Dlink Central_wifimanager
11 CVEs affecting Dlink Central_wifimanager. Latest disclosed: 2019-07-06. Critical: 4, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-13375 | Critical | 9.8 | 2019-07-06 | A SQL Injection was discovered in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 in PayAction.class.php with the index.php/Pay/passcodeAuth param… |
CVE-2019-13373 | Critical | 9.8 | 2019-07-06 | An issue was discovered in the D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6. Input does not get validated and arbitrary SQL statements can be e… |
CVE-2019-13372 | Critical | 9.8 | 2019-07-06 | /web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute arbitrary PHP code via… |
CVE-2018-17440 | Critical | 9.8 | 2018-10-08 | An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. They expose an FTP server that serves by default on port 9000 and has hardcode… |
CVE-2018-17442 | High | 8.8 | 2018-10-08 | An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. An unrestricted file upload vulnerability in the onUploadLogPic endpoint allow… |
CVE-2018-15517 | High | 8.6 | 2019-01-31 | The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbou… |
CVE-2018-15515 | High | 7.8 | 2019-01-31 | The CaptivelPortal service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices will load a Trojan horse "quserex.dll" from the CaptivelPortal.exe subdirec… |
CVE-2019-13374 | Medium | 6.1 | 2019-07-06 | A cross-site scripting (XSS) vulnerability in resource view in PayAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remot… |
CVE-2018-17443 | Medium | 6.1 | 2018-10-08 | An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. The 'sitename' parameter of the UpdateSite endpoint is vulnerable to stored XS… |
CVE-2018-17441 | Medium | 6.1 | 2018-10-08 | An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. The 'username' parameter of the addUser endpoint is vulnerable to stored XSS. |
CVE-2018-15516 | Medium | 5.8 | 2019-01-31 | The FTP service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices allows remote attackers to conduct a PORT command bounce scan via port 8000, resulting… |