12617 matches found
CVE-2017-8219
CVE-2017-8219 affects TP-Link C2 and C20i routers up to firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n. An authenticated attacker can trigger a DoS of the HTTP server by sending a crafted Cookie header to /cgi/ansi, and, more critically, perform remote code execution that can dump/modify conf...
PT-2017-18222
Name of the Vulnerable Software and Affected Versions TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n Description The issue allows for a denial-of-service DoS attack against the HTTP server by sending a crafted Cookie header to the "/cgi/ansi" API endpoint...
WePresent WiPG-1000 - Command Injection (Metasploit)
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'WePresent WiPG-1000 Command Injection', 'Description' = %q This module exploits a command injection vulnerability in an...
CVE-2017-8219: Improper Input Validation
TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow DoSing the HTTP server via a crafted Cookie header to the /cgi/ansi URI...
WePresent WiPG-1000 Command Injection
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'WePresent WiPG-1000 Command Injection', 'Description' = %q This module exploits a command injection vulnerability in an...
WePresent WiPG-1000 Command Injection Exploit
This Metasploit module exploits a command injection vulnerability in an undocumented CGI file in several versions of the WePresent WiPG-1000 devices. Version 2.0.0.7 was confirmed vulnerable, 2.2.3.0 patched this vulnerability. This module requires Metasploit: http://metasploit.com/download Curre...
Western Digital My Cloud 2.21.126 Authentication Bypass
------------------------------------------------------------------------ Authentication bypass vulnerability in Western Digital My Cloud allows escalation to admin privileges ------------------------------------------------------------------------ Remco Vermeulen, April 2017...
Amazon Linux AMI : munin (ALAS-2017-818)
Munin before 2.999.6 has a local file write vulnerability when CGI graphs are enabled. Setting multiple upperlimit GET parameters allows overwriting any file accessible to the www-data user. CVE-2017-6188 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...
Medium: munin
Issue Overview: Munin before 2.999.6 has a local file write vulnerability when CGI graphs are enabled. Setting multiple upperlimit GET parameters allows overwriting any file accessible to the www-data user. CVE-2017-6188 Affected Packages: munin Issue Correction: Run yum update munin or yum updat...
Session fixation
Cybozu Office 9.0.0 to 10.4.0 allow remote attackers to obtain session information via a page where CGI environment variables are displayed...
CVE-2016-4869
Cybozu Office 9.0.0 to 10.4.0 allow remote attackers to obtain session information via a page where CGI environment variables are displayed...
CVE-2016-4869
Cybozu Office 9.0.0 to 10.4.0 allow remote attackers to obtain session information via a page where CGI environment variables are displayed...
CVE-2016-4869
Cybozu Office 9.0.0 to 10.4.0 allow remote attackers to obtain session information via a page where CGI environment variables are displayed...
CVE-2016-4869
CVE-2016-4869 (Cybozu Office) : Cybozu Office versions 9.0.0–10.4.0 contain an information disclosure vulnerability where a page displaying CGI environment variables can leak session information. An unauthenticated remote attacker may obtain a user’s session data via that page. The issue’s impact...
PT-2017-8566
Name of the Vulnerable Software and Affected Versions Cybozu Office versions 9.0.0 through 10.4.0 Description The issue allows remote attackers to obtain session information via a page where CGI environment variables are displayed. Recommendations For Cybozu Office versions 9.0.0 through 10.4.0,...
CVE-2016-4869: Exposure of Sensitive Information to an Unauthorized Actor
Cybozu Office 9.0.0 to 10.4.0 allow remote attackers to obtain session information via a page where CGI environment variables are displayed...
cgi.com XSS vulnerability
Vulnerable URL: https://www.cgi.com/en/media-announcement/2015;alert'OPENBUGBOUNTY'; Details: Description| Value ---|--- Patched:| Yes, at 21.04.2017 Latest check for patch:| 21.04.2017 08:26 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 35900 VIP website...
Schneider Electric homeLYnk Controller Detection
Detection of Schneider Electric homeLYnk Controller The script sends a connection request to the server and attempts to detect Schneider Electric homeLYnk Controller and to extract its version. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced...
Directory traversal
Directory traversal vulnerability in the web-based management site on the Intellinet NFC-30ir IP Camera with firmware LM.1.6.16.05 allows remote attackers to read arbitrary files via a request to a vendor-supplied CGI script that is used to read HTML text file, but that does not do any URI/path...