Incorrect Control over DrayTek Vigor Router

Overview :
On DrayTek Vigor2925 devices with firmware 3.8.4.3, Incorrect Access Control exists in loginset.htm, and can be used to trigger XSS. NOTE: this is an end-of-life product.

On DrayTek Vigor2925 devices with firmware 3.8.4.3, XSS exists via a crafted WAN name on the General Setup screen. NOTE: this is an end-of-life product.

Affected Product(s) :
  • DrayTek Vigor2925 devices with firmware 3.8.4.3
Vulnerability Details :
CVE ID : CVE-2019-16533
Incorrect Access Control exists in loginset.htm
CVE ID : CVE-2019-16534
XSS exists via a crafted WAN name on the General Setup screen

Solution : update to the latest version

Common Vulnerabilityies and Exposures

Contact us to get started

CVE-2022-32532 : APACHE SHIRO UP TO 1.9.0 REGEXREQUESTMATCHER AUTHORIZATION

CVE-2022-32532 : APACHE SHIRO UP TO 1.9.0 REGEXREQUESTMATCHER AUTHORIZATION

Description Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher

CVE-2022-31104 : WASMTIME CALCULATION

CVE-2022-31104 : WASMTIME CALCULATION

Description Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime’s implementation of the SIMD proposal for WebAssembly on

CVE-2022-33146 : WEB2PY UP TO 2.22.4 URL REDIRECT

CVE-2022-33146 : WEB2PY UP TO 2.22.4 URL REDIRECT

Description Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an