OpenWrt 18.06.0

CPE Details

OpenWrt 18.06.0
18.06.0
2018-12-20
14h44 +00:00
2023-05-24
13h09 +00:00
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:o:openwrt:openwrt:18.06.0:*:*:*:*:*:*:*

Informations

Vendor

openwrt

Product

openwrt

Version

18.06.0

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2022-38333 2022-09-19 14h13 +00:00 Openwrt before v21.02.3 and Openwrt v22.03.0-rc6 were discovered to contain two skip loops in the function header_value(). This vulnerability allows attackers to access sensitive information via a crafted HTTP request.
7.5
High
CVE-2019-25015 2021-01-21 19h08 +00:00 LuCI in OpenWrt 18.06.0 through 18.06.4 allows stored XSS via a crafted SSID.
5.4
Medium
CVE-2020-28951 2020-11-19 18h01 +00:00 libuci in OpenWrt before 18.06.9 and 19.x before 19.07.5 may encounter a use after free when using malicious package names. This is related to uci_parse_package in file.c and uci_strdup in util.c.
9.8
Critical
CVE-2020-7982 2020-03-16 20h05 +00:00 An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7. A bug in the fork of the opkg package manager before 2020-01-25 prevents correct parsing of embedded checksums in the signed repository index, allowing a man-in-the-middle attacker to inject arbitrary package payloads (which are installed without verification).
8.1
High
CVE-2020-7248 2020-03-16 19h49 +00:00 libubox in OpenWrt before 18.06.7 and 19.x before 19.07.1 has a tagged binary data JSON serialization vulnerability that may cause a stack based buffer overflow.
7.5
High
CVE-2019-19945 2020-03-16 16h17 +00:00 uhttpd in OpenWrt through 18.06.5 and 19.x through 19.07.0-rc2 has an integer signedness error. This leads to out-of-bounds access to a heap buffer and a subsequent crash. It can be triggered with an HTTP POST request to a CGI script, specifying both "Transfer-Encoding: chunked" and a large negative Content-Length value.
7.5
High
CVE-2018-19630 2018-11-28 09h00 +00:00 cgi_handle_request in uhttpd in OpenWrt through 18.06.1 and LEDE through 17.01 has unauthenticated reflected XSS via the URI, as demonstrated by a cgi-bin/?[XSS] URI.
6.1
Medium