Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (1703 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2019-6969 1 Dlink 2 Dva-5592, Dva-5592 Firmware 2024-11-21 7.5 High
The web interface of the D-Link DVA-5592 20180823 is vulnerable to an authentication bypass that allows an unauthenticated user to have access to sensitive information such as the Wi-Fi password and the phone number (if VoIP is in use).
CVE-2019-6968 1 Dlink 2 Dva-5592, Dva-5592 Firmware 2024-11-21 6.1 Medium
The web interface of the D-Link DVA-5592 20180823 is vulnerable to XSS because HTML form parameters are directly reflected.
CVE-2019-6258 2 D-link, Dlink 2 Dir-822 Firmware, Dir-822 2024-11-21 9.8 Critical
D-Link DIR-822 Rev.Bx devices with firmware v.202KRb06 and older allow a buffer overflow via long MacAddress data in a /HNAP1/SetClientInfo HNAP protocol message, which is mishandled in /usr/sbin/udhcpd during reading of the /var/servd/LAN-1-udhcpd.conf file.
CVE-2019-6014 1 Dlink 2 Dba-1510p, Dba-1510p Firmware 2024-11-21 8.8 High
DBA-1510P firmware 1.70b009 and earlier allows an attacker to execute arbitrary OS commands via Web User Interface.
CVE-2019-6013 1 Dlink 2 Dba-1510p, Dba-1510p Firmware 2024-11-21 6.6 Medium
DBA-1510P firmware 1.70b009 and earlier allows authenticated attackers to execute arbitrary OS commands via Command Line Interface (CLI).
CVE-2019-20501 1 Dlink 2 Dwl-2600ap, Dwl-2600ap Firmware 2024-11-21 7.8 High
D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Upgrade Firmware functionality in the Web interface, using shell metacharacters in the admin.cgi?action=upgrade firmwareRestore or firmwareServerip parameter.
CVE-2019-20499 1 Dlink 2 Dwl-2600ap, Dwl-2600ap Firmware 2024-11-21 7.8 High
D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_restore configRestore or configServerip parameter.
CVE-2019-20217 1 Dlink 2 Dir-859, Dir-859 Firmware 2024-11-21 9.8 Critical
D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because SERVER_ID is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters.
CVE-2019-20216 1 Dlink 2 Dir-859, Dir-859 Firmware 2024-11-21 9.8 Critical
D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because REMOTE_PORT is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters.
CVE-2019-20215 1 Dlink 2 Dir-859, Dir-859 Firmware 2024-11-21 9.8 Critical
D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because HTTP_ST is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters.
CVE-2019-20213 1 Dlink 28 Dir-818lx, Dir-818lx Firmware, Dir-822 and 25 more 2024-11-21 7.5 High
D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php.
CVE-2019-19743 1 Dlink 2 Dir-615 T1, Dir-615 T1 Firmware 2024-11-21 6.5 Medium
On D-Link DIR-615 devices, a normal user is able to create a root(admin) user from the D-Link portal.
CVE-2019-19742 1 Dlink 2 Dir-615, Dir-615 Firmware 2024-11-21 4.8 Medium
On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field.
CVE-2019-19598 1 Dlink 2 Dap-1860, Dap-1860 Firmware 2024-11-21 8.8 High
D-Link DAP-1860 devices before v1.04b03 Beta allow access to administrator functions without authentication via the HNAP_AUTH header timestamp value. In HTTP requests, part of the HNAP_AUTH header is the timestamp used to determine the time when the user sent the request. If this value is equal to the value stored in the device's /var/hnap/timestamp file, the request will pass the HNAP_AUTH check function.
CVE-2019-19597 1 Dlink 2 Dap-1860, Dap-1860 Firmware 2024-11-21 8.8 High
D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAP_AUTH HTTP header.
CVE-2019-19226 1 Dlink 2 Dsl-2680, Dsl-2680 Firmware 2024-11-21 7.5 High
A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to enable or disable MAC address filtering by submitting a crafted Forms/WlanMacFilter_1 POST request without being authenticated on the admin interface.
CVE-2019-19225 1 Dlink 2 Dsl-2680, Dsl-2680 Firmware 2024-11-21 7.5 High
A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to change DNS servers without being authenticated on the admin interface by submitting a crafted Forms/dns_1 POST request.
CVE-2019-19224 1 Dlink 2 Dsl-2680, Dsl-2680 Firmware 2024-11-21 7.5 High
A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to download the configuration (binary file) settings by submitting a rom-0 GET request without being authenticated on the admin interface.
CVE-2019-19223 1 Dlink 2 Dsl-2680, Dsl-2680 Firmware 2024-11-21 7.5 High
A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to reboot the router by submitting a reboot.html GET request without being authenticated on the admin interface.
CVE-2019-19222 1 Dlink 2 Dsl-2680, Dsl-2680 Firmware 2024-11-21 5.4 Medium
A Stored XSS issue in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an authenticated attacker to inject arbitrary JavaScript code into the info.html administration page by sending a crafted Forms/wireless_autonetwork_1 POST request.