Cellinx NVT Web Server Access Control Error Vulnerability

Cellinx NVT Web Server is a web platform for virtual terminal management NVT from Cellinx, Korea. The platform is mainly used for managing video surveillance devices, and it is divided into monitoring page and setting page to control terminals. An access control error vulnerability exists in...

CVE-2020-25849

MailGates and MailAudit products contain Command Injection flaw, which can be used to inject and execute system commands from the cgi parameter after attackers obtain the user’s access token...

CVE-2020-25849: Improper Neutralization of Special Elements used in an OS Command

MailGates and MailAudit products contain Command Injection flaw, which can be used to inject and execute system commands from the cgi parameter after attackers obtain the user’s access token...

PT-2020-16244

Name of the Vulnerable Software and Affected Versions MailGates and MailAudit products affected versions not specified Description The issue allows attackers to inject and execute system commands from the cgi parameter after obtaining the user's access token. This can be used to exploit the syste...

CVE-2020-8263

A vulnerability in the authenticated user web interface of Pulse Connect Secure 9.1R9 could allow attackers to conduct Cross-Site Scripting XSS through the CGI file...

CVE-2020-8263

A vulnerability in the authenticated user web interface of Pulse Connect Secure 9.1R9 could allow attackers to conduct Cross-Site Scripting XSS through the CGI file...

CVE-2020-8263

A vulnerability in the authenticated user web interface of Pulse Connect Secure 9.1R9 could allow attackers to conduct Cross-Site Scripting XSS through the CGI file...

Western Digital My Cloud NAS Elevation of Privilege Vulnerability

Western Digital My Cloud is a personal cloud storage device from Western Digital. An elevation of privilege vulnerability exists in Western Digital My Cloud NAS versions prior to 5.04.114, which stems from a remote code execution vulnerability in cgi api.php that allows privilege escalation. No...

CVE-2020-8263: Improper Neutralization of Input During Web Page Generation

A vulnerability in the authenticated user web interface of Pulse Connect Secure 9.1R9 could allow attackers to conduct Cross-Site Scripting XSS through the CGI file...

PT-2020-20070

Name of the Vulnerable Software and Affected Versions Pulse Connect Secure versions prior to 9.1R9 Description A vulnerability in the authenticated user web interface could allow attackers to conduct Cross-Site Scripting XSS through the CGI file. Recommendations For versions prior to 9.1R9, updat...

CVE-2020-27158

Addressed remote code execution vulnerability in cgiapi.php that allowed escalation of privileges in Western Digital My Cloud NAS devices prior to 5.04.114...

PT-2020-4930

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud NAS devices versions prior to 5.04.114 Description: The issue is related to a remote code execution vulnerability in the cgi api.php component of Western Digital My Cloud NAS devices. This vulnerability is associated...

Scientific Linux Security Update : httpd on SL7.x x86_64 (20201001)

Security Fixes : - httpd: Improper handling of headers in modsession can allow a remote user to modify session data for CGI applications CVE-2018-1283 - httpd: Out of bounds read in modcachesocache can allow a remote attacker to cause DoS CVE-2018-1303 - httpd: modrewrite configurations vulnerabl...

Debian DSA-4773-1 : yaws - security update

Two vulnerabilities were discovered in yaws, a high performance HTTP 1.1 webserver written in Erlang. - CVE-2020-24379 The WebDAV implementation is prone to a XML External Entity XXE injection vulnerability. - CVE-2020-24916 The CGI implementation does not properly sanitize CGI requests allowing ...

[SECURITY] [DSA 4773-1] yaws security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4773-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 16, 2020 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4773-1] yaws security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4773-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 16, 2020 https://www.debian.org/security/faq -...

PT-2020-5928

Name of the Vulnerable Software and Affected Versions: QNAP QTS affected versions not specified Description: The issue is related to insufficient protection of service data in the QNAP QTS web server for network storage devices. It allows a remote attacker to execute arbitrary code using CGI file...

Authentication flaw

An issue was discovered on D-Link DSR-250N before 3.17B devices. The CGI script upgradeStatusReboot.cgi can be accessed without authentication. Any access reboots the device, rendering it therefore unusable for several minutes...

CVE-2020-26567

The CVE-2020-26567 issue affects D-Link DSR-250N devices (prior to version 3.17B). The CGI script upgradeStatusReboot.cgi can be accessed without authentication, and any access reboots the device, causing a DoS for several minutes. Publicly documented details come from multiple sources (Red Hat a...

PT-2020-16460 · D Link · Dsr-250N

Name of the Vulnerable Software and Affected Versions: D-Link DSR-250N versions prior to 3.17B Description: An issue was discovered where the CGI script upgradeStatusReboot.cgi can be accessed without authentication. Any access to this script reboots the device, rendering it unusable for several...