CVE Vulnerability Catalog

A weakness has been identified in Trendnet TEW-657BRM 1.00.1. The function add_wps_client in the file /setup.cgi is affected by OS command injection via manipulation of the argument wl_enrolee_pin. The attack can be launched remotely and the exploit has been made public. The vendor confirmed the product is end-of-life since 2011 and no patch will be released.

A bypass was found in OWASP Core Rule Set (CRS) before versions 3.3.9 and 4.25.0. By inserting whitespace in the filename (e.g., photo. php), files with dangerous extensions (.php, .phar, .jsp, .jspx) can be uploaded without being blocked.

In Textpattern up to version 4.9.1, the function mt_uploadImage in file rpc/TXP_RPCServer.php (XML-RPC Handler component) is vulnerable to path traversal via manipulation of the file.name argument. Remote exploitation is possible, and the exploit has been publicly disclosed.

A vulnerability in LibRaw up to 0.22.0 in the function LibRaw::nikon_load_padded_packed_raw. Manipulating load_flags/raw_width arguments leads to an out-of-bounds read. The attack can be remote.

A command injection vulnerability was detected in Tenda G103 1.0.0.5 in the action_set_net_settings function of the gpon.lua file. Remote manipulation of arguments like authLoid leads to arbitrary command execution. The exploit is publicly available.

phpMyFAQ before version 4.1.1 contains an XSS vulnerability in the regex-based SVG sanitizer. Attackers with edit_faq permission can upload a malicious SVG that uses HTML entity encoding in javascript: URLs within <a href> attributes, leading to arbitrary JavaScript execution and privilege escalation to full admin takeover.

An information disclosure vulnerability was found in phpMyFAQ prior to version 4.1.1 in the searchCustomPages() method. The escape() function uses real_escape_string(), which does not escape LIKE metacharacters (% and _), allowing an unauthenticated attacker to inject these characters and read unintended records.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /manage/password/web/. An authenticated attacker can inject arbitrary JavaScript.

Endian Firewall version 3.3.25 and prior have a stored cross-site scripting (XSS) vulnerability via the new_cert_name parameter in /manage/ca/certificate/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /manage/vpnauthentication/user/. An authenticated attacker can inject arbitrary JavaScript that executes when other users view the page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /manage/ipsec/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the REMARK parameter in /cgi-bin/openvpnclient.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /manage/dnsmasq/localdomains/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the ADDRESS BCC parameter in /cgi-bin/smtprouting.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the domain parameter in /manage/smtpscan/domainrouting/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the DOMAIN parameter in /cgi-bin/smtpdomains.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the group parameter in /cgi-bin/proxygroup.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior have a stored XSS vulnerability via the user parameter in /cgi-bin/proxyuser.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the mimetypes parameter in /cgi-bin/proxypolicy.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /cgi-bin/xtaccess.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.