lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAEsPrH0m3y=6pZNBM1TXRL76LPrYu6qqbYcMP-d4U=wyoYkRNg@mail.gmail.com> Date: Mon, 27 Mar 2017 20:09:24 +1100 From: Luke Symons <rezkon93@...il.com> To: fulldisclosure@...lists.org Subject: [FD] CVE-2017-5900 Hi, Mitre has provided the following with the CVE number: CVE-2017-5900 there is a Stored XSS vulnerability in a NetComm router's model NB16WV-02 running version NB16WV_R0.09, If authorized user is able to inject the following string POC: Authenticated user is required: http://<router_IP>/hdd.htm?rc=&S801F0334=/dkmvc%3C/script %3E%3Cscript%3Ealert%28String.fromCharCode%28101,90,101,90%29 %29%3C/script%3Ed29f Stored XSS will be injected and execute on the page reload. This vulnearbilty can be used to steal session, cookies and many more. NetComm will be releasing a patch in the coming weeks to address this issue. _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists