4366 matches found
CVE-2019-7438: Improper Neutralization of Input During Web Page Generation
cgi-bin/qcmapwebcgi on JioFi 4G M2S 1.0.2 devices has XSS and HTML injection via the mask POST parameter...
CVE-2019-7439: Undefined Security Weakness
cgi-bin/qcmapwebcgi on JioFi 4G M2S 1.0.2 devices allows a DoS Hang via the mask POST parameter...
PLC Wireless Router GPN2.4P21-C-CN Cross Site Request Forgery
Exploit Title: PLC Wireless Router GPN2.4P21-C-CN -Cross-Site Request Forgery CSRF Date: 14/01/2019 Exploit Author: Kumar Saurav Reference: https://0dayfindings.home.blog/2019/01/15/plc-wireless-router-gpn2-4p21-c-cn-cross-site-request-forgery-csrf/ Vendor: ChinaMobile Category: Hardware Version:...
CVE-2019-7440: Cross-Site Request Forgery (CSRF)
JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings aka a SetWiFiSetting request to cgi-bin/qcmapwebcgi...
PT-2019-18613
Name of the Vulnerable Software and Affected Versions JioFi 4G M2S version 1.0.2 Description The issue concerns a CSRF vulnerability that can be exploited via the SSID name and Security Key field under Edit Wi-Fi Settings. This is achieved through a SetWiFi Setting request to the "cgi-bin/qcmap w...
PT-2019-18612
Name of the Vulnerable Software and Affected Versions JioFi 4G M2S version 1.0.2 Description The issue affects the cgi-bin/qcmap web cgi endpoint on the device, allowing a denial of service DoS that causes the device to hang when the mask POST parameter is exploited. Recommendations For JioFi 4G...
PT-2019-18611
Name of the Vulnerable Software and Affected Versions JioFi 4G M2S version 1.0.2 Description The issue concerns the cgi-bin/qcmap web cgi endpoint on the affected device, where an attacker can exploit XSS and HTML injection vulnerabilities via the mask POST parameter. Recommendations For version...
CVE-2019-6282
ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have CSRF via the cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity URI, allowing an Attacker to change the Wireless Security Password...
PT-2019-18069
Name of the Vulnerable Software and Affected Versions ChinaMobile PLC Wireless Router GPN2.4P21-C-CN version W2001EN-00 Description The issue is related to an Incorrect Access Control problem. It can be exploited via the "cgi-bin/webproc?getpage=html/index.html&subpage=wlsecurity" URI, allowing a...
PT-2019-18070
Name of the Vulnerable Software and Affected Versions ChinaMobile PLC Wireless Router GPN2.4P21-C-CN version W2001EN-00 Description The issue allows an attacker to change the Wireless Security Password due to a CSRF vulnerability via the "cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity...
CVE-2019-6282: Cross-Site Request Forgery (CSRF)
ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have CSRF via the cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity URI, allowing an Attacker to change the Wireless Security Password...
CVE-2019-6279: Undefined Security Weakness
ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have an Incorrect Access Control vulnerability via the cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity URI, allowing an Attacker to change the Wireless Security Password...
CVE-2018-14575
Trash Bin plugin 1.1.3 for MyBB has cross-site scripting XSS via a thread subject and a cross-site request forgery CSRF via a post subject...
CVE-2018-14575
Trash Bin plugin 1.1.3 for MyBB has cross-site scripting XSS via a thread subject and a cross-site request forgery CSRF via a post subject...
CVE-2018-20212
CVE-2018-20212 affects TWiki 6.0.2, specifically the bin/statistics component, where the webs parameter enables cross-site scripting (XSS). The vulnerability is described as a parameter-based XSS in TWiki/bin/statistics, with CVSS vectors indicating network attack, low to moderate complexity, and...
PT-2019-18386
Name of the Vulnerable Software and Affected Versions AirTies Air5341 version 1.0.0.12 Description The issue allows for a CSRF attack on the cgi-bin/login endpoint. Recommendations For AirTies Air5341 version 1.0.0.12, consider implementing CSRF protection measures, such as token-based validation...
CVE-2019-6967: Cross-Site Request Forgery (CSRF)
AirTies Air5341 1.0.0.12 devices allow cgi-bin/login CSRF...
PT-2019-10017
Name of the Vulnerable Software and Affected Versions: TWiki version 6.0.2 Description: The issue allows cross-site scripting XSS via the webs parameter in the bin/statistics endpoint. Recommendations: For TWiki version 6.0.2, update to a version that fixes this issue to prevent cross-site...
CVE-2019-7385: Improper Neutralization of Special Elements used in an OS Command
An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware version ISCOMHT803G-U2.0.0140521R4.1.47.002 or below, The values of the newpass and confpass parameters in /bin/WebMGR are used in a syst...