12556 matches found
VulnCheck KEV: CVE-2014-9727
AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter to cgi-bin/webcm...
PT-2020-12458
Name of the Vulnerable Software and Affected Versions Wavlink WN530HG4 Wavlink WN531G3 Wavlink WN533A8 Wavlink WN551K1 Wavlink WL-WN530HG4 version M30HG4.V5030.191116 Description An issue was discovered affecting the /cgi-bin/ExportAllSettings.sh endpoint, where a crafted POST request can return...
D-Link DSL-2640B B2 Authorization Issue Missing
The D-Link DSL-2640B B2 is a wireless router from AUO D-Link of Taiwan, China. A security vulnerability exists in the D-Link DSL-2640B B2 EU4.01B version. An attacker can exploit this vulnerability by accessing the cgi module to bypass authentication and perform administrative operations e.g.,...
P5 FNIP-8x16A/FNIP-4xSH CSRF Stored Cross-Site Scripting
Summary The FNIP-8x16A is an eight channel relay module used for switching any type of load that doesn’t exceed the specifications. Via its built-in web site and TCP/IP communication, the outputs and inputs can be controlled and monitored from standard network capable devices such as computers,...
IQrouter 3.3.1 Firmware - Remote Code Execution
Exploit Title: IQrouter 3.3.1 Firmware - Remote Code Execution Date: 2020-04-21 Exploit Author: drakylar Vendor Homepage: https://evenroute.com/ Software Link: https://evenroute.com/iqrouter Version: IQrouter firmware up to 3.3.1 Tested on: IQrouter firmware 3.3.1 CVE : N/A !/usr/bin/env python3...
CVE-2020-9277
An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administrative tasks e.g., modify the admin password with no authentication...
CVE-2020-9276
An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. The function docgi, which processes cgi requests supplied to the device's web servers, is vulnerable to a remotely exploitable stack-based buffer overflow. Unauthenticated exploitation is possible by combining this vulnerability with...
CVE-2020-9276
An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. The function docgi, which processes cgi requests supplied to the device's web servers, is vulnerable to a remotely exploitable stack-based buffer overflow. Unauthenticated exploitation is possible by combining this vulnerability with...
CVE-2020-9277
An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administrative tasks e.g., modify the admin password with no authentication...
Authentication flaw
An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administrative tasks e.g., modify the admin password with no authentication...
CVE-2020-9277
The CVE-2020-9277 entry concerns D-Link DSL-2640B B2 EU_4.01B devices, where authentication can be bypassed when accessing CGI modules, enabling an attacker to perform administrative tasks (e.g., changing the admin password) with no authentication. The vulnerability stems from the CGI handling on...
CVE-2020-9277
An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administrative tasks e.g., modify the admin password with no authentication...
Security Bulletin: A Security vulnerability in Apache Tomcat used by Rational Build Forge (CVE-2017-15706)
Summary There is a potential security vulnerability in the Apache Tomcat used by Rational Build Forge. Vulnerability Details CVEID: CVE-2017-15706 DESCRIPTION: Apache Tomcat could provide weaker than expected security, caused by the incorrect documentation of the CGI search algorithm used by the...
CVE-2020-9277: Improper Authentication
An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administrative tasks e.g., modify the admin password with no authentication...
CVE-2020-5738: Improper Link Resolution Before File Access
Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/uploadvpntar interface...
PT-2020-18660
Name of the Vulnerable Software and Affected Versions Grandstream GXP1600 series firmware versions 1.0.4.152 and below Description The issue allows for authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/upload vpntar interface...
CVE-2020-11734
cgi-bin/go in CyberSolutions CyberMail 5 or later allows XSS via the ACTION parameter...
CVE-2020-11734
cgi-bin/go in CyberSolutions CyberMail 5 or later allows XSS via the ACTION parameter...