QNAP Turbo NAS 3.7.3 File Disclosure

Vulnerability: Multiple Path Injection Product: QNAP Turbo NAS Vendor: QNAP Version affected: = 3.7.3 build 20120801 Status: Unpatched Website: http://web.qnap.com/prodetailfeature.asp?pid=202 Discovered by: Andrea Fabrizi Email: [email protected] Web: http://www.andreafabrizi.it This...

QNAP Turbo NAS 3.7.3 File Disclosure

Exploit for hardware platform in category web applications Vulnerability: Multiple Path Injection Product: QNAP Turbo NAS Vendor: QNAP Version affected: = 3.7.3 build 20120801 Status: Unpatched Website: http://web.qnap.com/prodetailfeature.asp?pid=202 Discovered by: Andrea Fabrizi Email:...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

CVE-2012-2104

cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters, which might allow user-assisted remote attackers to inject terminal emulator escape sequences and execute arbitrary commands or delete arbitrary files via a crafted HTTP request...

CVE-2012-2147

munin-cgi-graph in Munin 2.0 rc4 allows remote attackers to cause a denial of service disk or memory consumption via many image requests with large values in the 1 sizex or 2 sizey parameters...

Code injection

munin-cgi-graph for Munin 2.0 rc4 does not delete temporary files, which allows remote attackers to cause a denial of service disk consumption via many requests to an image with unique parameters...

CVE-2012-2104

CVE-2012-2104 concerns the Munin project: the CGI script cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters, which could allow a user‑assisted remote attacker to inject terminal emulator escape sequences and execute arbitrary commands or del...

CVE-2012-4678

CVE‑2012‑4678 affects munin-cgi-graph in Munin 2.0 rc4. Root cause: it does not delete temporary files, allowing remote attackers to cause DoS via many requests to an image with unique parameters. Public documents do not specify a patch/workaround or explicit exploit details.

CVE-2012-4678

munin-cgi-graph for Munin 2.0 rc4 does not delete temporary files, which allows remote attackers to cause a denial of service disk consumption via many requests to an image with unique parameters...

CVE-2012-4678

munin-cgi-graph for Munin 2.0 rc4 does not delete temporary files, which allows remote attackers to cause a denial of service disk consumption via many requests to an image with unique parameters...

CVE-2012-2147

munin-cgi-graph in Munin 2.0 rc4 allows remote attackers to cause a denial of service disk or memory consumption via many image requests with large values in the 1 sizex or 2 sizey parameters...

CVE-2012-2104

cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters, which might allow user-assisted remote attackers to inject terminal emulator escape sequences and execute arbitrary commands or delete arbitrary files via a crafted HTTP request...

CVE-2012-2104

cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters, which might allow user-assisted remote attackers to inject terminal emulator escape sequences and execute arbitrary commands or delete arbitrary files via a crafted HTTP request...

CVE-2012-2147: Undefined Security Weakness

munin-cgi-graph in Munin 2.0 rc4 allows remote attackers to cause a denial of service disk or memory consumption via many image requests with large values in the 1 sizex or 2 sizey parameters...

CVE-2012-4678: Undefined Security Weakness

munin-cgi-graph for Munin 2.0 rc4 does not delete temporary files, which allows remote attackers to cause a denial of service disk consumption via many requests to an image with unique parameters...

PT-2012-3837

Name of the Vulnerable Software and Affected Versions Munin version 2.0 rc4 Description The issue allows remote attackers to cause a denial of service, resulting in disk or memory consumption, by making many image requests with large values in the size x or size y parameters to the munin-cgi-grap...

PT-2012-3810

Name of the Vulnerable Software and Affected Versions Munin versions 2.x Description The issue allows user-assisted remote attackers to inject terminal emulator escape sequences and execute arbitrary commands or delete arbitrary files via a crafted HTTP request to the "cgi-bin/munin-cgi-graph"...

PT-2012-5545

Name of the Vulnerable Software and Affected Versions Munin version 2.0 rc4 Description The issue allows remote attackers to cause a denial of service, specifically disk consumption, by making many requests to an image with unique parameters. This is due to the munin-cgi-graph not deleting...

CVE-2012-2104: Improper Input Validation

cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters, which might allow user-assisted remote attackers to inject terminal emulator escape sequences and execute arbitrary commands or delete arbitrary files via a crafted HTTP request...