CVE-2016-3904

A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected function is vlan_load_form_uci in /usr/bin/routerd, where manipulation of the wan_num argument leads to buffer overflow. The attack can be initiated remotely and the exploit is publicly disclosed.

A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. The affected function is wan_config_set_vlan in /usr/bin/routerd, where manipulation of the vlan_wanX.ports argument leads to buffer overflow. The attack can be performed remotely and the exploit is publicly available.

A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. The issue affects the restore.cgi file in the Backup Restore component, where manipulation of the QUERY_STRING argument results in command injection. The attack can be carried out remotely and the exploit is publicly released.

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. The vulnerability affects the /www/cgi-bin/upgrade file in the Firmware Upgrade CGI Endpoint component, where manipulation of the QUERY_STRING argument leads to command injection. The attack can be executed remotely and the exploit is publicly available.

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. The vulnerability affects the /www/cgi-bin/network_tools file in the CGI Diagnostic Endpoint component, where manipulation of the param/key/val arguments causes command injection. Remote exploitation is possible and the exploit has been publicly disclosed.

A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. The vulnerability affects the /usr/bin/network_tools file in the LAN IP Configuration Handler component, where manipulation of the ipv4 argument results in command injection. The attack may be launched remotely and the exploit has been made public.

A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. The vulnerability affects the /usr/bin/network_tools file in the Traceroute Diagnostic Feature component, where manipulation of the url argument leads to command injection. The attack may be initiated remotely and the exploit has been disclosed publicly.

A vulnerability was found in D-Link DIR-868L 2.01b05 in the strcpy function of the file /webfa_authentication.cgi in the Authentication Handler component. Manipulating the id/password arguments leads to a stack-based buffer overflow. The attack can be executed remotely, and the exploit has been publicly disclosed.

In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an authenticated privileged remote code execution vulnerability was found. The saveWatermark() function copies an uploaded file to a web-accessible directory using the client-supplied filename exactly as sent, with no extension check, content check, or filename sanitization. An authenticated core.manage user could upload a .php file disguised with an image Content-Type header and execute it directly by requesting the resulting path.

In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an authenticated privileged remote code execution vulnerability was found. The updateOSGallery() function, reached via task=update_osgallery, reads a JSON request body and calls the value of a method field as a live PHP function, passing the value of a package field as its single argument, with no allow-list or is_callable() check. Any function name compatible with a single argument is directly reachable, including system, exec, shell_exec, and passthru.