Havook

A flaw has been found in Cairo-dock Glx-Dock 3.4.0. The affected element is an unknown function of the file bg forum.php of the component href Attribute Handler. This manipulation of the argument f causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Remote cross site scripting is possible due to improper processing of the `p` argument within the Query Parameter Handler component in the `ww page.php` file. Cross site scripting is a technique where malicious scripts are injected into trusted websites.

A cross-site scripting issue exists within the Wireless Setup Section. Remote attackers can execute this by manipulating the `Wireless Network Name` argument. Cross-site scripting is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users.

A cross-site scripting issue exists in the Ethernet Configuration Page. A remote attacker can initiate an attack by manipulating the `Name` argument. Cross-site scripting is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users.

A security flaw in the New User Page component allows remote attackers to perform cross-site scripting (XSS), which is a technique where malicious scripts are injected into trusted websites. The issue exists within an unknown function of the '/index.asp' endpoint, specifically through the manipulation of the `User name` argument.

An issue in the New RMON History Page component allows remote exploitation via cross-site scripting (XSS), which is a technique where malicious scripts are injected into trusted websites. The flaw is triggered by the manipulation of the `Owner` argument.

An issue exists in the New RMON Statistics Page component where the manipulation of the `Owner` argument allows for remote cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites.

A cross-site scripting issue exists in the URL Filtering Page component, specifically within the `urlfilter.asp` file. The manipulation of the `URL` address argument can lead to exploitation. The exploit has been publicly disclosed.

A critical issue exists in D-Link DIR-818LW. The vulnerability is located within the System Time Page component. Manipulation of the `NTP Server` argument can lead to os command injection, allowing for remote attacks. The exploit has been publicly disclosed. This issue only affects products that are no longer supported by the maintainer.

A problematic issue has been found in the component Add Static IP, where the manipulation of the `Description` argument leads to cross-site scripting. This issue can be exploited remotely.

A critical issue has been discovered, affecting the Personal Script Submenu component, specifically the file /boafrm/formScript. This issue leads to os command injection and can be initiated remotely. The vendor was contacted about the disclosure but did not respond.

Name of the Vulnerable Software and Affected Versions: Castlenet CBW383G2N up to 20250301 Description: A vulnerability has been found that affects an unknown part of the file /RgSwInfo.asp. The manipulation of the argument `Description` with the input `<img/src/onerror=prompt(8)>` leads to cross-site scripting. It is possible to initiate the attack remotely. Other parameters might be affected as well. Recommendations: For Castlenet CBW383G2N up to 20250301, as a temporary workaround, consider restricting access to the `/RgSwInfo.asp` file until a patch is available. Avoid using the `Description` argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A problem has been found in the Ping6 Diagnóstico component, specifically in the /form2pingv6.cgi file. The issue affects some unknown functionality of this file. The manipulation of the `ip6addr` argument with specific input, such as `<img/src/onerror=prompt(8)>`, leads to cross-site scripting. This issue can be exploited remotely. The exploit has been made public, and the vendor was contacted about this issue but did not respond.

The issue concerns a cross-site scripting problem in the URL Filtering Submenu, specifically affecting the "/goform/URL filterCfg" endpoint with the `url IP` parameter.

The issue concerns a cross-site scripting (XSS) problem in the 2.4G Menu SSID of the Netis WF2780 wireless device.

The issue concerns a cross-site scripting problem related to the portForwardingCfg pf Description in the Port Forwarding Submenu.

A problematic issue has been found in Postman on Windows, affecting an unknown part of the library file profapi.dll. The manipulation leads to an untrusted search path. The attack must be approached locally and has a rather high complexity, with difficult exploitability. The vendor was contacted about this disclosure but did not respond.

A problem has been found in Discord that affects some unknown functionality in the profapi.dll library, leading to an untrusted search path. The attack must be approached locally and has a rather high complexity, with difficult exploitation. The issue may allow an attacker to impact the confidentiality, integrity, and availability of protected information.

A vulnerability was found in the Epic Games Launcher, affecting the library profapi.dll of the component Installer. The issue leads to an untrusted search path. Local attack is required, and the complexity of the attack is rather high, making exploitation difficult.

A problematic issue has been found in the library profapi.dll of the component Startup, leading to an untrusted search path. The manipulation requires a local attack approach. The vendor was contacted about this disclosure but did not respond.