12606 matches found
CVE-2018-20577
Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe, cgi-bin/firewallSPI.exe, cgi-bin/setupremotemgmt.exe, cgi-bin/setuppass.exe, and cgi-bin/upgradep.exe CSRF. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T...
CVE-2018-20577
Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe, cgi-bin/firewallSPI.exe, cgi-bin/setupremotemgmt.exe, cgi-bin/setuppass.exe, and cgi-bin/upgradep.exe CSRF. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T...
CVE-2018-20577
CVE-2018-20577 affects Orange Livebox 00.96.320S devices. The vulnerability is described as CSRF allowing forged requests via endpoints: /cgi-bin/restore.exe, /cgi-bin/firewall_SPI.exe, /cgi-bin/setup_remote_mgmt.exe, /cgi-bin/setup_pass.exe, and /cgi-bin/upgradep.exe. The associated hardware/fir...
CVE-2018-20577
Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe, cgi-bin/firewallSPI.exe, cgi-bin/setupremotemgmt.exe, cgi-bin/setuppass.exe, and cgi-bin/upgradep.exe CSRF. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T...
PT-2018-15446
Name of the Vulnerable Software and Affected Versions Orange Livebox 00.96.320S devices affected versions not specified Description The issue allows for CSRF attacks through cgi-bin/autodialing.exe and cgi-bin/phone test.exe, leading to arbitrary outbound telephone calls to an attacker-specified...
PT-2018-15447
Name of the Vulnerable Software and Affected Versions Orange Livebox 00.96.320S devices Description The issue is related to several CGI binaries, including cgi-bin/restore.exe, cgi-bin/firewall SPI.exe, cgi-bin/setup remote mgmt.exe, cgi-bin/setup pass.exe, and cgi-bin/upgradep.exe, which are...
CVE-2018-20576: Cross-Site Request Forgery (CSRF)
Orange Livebox 00.96.320S devices allow cgi-bin/autodialing.exe and cgi-bin/phonetest.exe CSRF, leading to arbitrary outbound telephone calls to an attacker-specified telephone number. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan...
CVE-2018-20577: Cross-Site Request Forgery (CSRF)
Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe, cgi-bin/firewallSPI.exe, cgi-bin/setupremotemgmt.exe, cgi-bin/setuppass.exe, and cgi-bin/upgradep.exe CSRF. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T...
PT-2018-15325
Name of the Vulnerable Software and Affected Versions Barracuda Message Archiver version 2018 Description The issue concerns an XSS vulnerability in the error msg exception-handling value for the ldap user parameter to the cgi-mod/ldap load entry.cgi module. The injection point of the issue is th...
CVE-2018-20369: Improper Neutralization of Input During Web Page Generation
Barracuda Message Archiver 2018 has XSS in the errormsg exception-handling value for the ldapuser parameter to the cgi-mod/ldaploadentry.cgi module. The injection point of the issue is the AddUpdate module...
TRENDnet TEW-673GRU Command Injection Vulnerability
The TRENDnet TEW-673GRU is a dual-band green router. A command injection vulnerability exists in the TRENDnet TEW-673GRU. This allows remote attackers to inject commands via a POST request passed to the . .cgi binary file with three parameters dhcpdstart, dhcpdend, and lanipaddr to execute...
[SECURITY] Fedora 28 Update: php-7.2.13-2.fc28
PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...
Perl Modules Detection (Linux/Unix SSH Login)
SSH login-based detection of various installed Perl modules. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...
FutureNet NXR-G240 Series ShellShock Command Injection
-- coding: utf-8 -- Title: FutureNet NXR-G240 Series - "ShellShock" Remote Command Injection Date: 2018-06-12 Author: Nassim Asrir You have a Q ? Contact me at: https://www.linkedin.com/in/nassim-asrir-b73a57122/ Vendor: http://www.centurysys.co.jp/ CVE: CVE-2014-6271 Greetz to : Nadia BENCHIKHA...
ASUSTOR ADM OS Command Injection Vulnerability (CNVD-2018-26927)
ASUSTOR ADM is an operating system from ASUSTOR dedicated to ASUSTOR NAS storage devices. An operating system command injection vulnerability exists in the user.cgi file in ASUSTOR ADM version 3.1.1, which can be exploited to execute system commands with the help of the 'name' POST parameter...
OpenWrt and LEDE Cross-Site Scripting Vulnerabilities
Both OpenWrt and LEDE are Linux operating systems for embedded devices. The systems are capable of providing fully writable file systems and package management. A cross-site scripting vulnerability exists in the 'cgihandlerequest' function in OpenWrt versions 18.06.1 and earlier and LEDE versions...
CVE-2018-19646
The Python CGI scripts in PWS in Imperva SecureSphere 13.0.10, 13.1.10, and 13.2.10 allow remote attackers to execute arbitrary OS commands because command-line arguments are mishandled...
Design/Logic Flaw
The Python CGI scripts in PWS in Imperva SecureSphere 13.0.10, 13.1.10, and 13.2.10 allow remote attackers to execute arbitrary OS commands because command-line arguments are mishandled...
CVE-2018-19646
CVE-2018-19646 affects Imperva SecureSphere Personal Web Server (PWS) CGI scripts. Vulnerable component: Python CGI scripts in PWS versions 13.0.10, 13.1.10, and 13.2.10. Root cause: command-line arguments are mishandled, allowing remote attackers to execute arbitrary OS commands. Impact: high se...