12557 matches found
PT-2020-13053
Name of the Vulnerable Software and Affected Versions WAVLINK WN530H4 M30H4.V5030.190403 Description The issue allows an attacker to leak router settings, including cleartext login details, DNS settings, and other sensitive information without authentication through the "API Endpoint:...
PT-2020-13051
Name of the Vulnerable Software and Affected Versions WAVLINK WN530H4 M30H4.V5030.190403 Description A remote buffer overflow issue exists in the "/cgi-bin/makeRequest.cgi" API endpoint, allowing an attacker to execute arbitrary machine instructions as root without authentication. Recommendations...
PT-2020-13050
Name of the Vulnerable Software and Affected Versions WAVLINK WN530H4 M30H4.V5030.190403 Description A remote command-line injection issue exists in the "/cgi-bin/live api.cgi" API endpoint, allowing an attacker to execute arbitrary Linux commands as root without authentication. Recommendations F...
PT-2020-13049
Name of the Vulnerable Software and Affected Versions WAVLINK WN530H4 M30H4.V5030.190403 Description The issue allows an attacker to remotely access router endpoints due to the lack of CSRF tokens in the /cgi-bin/ directory. This can be exploited if a user is authenticated in the router portal...
CVE-2020-12126: Improper Authentication
Multiple authentication bypass vulnerabilities in the /cgi-bin/ endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allow an attacker to leak router settings, change configuration variables, and cause denial of service via an unauthenticated endpoint...
movietok.kr Cross Site Scripting vulnerability OBB-1375189
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
A possible interaction between Apple MacOS X release 1.0 and Apache HTTP server allows remote attackers to cause a denial of service (crash) via a flood of HTTP GET requests to CGI programs which generates a large number of processes.
...
ScriptAlias directory in NCSA and Apache httpd allowed attackers to read CGI programs.
...
UBUNTU-CVE-2020-24916
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection...
Command injection
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection...
CVE-2020-24916
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection...
CVE-2020-24916
CVE-2020-24916 affects the Yaws web server CGI implementation, with versions 1.81–2.0.7 vulnerable. The root cause is that CGI requests are not properly sanitized, enabling a remote attacker to execute arbitrary shell commands by crafting CGI executable names. This is a remote, unauthenticated co...
CVE-2020-24916
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection...
CVE-2020-24916
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection...
CVE-2020-24916: Improper Neutralization of Special Elements used in an OS Command
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection...
AZL-79064 CVE-2020-24553 affecting package golang 1.25.7-1
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header...
AZL-98880 CVE-2020-24553 affecting package golang 1.27.1-1
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header...
CVE-2020-24553
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header...