Raymond

برنامج MCP Inspector، وهو أداة تطوير لاختبار وتصحيح أخطاء خوادم MCP، معرض لثغرة أمنية تتعلق بالبرمجة النصية عبر المواقع (cross-site scripting). تحدث هذه الثغرة عند الاتصال بخوادم MCP بعيدة غير موثوقة باستخدام عنوان URI لإعادة التوجيه خبيث. قد يؤدي استغلال هذه الثغرة إلى التفاعل مع وكيل المفتش (proxy)، مما قد يؤدي إلى تنفيذ أوامر تعسفية.

The issue concerns a hidden functionality in certain D-Link wireless routers where the telnet service is enabled when the WAN port is plugged in. This allows unauthorized remote attackers to log in and execute OS commands using hard-coded credentials. The vulnerability is related to the presence of undocumented configuration commands in the telnet service.

The issue is related to the presence of hidden functionality in certain D-Link wireless routers, allowing an attacker to forcibly enable the telnet service by sending specific packets to the web service. This can grant the attacker access to the device using hard-coded credentials. The telnet service enabled through this method can only be accessed from within the same local network as the device.

The issue is related to the telnet service in certain D-Link wireless routers, where user input is not properly validated, allowing unauthenticated remote attackers to use hard-coded credentials to log into telnet and inject arbitrary OS commands. This can result in the execution of commands on the device, potentially leading to unauthorized access to confidential information.

The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow vulnerability, which allows unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device. This flaw lets unauthenticated remote attackers execute code on the device without authorization.

The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow issue, which allows unauthenticated remote attackers to exploit this issue to execute arbitrary code on the device.

Name of the Vulnerable Software and Affected Versions: D-Link wireless routers (affected versions not specified) Description: The issue allows unauthenticated attackers on the same local area network to read arbitrary system files by manipulating the URL, due to a path traversal vulnerability. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to an undisclosed factory testing backdoor in certain models of D-Link wireless routers. This backdoor allows unauthenticated attackers on the local area network to enable the Telnet service by accessing a specific URL and log in using the administrator credentials obtained from analyzing the firmware. The backdoor is believed to have been used for automating device testing during production.