CVE-2019-9949

Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmware 2.31.183 are affected by a code execution as root, starting from a low-privilege user session vulnerability. The cgi-bin/webfilemgr.cgi file allows arbitrary file write by...

PT-2019-19953

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 versions prior to 2.31.183 Description The issue allows for code execution as root, starting from a low-privilege user session. This occu...

Code Execution Vulnerability in Multiple Western Digital Products

Western Digital My Cloud Mirror Gen2 is a personal cloud storage device.Western Digital My Cloud EX2 Ultra is a personal cloud storage device.Western Digital My Cloud EX2 Ultra is a personal cloud storage device.Western Digital My Cloud EX2100 is a personal cloud storage device.Western Digital My...

CVE-2019-9949: Improper Link Resolution Before File Access

Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmware 2.31.183 are affected by a code execution as root, starting from a low-privilege user session vulnerability. The cgi-bin/webfilemgr.cgi file allows arbitrary file write by...

EulerOS Virtualization 3.0.1.0 : php (EulerOS-SA-2019-1544)

According to the versions of the php packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An integer underflow flaw leading to out-of-bounds memory access was found in the way PHP's Phar extension parsed Phar archives. A...

Apache Tomcat 9.0.x < 9.0.5 Insecure CGI Servlet Search Algorithm Description Weakness

Binary data 700705.pasl...

Apache Tomcat 9.0.x < 9.0.2 Insecure CGI Servlet Search Algorithm Description Weakness

Binary data 700704.pasl...

Apache Tomcat 8.5.x < 8.5.24 Insecure CGI Servlet Search Algorithm Description Weakness

Binary data 700692.pasl...

Apache Tomcat 8.0.45 < 8.0.48 Insecure CGI Servlet Search Algorithm Description Weakness

Binary data 700686.pasl...

Apache Tomcat 7.0.x < 7.0.84 Insecure CGI Servlet Search Algorithm Description Weakness

Binary data 700676.pasl...

[SECURITY] Fedora 28 Update: php-7.2.18-1.fc28

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

PT-2019-5518

Name of the Vulnerable Software and Affected Versions OpenWRT firmware version 18.06.4 Description The issue exists due to incorrect functionality of the web page structure protection mechanism in the LuCI web interface configuration of the OpenWRT embedded operating system. This can be exploited...

Cross site request forgery (csrf)

JioFi 4 jmr1140 AmtelJMR1140R12.07 devices allow remote attackers to obtain an admin token by making a /cgi-bin/qcmapauth type=getuser request and then reading the token field. This token value can then be used to change the Wi-Fi password or perform a factory reset...

Cross site scripting

cgi-bin/qcmapwebcgi on JioFi 4 jmr1140 AmtelJMR1140R12.07 devices has POST based reflected XSS via the Page parameter. No sanitization is performed for user input data...

PT-2019-18739

Name of the Vulnerable Software and Affected Versions JioFi 4 jmr1140 Amtel JMR1140 R12.07 Description The issue allows remote attackers to obtain the Wi-Fi password by making a "cgi-bin/qcmap web cgi Page=GetWiFi Setting" request and then reading the wpa security key field. Recommendations For...

CVE-2019-7745: Undefined Security Weakness

JioFi 4 jmr1140 AmtelJMR1140R12.07 devices allow remote attackers to obtain the Wi-Fi password by making a cgi-bin/qcmapwebcgi Page=GetWiFiSetting request and then reading the wpasecuritykey field...

PT-2019-18740

Name of the Vulnerable Software and Affected Versions JioFi 4 jmr1140 Amtel JMR1140 R12.07 Description The issue allows remote attackers to obtain an admin token by making a "/cgi-bin/qcmap auth" type=getuser request and then reading the token field. This token value can then be used to change th...

CVE-2019-7687: Improper Neutralization of Input During Web Page Generation

cgi-bin/qcmapwebcgi on JioFi 4 jmr1140 AmtelJMR1140R12.07 devices has POST based reflected XSS via the Page parameter. No sanitization is performed for user input data...

PT-2019-18703

Name of the Vulnerable Software and Affected Versions JioFi 4 jmr1140 Amtel JMR1140 R12.07 Description The issue concerns a reflected XSS vulnerability. It occurs via the Page parameter in the cgi-bin/qcmap web cgi endpoint. The problem arises because no sanitization is performed on user input...

CVE-2019-7746: Cross-Site Request Forgery (CSRF)

JioFi 4 jmr1140 AmtelJMR1140R12.07 devices allow remote attackers to obtain an admin token by making a /cgi-bin/qcmapauth type=getuser request and then reading the token field. This token value can then be used to change the Wi-Fi password or perform a factory reset...