Dlink
Page 16 of 18 — Dlink CVEs from a corpus of 1765, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-13375 | Critical | 9.8 | 2019-07-06 | A SQL Injection was discovered in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 in PayAction.class.php with the index.php/Pay/passcodeAuth param… |
CVE-2019-13374 | Medium | 6.1 | 2019-07-06 | A cross-site scripting (XSS) vulnerability in resource view in PayAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remot… |
CVE-2019-13373 | Critical | 9.8 | 2019-07-06 | An issue was discovered in the D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6. Input does not get validated and arbitrary SQL statements can be e… |
CVE-2019-13372 | Critical | 9.8 | 2019-07-06 | /web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute arbitrary PHP code via… |
CVE-2017-8417 | High | 8.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device requires that a user logging into the device provide a username and password. Howev… |
CVE-2017-8416 | High | 8.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for b… |
CVE-2017-8415 | Critical | 9.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from… |
CVE-2017-8413 | High | 8.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for b… |
CVE-2017-8412 | High | 8.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom binary called mp4ts under the /var/www/video folder. It seems that thi… |
CVE-2017-8414 | High | 7.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary orthrus in /sbin folder of the device handles all the UPnP connections received by… |
CVE-2017-8410 | Critical | 9.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by th… |
CVE-2017-8409 | High | 7.5 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password. However, the devi… |
CVE-2017-8406 | High | 8.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allow… |
CVE-2017-8405 | High | 7.5 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by th… |
CVE-2017-8411 | High | 8.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by… |
CVE-2017-8407 | High | 8.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password for the web manageme… |
CVE-2017-8404 | Critical | 9.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by… |
CVE-2017-8408 | Critical | 9.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by… |
CVE-2019-13128 | High | 8.8 | 2019-07-01 | An issue was discovered on D-Link DIR-823G devices with firmware 1.02B03. There is a command injection in HNAP1 (exploitable with Authentication) via shell met… |
CVE-2013-7471 | Critical | 9.8 | 2019-06-11 | An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, DIR-300 rev. B, and… |
CVE-2019-12787 | High | 8.8 | 2019-06-10 | An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a command injection in HNAP1 SetWanSettings via an XML injection of… |
CVE-2019-12786 | High | 8.8 | 2019-06-10 | An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a command injection in HNAP1 SetWanSettings via an XML injection of… |
CVE-2018-19990 | Critical | 9.8 | 2019-05-13 | In the /HNAP1/SetWiFiVerifyAlpha message, the WPSPIN parameter is vulnerable, and the vulnerability affects D-Link DIR-822 B1 202KRb06 devices. In the SetWiFiV… |
CVE-2018-19989 | Critical | 9.8 | 2019-05-13 | In the /HNAP1/SetQoSSettings message, the uplink parameter is vulnerable, and the vulnerability affects D-Link DIR-822 Rev.B 202KRb06 and DIR-822 Rev.C 3.10B06… |
CVE-2018-19988 | Critical | 9.8 | 2019-05-13 | In the /HNAP1/SetClientInfoDemo message, the AudioMute and AudioEnable parameters are vulnerable, and the vulnerabilities affect D-Link DIR-868L Rev.B 2.05B02… |
CVE-2018-19987 | Critical | 9.8 | 2019-05-13 | D-Link DIR-822 Rev.B 202KRb06, DIR-822 Rev.C 3.10B06, DIR-860L Rev.B 2.03.B03, DIR-868L Rev.B 2.05B02, DIR-880L Rev.A 1.20B01_01_i3se_BETA, and DIR-890L Rev.A… |
CVE-2018-19986 | Critical | 9.8 | 2019-05-13 | In the /HNAP1/SetRouterSettings message, the RemotePort parameter is vulnerable, and the vulnerability affects D-Link DIR-818LW Rev.A 2.05.B03 and DIR-822 B1 2… |
CVE-2019-10999 | High | 8.8 | 2019-05-06 | The D-Link DCS series of Wi-Fi cameras contains a stack-based buffer overflow in alphapd, the camera's web server. The overflow allows a remotely authenticated… |
CVE-2019-11017 | Medium | 4.8 | 2019-04-18 | On D-Link DI-524 V2.06RU devices, multiple Stored and Reflected XSS vulnerabilities were found in the Web Configuration: /spap.htm, /smap.htm, and /cgi-bin/sma… |
CVE-2018-19300 | Critical | 9.8 | 2019-04-11 | On D-Link DAP-1530 (A1) before firmware version 1.06b01, DAP-1610 (A1) before firmware version 1.06b01, DWR-111 (A1) before firmware version 1.02v02, DWR-116 (… |
CVE-2018-17990 | High | 8.8 | 2019-04-01 | An issue was discovered on D-Link DSL-3782 devices with firmware 1.01. An OS command injection vulnerability in Acl.asp allows a remote authenticated attacker… |
CVE-2018-17989 | Medium | 5.4 | 2019-04-01 | A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to inject a JavaScript… |
