/fd-cross-site-request-forgery-in-netgear-router-jnr1010-version-1-0-0-24 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 3%CPEs: 2EXPL: 5CVE-2016-11016
https://notcve.org/view.php?id=CVE-2016-11016
NETGEAR JNR1010 devices before 1.0.0.32 allow webproc?getpage= XSS. Los dispositivos NETGEAR JNR1010 versiones anteriores a 1.0.0.32, permiten un ataque de tipo XSS en webproc?getpage=. • http://007software.net/multiple-cross-site-scripting-in-netgear-router-version1-0-0-24 https://cybersecurityworks.com/zerodays/cve-2016-11016-netgear.html https://github.com/cybersecurityworks/Disclosed/issues/12 https://khalil-shreateh.com/khalil.shtml/it-highlights/592-Netgear-1.0.0.24-Cross-Site-Request-Forgery--.html https://lists.openwall.net/full-disclosure/2016/01/11/1 https://packetstormsecurity.com/files/135194/Netgear-1.0.0.24-Cross-Site-Scripting.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •