3 results (0.003 seconds)

CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0

CVE-2014-7858

https://notcve.org/view.php?id=CVE-2014-7858

The check_login function in D-Link DNR-326 before 2.10 build 03 allows remote attackers to bypass authentication and log in by setting the username cookie parameter to an arbitrary string. La función check_login en D-Link DNR-326 en versiones anteriores a la 2.10 build 03 permite que atacantes remotos omitan la autenticación e inicien sesión estableciendo el parámetro username cookie en una cadena arbitraria. • http://packetstormsecurity.com/files/132075/D-Link-Bypass-Buffer-Overflow.html http://seclists.org/fulldisclosure/2015/May/125 http://www.search-lab.hu/media/D-Link_Security_advisory_3_0_public.pdf http://www.securityfocus.com/archive/1/535626/100/200/threaded http://www.securityfocus.com/bid/74886 • CWE-287: Improper Authentication •

CVSS: 9.8EPSS: 42%CPEs: 10EXPL: 0

CVE-2014-7859

https://notcve.org/view.php?id=CVE-2014-7859

Stack-based buffer overflow in login_mgr.cgi in D-Link firmware DNR-320L and DNS-320LW before 1.04b08, DNR-322L before 2.10 build 03, DNR-326 before 2.10 build 03, and DNS-327L before 1.04b01 allows remote attackers to execute arbitrary code by crafting malformed "Host" and "Referer" header values. Un desbordamiento de búfer basado en pila en login_mgr.cgi en D-Link firmware DNR-320L y DNS-320LW en versiones anteriores a la 1.04b08, DNR-322L en versiones anteriores a la 2.10 build 03, DNR-326 en versiones anteriores a la 2.10 build 03, y DNS-327L en versiones anteriores a la 1.04b01 permite que atacantes remotos ejecuten código arbitrario mediante la manipulación de valores de cabecera "Host" y "Referer" con formato incorrecto. • http://packetstormsecurity.com/files/132075/D-Link-Bypass-Buffer-Overflow.html http://seclists.org/fulldisclosure/2015/May/125 http://www.search-lab.hu/media/D-Link_Security_advisory_3_0_public.pdf http://www.securityfocus.com/archive/1/535626/100/200/threaded http://www.securityfocus.com/bid/74878 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVSS: 10.0EPSS: 0%CPEs: 14EXPL: 0

CVE-2014-7857

https://notcve.org/view.php?id=CVE-2014-7857

D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01, DNS-345 1.03b06, DNS-325 1.05b03, and DNS-322L 2.00b07 allow remote attackers to bypass authentication and log in with administrator permissions by passing the cgi_set_wto command in the cmd parameter, and setting the spawned session's cookie to username=admin. DNS-320L firmware anterior a la versión 1.04b12, DNS-327L anterior a la versión 1.03b04 Build0119, DNR-326 versión 1.40b03, DNS-320B versión 1.02b01, DNS-345 versión 1.03b06, DNS-325 versión 1.05b03, y DNS-322L versión 2.00b07 de D-Link, permite a los atacantes remotos omitir la autenticación e iniciar sesión con los permisos de administrador omitiendo el comando cgi_set_wto en el parámetro cmd y ajustando la cookie de sesión creada en username=admin. • http://packetstormsecurity.com/files/132075/D-Link-Bypass-Buffer-Overflow.html http://seclists.org/fulldisclosure/2015/May/125 http://www.search-lab.hu/media/D-Link_Security_advisory_3_0_public.pdf http://www.securityfocus.com/archive/1/535626/100/200/threaded http://www.securityfocus.com/bid/74880 • CWE-287: Improper Authentication •