12608 matches found
CVE-2021-3342: Improper Neutralization of Special Elements used in an OS Command
EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted LaTeX input to a cgi/latex2png?latex= URI...
CVE-2021-26475: Improper Neutralization of Input During Web Page Generation
EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI...
PT-2021-17021
Name of the Vulnerable Software and Affected Versions EPrints version 3.4.2 Description The issue exposes a reflected XSS opportunity via a cgi/cal URI. Recommendations For EPrints version 3.4.2, update to a newer version that contains a fix for this issue...
CVE-2021-26702: Improper Neutralization of Input During Web Page Generation
EPrints 3.4.2 exposes a reflected XSS opportunity in the dataset parameter to the cgi/datasetdictionary URI...
CVE-2021-26704: Improper Neutralization of Special Elements used in an OS Command
EPrints 3.4.2 allows remote attackers to execute arbitrary commands via crafted input to the verb parameter in a cgi/toolbox/toolbox URI...
PT-2021-17022
Name of the Vulnerable Software and Affected Versions EPrints version 3.4.2 Description The issue allows remote attackers to execute OS commands via crafted LaTeX input to a "cgi/cal?year=" URI. Recommendations For EPrints version 3.4.2, consider restricting access to the cgi/cal endpoint until a...
EPrints cross-site scripting vulnerabilities
EPrints is a free open source software package for building open access repositories compliant with the OAI-PMH protocol. A reflected cross-site scripting vulnerability exists in the year parameter of the cgi/cal URI in EPrints 3.4.2. No detailed vulnerability details are provided at this time...
EPrints security vulnerabilities
EPrints is a free open source software package for building open access repositories compliant with the OAI-PMH protocol. EPrints 3.4.2 suffers from a command injection vulnerability. A remote attacker can exploit this vulnerability by entering specially crafted data into cgi/cal?year= URI to...
D-Link DAP-2020 errorpage External Control of File Name Information Disclosure Vulnerability
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 Wi-Fi access points. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of CGI scripts. When parsing the...
D-Link DAP-2020 WEB_CmdFileList Command Injection Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 Wi-Fi access points. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of CGI scripts. The issue results from the...
D-Link DAP-2020 webproc getpage Stack-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 Wi-Fi access points. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of CGI scripts. When parsing the getpage...
Updated privoxy package fixes security vulnerabilities
Fixed a memory leak when decompression fails "unexpectedly". CVE-2021-20216 Prevent an assertion from getting triggered by a crafted CGI request. CVE-2021-20217...
CVE-2021-27403
Askey RTF8115VW BRSVg11.11RTFTEF001V6.54V014 devices allow cgi-bin/teaccesorouter.cgi curWebPage XSS...
CVE-2021-27403
Askey RTF8115VW BRSVg11.11RTFTEF001V6.54V014 devices allow cgi-bin/teaccesorouter.cgi curWebPage XSS...
CVE-2021-27403
Askey RTF8115VW BRSVg11.11RTFTEF001V6.54V014 devices allow cgi-bin/teaccesorouter.cgi curWebPage XSS...
CVE-2021-27403
CVE-2021-27403 affects Asus Askey routers: specifically the RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 family. The vulnerability is a cross-site scripting (XSS) in the web interface, exposed via cgi-bin/te_acceso_router.cgi with curWebPage context. Public descriptions consistently state that th...
CVE-2021-27403: Improper Neutralization of Input During Web Page Generation
Askey RTF8115VW BRSVg11.11RTFTEF001V6.54V014 devices allow cgi-bin/teaccesorouter.cgi curWebPage XSS...
PT-2021-17442
Name of the Vulnerable Software and Affected Versions Askey RTF8115VW BR SV g11.11 RTF TEF001 V6.54 V014 Description The issue concerns a XSS vulnerability in the "cgi-bin/te acceso router.cgi" endpoint, specifically with the curWebPage parameter. This allows for potential exploitation...
Webmin < 1.970 Multiple Vulnerabilities
According to its self-reported version, the version of Webmin running on the remote host may be affected by multiple vulnerabilities, including the following: - Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary...