12685 matches found
Apache + PHP < 5.3.12 / < 5.4.2 - cgi-bin Remote Code Execution
/ Apache Magica by Kingcope / / gcc apache-magika.c -o apache-magika -lssl / / This is a code execution bug in the combination of Apache and PHP. On Debian and Ubuntu the vulnerability is present in the default install of the php5-cgi package. When the php5-cgi package is installed on Debian and...
Apache + PHP 5.3.12 5.4.2 - cgi-bin Remote Code Execution
Apache + PHP 5.3.12 5.4.2 - cgi-bin Remote Code Execution / Apache Magica by Kingcope / / gcc apache-magika.c -o apache-magika -lssl / / This is a code execution bug in the combination of Apache and PHP. On Debian and Ubuntu the vulnerability is present in the default install of the php5-cgi...
PSF-2013-3 CGI directory traversal (URL parsing)
An error in separating the path and filename of the CGI script to run in http.server.CGIHTTPRequestHandler allows running arbitrary executables in the directory under which the server was started...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
OpenJDK: RMI CGIHandler XSS issue (RMI, 6563318)
Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.240 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via vectors related to RMI. NOTE: the previous information...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
CVE-2013-3686
cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password via a list action...
CVE-2013-3686
cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password via a list action...
CVE-2013-2578
cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12sign6 allows remote attackers to execute arbitrary commands via shell metacharacters in 1 the ServerName parameter and 2 other unspecified...
PT-2013-3850
Name of the Vulnerable Software and Affected Versions TP-Link IP Cameras versions prior to beta firmware LM.1.6.18P12 sign6 Description The issue allows remote attackers to modify the firmware revision. This is achieved through the cgi-bin/firmwareupgrade endpoint, by utilizing a "preset" action...
PT-2013-3849
Name of the Vulnerable Software and Affected Versions TP-Link IP Cameras versions prior to beta firmware LM.1.6.18P12 sign6 Description The issue allows remote attackers to upload arbitrary files to the cgi-bin/uploadfile directory, which can then be accessed directly via a request to the file in...
CVE-2013-3686: Undefined Security Weakness
cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password via a list action...
PT-2013-4564
Name of the Vulnerable Software and Affected Versions AirLive WL2600CAM affected versions not specified Description The issue allows remote attackers to obtain the administrator password. This is achieved through the cgi-bin/operator/param endpoint, specifically by utilizing a list action...
PT-2013-3847
Name of the Vulnerable Software and Affected Versions TP-Link IP Cameras versions prior to beta firmware LM.1.6.18P12 sign6 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the ServerName parameter and other unspecified parameters in the...
CVE-2013-2578: Improper Neutralization of Special Elements used in an OS Command
cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12sign6 allows remote attackers to execute arbitrary commands via shell metacharacters in 1 the ServerName parameter and 2 other unspecified...
CVE-2013-2580: Undefined Security Weakness
Unrestricted file upload vulnerability in cgi-bin/uploadfile in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12sign6, allows remote attackers to upload arbitrary files, then accessing it via a direct request to the file ...
CVE-2013-2581: Undefined Security Weakness
cgi-bin/firmwareupgrade in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12sign6 allows remote attackers to modify the firmware revision via a "preset" action...
Samsung DVR authentication bypass
Title: Samsung DVR authentication bypass Version affected: firmware version = 1.10 Vendor: Samsung - www.samsung-security.com Discovered by: Andrea Fabrizi Email: [email protected] Web: http://www.andreafabrizi.it Twitter: @andreaf83 Status: unpatched Samsung provides a wide range of DVR...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
CVE-2013-3541
The CVE-2013-3541 entry concerns a directory traversal vulnerability in AirLive devices, specifically the cgi-bin/admin/fileread functionality. The documented flaw allows remote attackers to read arbitrary files by manipulating the READ.filePath parameter (using .. to traverse directories). Affec...