CVE-2020-7848

The EFM ipTIME C200 IP Camera is affected by a Command Injection vulnerability in /login.cgi?logout=1 script. To exploit this vulnerability, an attacker can send a GET request that executes arbitrary OS commands via cookie value...

Command injection

The EFM ipTIME C200 IP Camera is affected by a Command Injection vulnerability in /login.cgi?logout=1 script. To exploit this vulnerability, an attacker can send a GET request that executes arbitrary OS commands via cookie value...

CVE-2020-7848

The CVE-2020-7848 entry concerns the EFM ipTIME C200 IP Camera with a Command Injection flaw in /login.cgi?logout=1. An attacker can send a GET request to execute arbitrary OS commands via a crafted cookie value. CVSS data (2.0/3.1) indicates HIGH impact across confidentiality, integrity, and ava...

PT-2021-12671

Name of the Vulnerable Software and Affected Versions: EFM ipTIME C200 IP Camera affected versions not specified Description: The issue concerns a Command Injection vulnerability in the /login.cgi?logout=1 script. An attacker can exploit this by sending a GET request that executes arbitrary OS...

Sql injection

Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and possibly other versions before 9.0.1.19899, allow remote attackers to execute arbitrary SQL commands via the 1 addip parameter to cgi-bin/scrutfaexclusions.cgi, 2...

CVE-2012-1259: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and possibly other versions before 9.0.1.19899, allow remote attackers to execute arbitrary SQL commands via the 1 addip parameter to cgi-bin/scrutfaexclusions.cgi, 2...

PT-2020-7181

Name of the Vulnerable Software and Affected Versions Plixer International Scrutinizer NetFlow & sFlow Analyzer versions 8.6.2.16204 through 9.0.1.19899 Description Multiple SQL injection vulnerabilities allow remote attackers to execute arbitrary SQL commands via the addip parameter to...

PT-2019-8590

Name of the Vulnerable Software and Affected Versions Riello NetMan 204 versions 14-2 through 15-2 Description The issue is related to the login script and the wrongpass Python script used for authentication. The variables $VAL0 and $VAL1 should be enclosed in quotes to prevent Bash command...

CVE-2017-6900: Undefined Security Weakness

An issue was discovered in Riello NetMan 204 14-2 and 15-2. The issue is with the login script and wrongpass Python script used for authentication. When calling wrongpass, the variables $VAL0 and $VAL1 should be enclosed in quotes to prevent the potential for Bash command injection. Further to...

CVE-2019-3934: Improper Access Control

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code sending a crafted HTTP POST request to login.cgi. A remote, unauthenticated attacker can use this vulnerability to download the current slide image without knowing the access code...

PT-2019-16788

Name of the Vulnerable Software and Affected Versions Crestron AM-100 version 1.6.0.2 Crestron AM-101 version 2.7.0.2 Description The issue allows a remote, unauthenticated attacker to bypass the presentation code by sending a crafted HTTP POST request to "login.cgi". This enables the attacker to...

CVE-2019-6710

Zyxel NBG-418N v2 v1.00AAXM.4C0 devices allow login.cgi CSRF...

Cross site request forgery (csrf)

Zyxel NBG-418N v2 v1.00AAXM.4C0 devices allow login.cgi CSRF...

PT-2019-18278

Name of the Vulnerable Software and Affected Versions Zyxel NBG-418N v2 version 1.00AAXM.4C0 Description The issue allows for a CSRF attack via the "login.cgi" API endpoint. This could potentially be exploited by tricking a user into performing unintended actions. Recommendations For Zyxel NBG-41...

CVE-2019-6710: Cross-Site Request Forgery (CSRF)

Zyxel NBG-418N v2 v1.00AAXM.4C0 devices allow login.cgi CSRF...

CVE-2018-6320

CVE-2018-6320 affects Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS) where login.cgi improperly validates the http(s) Host header. Affected versions: PCS 8.1RX pre-8.1R12 and 8.3RX pre-8.3R2; PPS 5.2RX pre-5.2R9 and 5.4RX pre-5.4R2. The issue arises from trusting the Host header receive...

CVE-2018-6320: Improper Input Validation

A vulnerability has been discovered in login.cgi in Pulse Secure Pulse Connect Secure PCS 8.1RX before 8.1R12 and 8.3RX before 8.3R2 and Pulse Policy Secure PPS 5.2RX before 5.2R9 and 5.4RX before 5.4R2 wherein an https Host header received from the browser is trusted without validation...

PT-2018-17475 · Pulse · Pulse Policy Secure +1

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure PCS versions 8.1RX through 8.1R11 Pulse Connect Secure PCS versions 8.3RX through 8.3R1 Pulse Policy Secure PPS versions 5.2RX through 5.2R8 Pulse Policy Secure PPS versions 5.4RX through 5.4R1 Description: A vulnerabilit...

bucksportal.com XSS vulnerability

Open Bug Bounty ID: OBB-655797 Description| Value ---|--- Affected Website:| bucksportal.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Citrix CloudBridge - CAKEPHP Cookie Command Injection Vulnerability

Exploit for cgi platform in category web applications POST /cgi-bin/login.cgi?redirect=/ HTTP/1.1 Host: 10.242.129.149 Accept: / Accept-Language: en User-Agent: Mozilla/5.0 compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0 Connection: close Referer:...