12680 matches found
Buffer overflow
An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. In a CGI program running under the HTTPD web server, a buffer overflow in the param parameter leads to remote code execution in the context of the nobody account...
CVE-2019-14698
MicroDigital N-series cameras (firmware up to 6400.0.8.5) expose a vulnerability in a CGI program running under the HTTPD web server. A buffer overflow in the param parameter allows remote code execution in the nobody context. This is a server-side flaw in the CGI component and is stated as enabl...
CVE-2016-10795
cPanel before 59.9999.145 allows stored XSS in the WHM tailupcp2.cgi interface SEC-156...
CVE-2016-10795
cPanel before 59.9999.145 allows stored XSS in the WHM tailupcp2.cgi interface SEC-156...
CVE-2016-10795
cPanel before 59.9999.145 allows stored XSS in the WHM tailupcp2.cgi interface SEC-156...
CVE-2016-10795
The CVE-2016-10795 entry affects cPanel/WHM, where a stored XSS vulnerability exists in the WHM tail_upcp2.cgi interface. Affected versions are prior to 59.9999.145. The issue stems from insufficient validation of client-side data in the web application, enabling an attacker to execute client-sid...
PT-2019-7591
Name of the Vulnerable Software and Affected Versions cPanel versions prior to 59.9999.145 Description The issue allows for stored XSS in the WHM tail upcp2.cgi interface. Recommendations For versions prior to 59.9999.145, update to version 59.9999.145 or later to resolve the issue...
CVE-2016-10795: Improper Neutralization of Input During Web Page Generation
cPanel before 59.9999.145 allows stored XSS in the WHM tailupcp2.cgi interface SEC-156...
CVE-2016-10769
cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi SEC-162...
PT-2019-7565
Name of the Vulnerable Software and Affected Versions cPanel versions prior to 60.0.25 Description The issue allows an open redirect via the /cgi-sys/FormMail-clone.cgi API endpoint. Recommendations For versions prior to 60.0.25, update to version 60.0.25 or later to resolve the issue. As a...
PT-2019-10345
Name of the Vulnerable Software and Affected Versions: cPanel versions prior to 70.0.23 Description: The issue allows attackers to read the root accesshash. This can be achieved via the WHM /cgi/trustclustermaster.cgi endpoint. Recommendations: For versions prior to 70.0.23, update to version...
CVE-2018-20913: Exposure of Sensitive Information to an Unauthorized Actor
cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi SEC-364...
Xymon 4.3.25 - useradm Command Execution Exploit
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Xymon useradm Command Execution', 'Description' = %q This module exploits a command injection vulnerability in Xymon versions before 4.3.25 which...
Xymon useradm Command Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Xymon useradm Command Execution', 'Description' = %q This module exploits a command injection vulnerability in Xymon versions before 4.3.25 which...
Dynacolor FCM-MB40 Cross-Site Request Forgery Vulnerability
Dynacolor FCM-MB40 is an IP camera from Dynacolor, Taiwan, China. A cross-site request forgery vulnerability exists in scripts under cgi-bin/ in the Dynacolor FCM-MB40 v1.2.0.0, which arises from a network system or product that does not adequately verify the origin or authenticity of data, and c...
CVE-2019-13401
Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...
CVE-2019-13401
Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...
CVE-2019-13398
Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrlsaveprofile.cgi save parameter and cgi-bin/ddns.cgi...
CVE-2019-13398
Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrlsaveprofile.cgi save parameter and cgi-bin/ddns.cgi...