cnvd-2018-09302

fkie_cve-2018-10165

GHSA-3pm5-qmcr-c546

VAR-201805-0359

Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows allows authenticated attackers to inject arbitrary web script or HTML via the userName parameter in the local user creation functionality. This is fixed in version 2.6.1_Windows. TP-Link EAP Controller and Omada Controller Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. A privilege-escalation vulnerability 2. A hard-coded cryptographic key vulnerability 3. A cross-site request-forgery vulnerability 4. Multiple HTML-injection vulnerability An attacker may leverage these issues to gain elevated privileges, perform unauthorized actions and gain access to the affected application, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. **Advisory Information**

Title: TP-Link EAP Controller Multiple Vulnerabilities Advisory ID: CORE-2018-0001 Advisory URL: http://www.coresecurity.com/advisories/tp-link-eap-controller-multiple-vulnerabilities Date published: 2018-05-03 Date of last update: 2018-04-17 Vendors contacted: TP-Link Release mode: Coordinated release

2. **Vulnerability Information**

Class: Improper Privilege Management [CWE-269], Use of Hard-coded Cryptographic Key [CWE-321], Cross-Site Request Forgery [CWE-352], Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') [CWE-79], Improper Neutraliz…

Most recent entries from all

cnvd-2018-09302

fkie_cve-2018-10165

GHSA-3pm5-qmcr-c546

gsd-2018-10165

VAR-201805-0359