Tp Link

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-10167 1Tp Link 1Eap Controller Nov 21, 2024 May 3, 2018 N/A· v4 7.5 HIGH· v3 6.0 MEDIUM· v2 The web application backup file in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows is encrypted with a hard-coded cryptographic key, so anyone who knows that key and the algorithm can...Show more The web application backup file in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows is encrypted with a hard-coded cryptographic key, so anyone who knows that key and the algorithm can decrypt it. A low-privilege user could decrypt and modify the backup file in order to elevate their privileges. This is fixed in version 2.6.1_Windows.Show less
CVE-2018-10166 1Tp Link 1Eap Controller Nov 21, 2024 May 3, 2018 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 The web management interface in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows does not have Anti-CSRF tokens in any forms. This would allow an attacker to submit authenticated reque...Show more The web management interface in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows does not have Anti-CSRF tokens in any forms. This would allow an attacker to submit authenticated requests when an authenticated user browses an attack-controlled domain. This is fixed in version 2.6.1_Windows.Show less
CVE-2018-10165 1Tp Link 1Eap Controller Nov 21, 2024 May 3, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows allows authenticated attackers to inject arbitrary web script or HTML via the userNa...Show more Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows allows authenticated attackers to inject arbitrary web script or HTML via the userName parameter in the local user creation functionality. This is fixed in version 2.6.1_Windows.Show less
CVE-2018-10164 1Tp Link 1Eap Controller Nov 21, 2024 May 3, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows allows authenticated attackers to inject arbitrary web script or HTML via the implem...Show more Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows allows authenticated attackers to inject arbitrary web script or HTML via the implementation of portalPictureUpload functionality. This is fixed in version 2.6.1_Windows.Show less
CVE-2017-15637 1Tp Link 37Er5110g Firmware Er5120g FirmwareEr5510g Firmware+34 more Nov 21, 2024 Jan 11, 2018 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the pptphellointerval variable in the pptp_server.lua file.
CVE-2017-15636 1Tp Link 37Er5110g Firmware Er5120g FirmwareEr5510g Firmware+34 more Nov 21, 2024 Jan 11, 2018 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-time variable in the webfilter.lua file.
CVE-2017-15635 1Tp Link 37Er5110g Firmware Er5120g FirmwareEr5510g Firmware+34 more Nov 21, 2024 Jan 11, 2018 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the max_conn variable in the session_limits.lua file.
CVE-2017-15634 1Tp Link 37Er5110g Firmware Er5120g FirmwareEr5510g Firmware+34 more Nov 21, 2024 Jan 11, 2018 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the name variable in the wportal.lua file.
CVE-2017-15633 1Tp Link 37Er5110g Firmware Er5120g FirmwareEr5510g Firmware+34 more Nov 21, 2024 Jan 11, 2018 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-ipgroup variable in the session_limits.lua file.
CVE-2017-15632 1Tp Link 37Er5110g Firmware Er5120g FirmwareEr5510g Firmware+34 more Nov 21, 2024 Jan 11, 2018 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-mppeencryption variable in the pptp_server.lua file.
CVE-2017-15631 1Tp Link 37Er5110g Firmware Er5120g FirmwareEr5510g Firmware+34 more Nov 21, 2024 Jan 11, 2018 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-workmode variable in the pptp_client.lua file.
CVE-2017-15630 1Tp Link 37Er5110g Firmware Er5120g FirmwareEr5510g Firmware+34 more Nov 21, 2024 Jan 11, 2018 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-remotesubnet variable in the pptp_client.lua file.
CVE-2017-15629 1Tp Link 37Er5110g Firmware Er5120g FirmwareEr5510g Firmware+34 more Nov 21, 2024 Jan 11, 2018 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-tunnelname variable in the pptp_client.lua file.
CVE-2017-15628 1Tp Link 37Er5110g Firmware Er5120g FirmwareEr5510g Firmware+34 more Nov 21, 2024 Jan 11, 2018 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the lcpechointerval variable in the pptp_server.lua file.
CVE-2017-15627 1Tp Link 37Er5110g Firmware Er5120g FirmwareEr5510g Firmware+34 more Nov 21, 2024 Jan 11, 2018 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-pns variable in the pptp_client.lua file.
CVE-2017-15626 1Tp Link 37Er5110g Firmware Er5120g FirmwareEr5510g Firmware+34 more Nov 21, 2024 Jan 11, 2018 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-bindif variable in the pptp_server.lua file.
CVE-2017-15625 1Tp Link 37Er5110g Firmware Er5120g FirmwareEr5510g Firmware+34 more Nov 21, 2024 Jan 11, 2018 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-olmode variable in the pptp_client.lua file.
CVE-2017-15624 1Tp Link 37Er5110g Firmware Er5120g FirmwareEr5510g Firmware+34 more Nov 21, 2024 Jan 11, 2018 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-authtype variable in the pptp_server.lua file.
CVE-2017-15623 1Tp Link 37Er5110g Firmware Er5120g FirmwareEr5510g Firmware+34 more Nov 21, 2024 Jan 11, 2018 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-enable variable in the pptp_server.lua file.
CVE-2017-15622 1Tp Link 37Er5110g Firmware Er5120g FirmwareEr5510g Firmware+34 more Nov 21, 2024 Jan 11, 2018 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-mppeencryption variable in the pptp_client.lua file.

Previous 1...242526 27 28 Next