PT-2017-11951

Name of the Vulnerable Software and Affected Versions Axesstel MU553S MU55XS-V1.14 Description A Cross-Site Request Forgery CSRF issue exists in the cgi-bin/ConfigSet endpoint. This allows for potential unauthorized actions on affected devices. Recommendations For Axesstel MU553S MU55XS-V1.14,...

EMC CMCNE 11.2.1 - FileUploadController Remote Code Execution (Metasploit)

require 'msf/core' class MetasploitModule 'EMC CMCNE FileUploadController Remote Code Execution', 'Description' = %q This module exploits a fileupload vulnerability found in EMC Connectrix Manager Converged Network Edition MSFLICENSE, 'Author' = 'james fitts' , 'References' = 'ZDI', '13-279' ,...

CVE-2017-11350: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF exists in cgi-bin/ConfigSet on Axesstel MU553S MU55XS-V1.14 devices...

Trend Micro Control Manager - ImportFile Directory Traversal RCE Exploit

Exploit for windows platform in category remote exploits require 'msf/core' require 'msf/core/exploit/phpexe' class MetasploitModule 'Trend Micro Control Manager importFile Directory Traversal RCE', 'Description' = %q This module exploits a directory traversal vulnerability found in Trend Micro...

CVE-2017-14262

On Samsung NVR devices, remote attackers can read the MD5 password hash of the 'admin' account via certain szUserName JSON data to cgi-bin/main-cgi, and login to the device with that hash in the szUserPasswd parameter...

CVE-2017-14262: Inadequate Encryption Strength

On Samsung NVR devices, remote attackers can read the MD5 password hash of the 'admin' account via certain szUserName JSON data to cgi-bin/main-cgi, and login to the device with that hash in the szUserPasswd parameter...

PT-2017-13331

Name of the Vulnerable Software and Affected Versions Samsung NVR devices affected versions not specified Description The issue allows remote attackers to read the MD5 password hash of the 'admin' account by sending certain szUserName JSON data to the "cgi-bin/main-cgi" API endpoint. This hash ca...

HTTPoxy Vulnerability

composer/composer is vulnerable to the HTTPoxy vulnerability. The vulnerability exists because the library trusts the HTTPPROXY environment variable, and allows the configuration of proxies by setting the environment variables HTTPPROXY and HTTPSPROXY without checking if CGI is in use...

PT-2017-13039

Name of the Vulnerable Software and Affected Versions T&W WIFI Repeater BE126 version not specified Description The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in the user parameter to "cgi-bin/webupg". Recommendations For T&W WIFI Repeater BE126,...

PT-2017-13090

Name of the Vulnerable Software and Affected Versions Lexmark Scan To Network SNF versions 3.2.9 and earlier Description The issue allows remote attackers to obtain sensitive information. This is due to network configuration credentials being stored in plaintext and transmitted in requests...

CVE-2017-13713: Improper Neutralization of Special Elements used in an OS Command

T&W WIFI Repeater BE126 allows remote authenticated users to execute arbitrary code via shell metacharacters in the user parameter to cgi-bin/webupg...

Mongoose Web Server 6.5 CSRF / Command Execution

Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MONGOOSE-WEB-SERVER-v6.5-CSRF-COMMAND-EXECUTION.txt + ISR: apparitionSec Vendor: =============== www.cesanta.com Product: ================== Mongoose Web Server Free Edition...

Mongoose Web Server 6.5 CSRF / Command Execution Vulnerability

Mongoose Web Server version 6.5 suffers from cross site request forgery and remote command execution vulnerabilities. + Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MONGOOSE-WEB-SERVER-v6.5-CSRF-COMMAND-EXECUTION.txt +...

Mongoose Web Server 6.5 - Cross-Site Request Forgery / Remote Code Execution

Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MONGOOSE-WEB-SERVER-v6.5-CSRF-COMMAND-EXECUTION.txt + ISR: apparitionSec Vendor: =============== www.cesanta.com Product: ================== Mongoose Web Server Free Edition...

Mongoose Web Server 6.5 - Cross-Site Request Forgery Remote Code Execution

Mongoose Web Server 6.5 - Cross-Site Request Forgery Remote Code Execution + Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MONGOOSE-WEB-SERVER-v6.5-CSRF-COMMAND-EXECUTION.txt + ISR: apparitionSec Vendor: ===============...

Huawei E3272s Denial of Service Vulnerability

The Huawei E3272s is a wireless Internet card card tray device from Huawei China. A denial of service vulnerability exists in versions prior to Huawei E3272s E3272s-153TCPU-V200R002B491D09SP00C00. An attacker can exploit this vulnerability by sending specific messages to the CGI Common Gateway...

banners.realsexacts.com XSS vulnerability

Open Bug Bounty ID: OBB-279625 Description| Value ---|--- Affected Website:| banners.realsexacts.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2016-8743

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-en...

Design/Logic Flaw

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-en...

CVE-2016-8743

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-en...