CVE-2019-7642 | High | 7.5 | 2019-03-25 | D-Link routers with the mydlink feature have some web interfaces without authentication requirements. An attacker can remotely obtain users' DNS query logs and… |
CVE-2019-10042 | High | 7.5 | 2019-03-25 | The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use an… |
CVE-2019-10041 | Critical | 9.8 | 2019-03-25 | The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use an… |
CVE-2019-10040 | Critical | 9.8 | 2019-03-25 | The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use a h… |
CVE-2019-10039 | Critical | 9.8 | 2019-03-25 | The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use an… |
CVE-2019-9126 | High | 7.5 | 2019-02-25 | An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is an information disclosure vulnerability via requests for the router_info.xml document. T… |
CVE-2019-9125 | Critical | 9.8 | 2019-02-25 | An issue was discovered on D-Link DIR-878 1.12B01 devices. Because strncpy is misused, there is a stack-based buffer overflow vulnerability that does not requi… |
CVE-2019-9124 | Critical | 9.8 | 2019-02-25 | An issue was discovered on D-Link DIR-878 1.12B01 devices. At the /HNAP1 URI, an attacker can log in with a blank password. |
CVE-2019-9123 | Critical | 9.8 | 2019-02-25 | An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. The "user" account has a blank password. |
CVE-2019-9122 | High | 8.8 | 2019-02-25 | An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the ntp_server parameter in an ntp_… |
CVE-2019-8392 | High | 7.5 | 2019-02-17 | An issue was discovered on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to enable Guest Wi-Fi via… |
CVE-2019-8319 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-8318 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-8317 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-8316 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-8315 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-8314 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-8313 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-8312 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-7736 | Critical | 9.8 | 2019-02-11 | D-Link DIR-600M C1 3.04 devices allow authentication bypass via a direct request to the wan.htm page. NOTE: this may overlap CVE-2019-13101. |
CVE-2019-7390 | High | 8.6 | 2019-02-05 | An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to hijack… |
CVE-2019-7389 | High | 7.5 | 2019-02-05 | An issue was discovered in /bin/goahead on D-Link DIR-823G devices with the firmware 1.02B03. There is incorrect access control allowing remote attackers to re… |
CVE-2019-7388 | High | 7.5 | 2019-02-05 | An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to get se… |
CVE-2019-7298 | High | 8.1 | 2019-02-01 | An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS co… |
CVE-2019-7297 | Critical | 9.8 | 2019-01-31 | An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS co… |
CVE-2018-15517 | High | 8.6 | 2019-01-31 | The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbou… |
CVE-2018-15516 | Medium | 5.8 | 2019-01-31 | The FTP service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices allows remote attackers to conduct a PORT command bounce scan via port 8000, resulting… |
CVE-2018-15515 | High | 7.8 | 2019-01-31 | The CaptivelPortal service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices will load a Trojan horse "quserex.dll" from the CaptivelPortal.exe subdirec… |
CVE-2018-20675 | Critical | 9.8 | 2019-01-09 | D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A* before v1.21B08Beta, DIR-850L B* before v2.22B03Beta, and DIR-880L A* bef… |
CVE-2018-20674 | High | 8.8 | 2019-01-09 | D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A* before v1.21B08Beta, DIR-850L B* before v2.22B03Beta, and DIR-880L A* bef… |
CVE-2018-20114 | Critical | 9.8 | 2019-01-02 | On D-Link DIR-818LW Rev.A 2.05.B03 and DIR-860L Rev.B 2.03.B03 devices, unauthenticated remote OS command execution can occur in the soap.cgi service of the cg… |
CVE-2018-20445 | Critical | 9.8 | 2018-12-25 | D-Link DCM-604 DCM604_C1_ViaCabo_1.04_20130606 and DCM-704 EU_DCM-704_1.10 devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.4413… |
CVE-2018-20389 | Critical | 9.8 | 2018-12-23 | D-Link DCM-604 DCM604_C1_ViaCabo_1.04_20130606 and DCM-704 EU_DCM-704_1.10 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1… |
CVE-2018-18009 | Critical | 9.8 | 2018-12-21 | dirary0.js on D-Link DIR-140L, DIR-640L devices allows remote unauthenticated attackers to discover admin credentials. |
CVE-2018-18008 | Critical | 9.8 | 2018-12-21 | spaces.htm on multiple D-Link devices (DSL, DIR, DWR) allows remote unauthenticated attackers to discover admin credentials. |
CVE-2018-18007 | Critical | 9.8 | 2018-12-21 | atbox.htm on D-Link DSL-2770L devices allows remote unauthenticated attackers to discover admin credentials. |
CVE-2018-18767 | High | 7.0 | 2018-12-20 | An issue was discovered in D-Link 'myDlink Baby App' version 2.04.06. Whenever actions are performed from the app (e.g., change camera settings or play lullabi… |
