Chitran

Esta vulnerabilidade permite que invasores na mesma rede executem código arbitrário em instalações afetadas dos roteadores D-Link DAP-2020. Não é necessária autenticação para explorar esta vulnerabilidade. A falha específica existe no endpoint “webproc”, que escuta na porta TCP 80 por padrão. A vulnerabilidade resulta da falta de validação adequada do comprimento dos dados fornecidos pelo usuário antes de copiá-los para um buffer baseado em pilha de comprimento fixo. Um invasor pode aproveitar essa vulnerabilidade para executar código no contexto do root.

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.10 Description: The issue concerns a Self-XSS vulnerability that can be triggered via the Layout Design Manager, specifically through the "Name" field. This field is accessible when creating a new template action in the Design Manager. Recommendations: For CMS Made Simple version 2.2.10, update to a newer version that contains a fix for this issue to prevent potential exploitation.

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.10 Description: The issue concerns an XSS vulnerability that can be triggered via the 'moduleinterface.php' Name field. This field is accessible through an "Add Category" action in the "Site Admin Settings - News module" section. Recommendations: For CMS Made Simple version 2.2.10, update to a version that includes a fix for this issue to prevent exploitation.

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.10 Description: The issue concerns a cross-site scripting (XSS) problem. It is located in the `myaccount.php` file, specifically in the "Email Address" field. This field is accessible through the "My Preferences -> My Account" section. Recommendations: For CMS Made Simple version 2.2.10, update to a version that fixes this issue to prevent cross-site scripting attacks.

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.10 Description: The issue concerns an XSS vulnerability that can be triggered via the `moduleinterface.php` `Name` field. This field is accessible through an "Add a new Profile" action to the File Picker. Recommendations: For CMS Made Simple version 2.2.10, update to a version that includes a fix for this issue to prevent exploitation.