CVE-2018-17989: Improper Neutralization of Input During Web Page Generation

A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to inject a JavaScript or HTML payload inside the ACL page. The injected payload would be executed in a user's browser when "/cgi-bin/NewGUI/Acl.asp" is request...

CVE-2019-10663

Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to conduct SQL injection attacks via the sord parameter in a listCodeblueGroup API call to the /cgi? URI...

Code injection

Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter to the /cgi? URI...

CVE-2019-10662

Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter to the /cgi? URI...

CVE-2019-10662: Improper Neutralization of Special Elements used in an OS Command

Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter to the /cgi? URI...

[SECURITY] Fedora 30 Update: php-7.3.3-1.fc30

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

CVE-2018-19879

An issue was discovered in /cgi-bin/luci on Teltonika RTU9XX e.g., RUT950 R31.04.89 before R00.05.00.5 devices. The authentication functionality is not protected from automated tools used to make login attempts to the application. An anonymous attacker has the ability to make unlimited login...

PT-2019-9941

Name of the Vulnerable Software and Affected Versions Teltonika RTU9XX e.g., RUT950 versions R 31.04.89 through R 00.05.00.4 Description The issue concerns the authentication functionality in the /cgi-bin/luci endpoint, which is not protected against automated login attempts. This allows an...

CVE-2018-19879: Improper Restriction of Excessive Authentication Attempts

An issue was discovered in /cgi-bin/luci on Teltonika RTU9XX e.g., RUT950 R31.04.89 before R00.05.00.5 devices. The authentication functionality is not protected from automated tools used to make login attempts to the application. An anonymous attacker has the ability to make unlimited login...

Cisco RV320 Unauthenticated Configuration Export Vulnerability

The configuration of a Cisco RV320 router can still be exported without authentication via the device's web interface due to an inadequate fix by the vendor. Cisco RV320 Unauthenticated Configuration Export Vulnerability Details ======= Product: Cisco RV320 Dual Gigabit WAN VPN Router, possibly...

CVE-2019-7440

JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings aka a SetWiFiSetting request to cgi-bin/qcmapwebcgi...

CVE-2019-7438

cgi-bin/qcmapwebcgi on JioFi 4G M2S 1.0.2 devices has XSS and HTML injection via the mask POST parameter...

CVE-2019-7439

cgi-bin/qcmapwebcgi on JioFi 4G M2S 1.0.2 devices allows a DoS Hang via the mask POST parameter...

CVE-2019-6967

AirTies Air5341 1.0.0.12 devices allow cgi-bin/login CSRF...

CVE-2019-6274

Directory traversal vulnerability in storagecgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to have unspecified impact via directory traversal sequences...

CVE-2019-6275

Command injection vulnerability in firmwarecgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code...

Cross site scripting

XSS exists in Ericsson Active Library Explorer ALEX 14.3 in multiple parameters in the "/cgi-bin/alexserv" servlet, as demonstrated by the DB, FN, fn, or id parameter...

Design/Logic Flaw

cgi-bin/qcmapwebcgi on JioFi 4G M2S 1.0.2 devices allows a DoS Hang via the mask POST parameter...

CVE-2018-19191

Webmin 1.890 has XSS via /config.cgi?webmin, the /shell/index.cgi history parameter, /shell/index.cgi?stripped=1, or the /webminlog/search.cgi uall or mall parameter...

CVE-2019-7440

Affected product: JioFi 4G M2S 1.0.2. Vulnerability: Cross-Site Request Forgery (CSRF) via the SSID name and Security Key field in Edit Wi‑Fi Settings (SetWiFi_Setting to cgi-bin/qcmap_web_cgi). Root cause: HTTP requests processed without proper validity checks enabling state-changing actions. Im...