CVE-2018-18442 | High | 7.5 | 2018-12-20 | D-Link DCS-825L devices with firmware 1.08 do not employ a suitable mechanism to prevent denial-of-service (DoS) attacks. An attacker can harm the device avail… |
CVE-2018-18441 | High | 7.5 | 2018-12-20 | D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration. The affected devices include many of DCS series, such as: DCS-… |
CVE-2018-20305 | Critical | 9.8 | 2018-12-20 | D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpass parameter. In the /goform/form2userconfig.cgi h… |
CVE-2018-17777 | Critical | 9.8 | 2018-12-18 | An issue was discovered on D-Link DVA-5592 A1_WI_20180823 devices. If the PIN of the page "/ui/cbpc/login" is the default Parental Control PIN (0000), it is po… |
CVE-2018-20057 | High | 8.8 | 2018-12-11 | An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to e… |
CVE-2018-20056 | Critical | 9.8 | 2018-12-11 | An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. There is a stack-based buffer overflow allowing remote a… |
CVE-2018-18636 | Medium | 6.1 | 2018-10-24 | XSS exists in cgi-bin/webcm on D-link DSL-2640T routers via the var:RelaodHref or var:conid parameter. |
CVE-2018-10824 | Critical | 9.8 | 2018-10-17 | An issue was discovered on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 throu… |
CVE-2018-10823 | High | 8.8 | 2018-10-17 | An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 thr… |
CVE-2018-10822 | High | 7.5 | 2018-10-17 | Directory traversal vulnerability in the web interface on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-… |
CVE-2018-14081 | Critical | 9.8 | 2018-10-09 | An issue was discovered on D-Link DIR-809 A1 through 1.09, A2 through 1.11, and Guest Zone through 1.09 devices. Device passwords, such as the admin password a… |
CVE-2018-14080 | High | 7.5 | 2018-10-09 | An issue was discovered on D-Link DIR-809 A1 through 1.09, A2 through 1.11, and Guest Zone through 1.09 devices. One can bypass authentication mechanisms to do… |
CVE-2018-17443 | Medium | 6.1 | 2018-10-08 | An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. The 'sitename' parameter of the UpdateSite endpoint is vulnerable to stored XS… |
CVE-2018-17442 | High | 8.8 | 2018-10-08 | An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. An unrestricted file upload vulnerability in the onUploadLogPic endpoint allow… |
CVE-2018-17441 | Medium | 6.1 | 2018-10-08 | An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. The 'username' parameter of the addUser endpoint is vulnerable to stored XSS. |
CVE-2018-17440 | Critical | 9.8 | 2018-10-08 | An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. They expose an FTP server that serves by default on port 9000 and has hardcode… |
CVE-2018-17881 | Critical | 9.8 | 2018-10-03 | On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger an admin password c… |
CVE-2018-17880 | High | 7.5 | 2018-10-03 | On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 RunReboot commands without authentication to trigger a reboot. |
CVE-2018-17787 | Critical | 9.8 | 2018-10-02 | On D-Link DIR-823G devices, the GoAhead configuration allows /HNAP1 Command Injection via shell metacharacters in the POST data, because this data is sent dire… |
CVE-2018-17786 | Critical | 9.8 | 2018-10-02 | On D-Link DIR-823G devices, ExportSettings.sh, upload_settings.cgi, GetDownLoadSyslog.sh, and upload_firmware.cgi do not require authentication, which allows r… |
CVE-2018-17068 | Critical | 9.8 | 2018-09-15 | An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction in the handler function of the… |
CVE-2018-17067 | Critical | 9.8 | 2018-09-15 | An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. A very long password to /goform/formLogin could lead to a stack-based buffer overflow and overwr… |
CVE-2018-17066 | Critical | 9.8 | 2018-09-15 | An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction in the handler function of the… |
CVE-2018-17065 | Critical | 9.8 | 2018-09-15 | An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/DDNS route, a very long password could lead to a stac… |
CVE-2018-17064 | Critical | 9.8 | 2018-09-15 | An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of… |
CVE-2018-17063 | Critical | 9.8 | 2018-09-15 | An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of… |
CVE-2018-16605 | Medium | 5.4 | 2018-09-12 | D-Link DIR-600M devices allow XSS via the Hostname and Username fields in the Dynamic DNS Configuration page. |
CVE-2018-16408 | High | 7.2 | 2018-09-03 | D-Link DIR-846 devices with firmware 100.26 allow remote attackers to execute arbitrary code as root via a SetNetworkTomographySettings request by leveraging a… |
CVE-2018-12710 | High | 8.0 | 2018-08-29 | An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (which is a low privilege account) access… |
CVE-2018-15839 | Critical | 9.8 | 2018-08-28 | D-Link DIR-615 devices have a buffer overflow via a long Authorization HTTP header. |
CVE-2018-15875 | Medium | 6.1 | 2018-08-25 | Cross-site scripting (XSS) vulnerability on D-Link DIR-615 routers 20.07 allows attackers to inject JavaScript into the router's admin UPnP page via the descri… |