ZYXEL NSA310 FIRMWARE 4.40 UPDATE
ZYXEL NSA310 FIRMWARE 4.40 FULL
ZYXEL NSA310 FIRMWARE 4.40 CODE
ZYXEL NSA310 FIRMWARE 4.40 PASSWORD

This vulnerability exists in the web interface '/cgi-bin/New_GUI/Igmp.asp'. Telegram Web K Alpha before 0.7.2 mishandles the characters in a document extension.Д-Link DSL-3782 EU v1.01:EU v1.03 is affected by a buffer overflow which can cause a denial of service.

ZYXEL NSA310 FIRMWARE 4.40 CODE

Neither the content nor extension of the uploaded files is checked, allowing execution of PHP code under the /cmd directory.

The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at php/index.php.

ZYXEL NSA310 FIRMWARE 4.40 UPDATE

Users are advised to update to version 11.16.0. Although we know of no known CSRF exploits that have happened in the wild, this vulnerability has been confirmed by our testing, and by a third party. This CSRF vulnerability in Dada Mail affects all versions of Dada Mail v11.15.1 and below. For this vulnerability to work, the target of the bad actor would need to be logged into the list control panel themselves. This vulnerability also affects profile logins.

ZYXEL NSA310 FIRMWARE 4.40 PASSWORD

This includes changing any mailing list password, as well as the Dada Mail Root Password - which could effectively shut out actual list owners of the mailing list and allow the bad actor complete and unfettered control of your mailing list. In affected versions a bad actor could give someone a carefully crafted web page via email, SMS, etc, that - when visited, allows them control of the list control panel as if the bad actor was logged in themselves. Users are advised to update to version 4.9.11 to resolve.Дada Mail is a web-based e-mail list management system. This is because a part of the clipboard content is directly written to `innerHTML` allowing for javascript injection and thus XSS. jsuites is vulnerable to DOM based XSS if the user can be tricked into copying _anything_ from a malicious and pasting it into the html editor. In affected versions users are subject to cross site scripting (XSS) attacks via clipboard content. Jsuites is an open source collection of common required javascript web components. The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or pkg/prog/web, depending on the exact version). All Elvish releases from 0.14.0 onward no longer include the the web UI, although it is still possible for the user to build a version from source that includes the web UI. As a result, if the user has the web UI backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in localhost. The backend does not check the origin of requests correctly. In versions prior to 0.14.0 Elvish's web UI backend (started by `elvish -web`) hosts an endpoint that allows executing the code sent from the web UI.

ZYXEL NSA310 FIRMWARE 4.40 FULL

This leads to admin session crafting and therefore gaining full web UI admin privileges by an unauthenticated attacker. Certain NETGEAR smart switches are affected by a injection in the web UI's password field, which - due to several faulty aspects of the authentication scheme - allows the attacker to create (or overwrite) a file with specific content (e.g., the '2' string).

Zyxel nsa310 firmware 4.40