Citrix CloudBridge - CAKEPHP Cookie Command Injection

Citrix CloudBridge - CAKEPHP Cookie Command Injection POST /cgi-bin/login.cgi?redirect=/ HTTP/1.1 Host: 10.242.129.149 Accept: / Accept-Language: en User-Agent: Mozilla/5.0 compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0 Connection: close Referer:...

CVE-2017-9542: Improper Authentication

D-Link DIR-615 Wireless N 300 Router allows authentication bypass via a modified POST request to login.cgi. This issue occurs because it fails to validate the password field. Successful exploitation of this issue allows an attacker to take control of the affected device...

PT-2017-2634 · D Link · D-Link Dir-615 Wireless N 300 Router

Name of the Vulnerable Software and Affected Versions: D-Link DIR-615 Wireless N 300 Router Description: The issue is related to weaknesses in the authentication procedure of the router's firmware. It can be exploited by a remote attacker using a modified POST request to the "login.cgi" endpoint,...

CVE-2017-9100

login.cgi on D-Link DIR-600M devices with firmware 3.04 allows remote attackers to bypass authentication by entering more than 20 blank spaces in the password field during an admin login attempt...

CVE-2017-9100

login.cgi on D-Link DIR-600M devices with firmware 3.04 allows remote attackers to bypass authentication by entering more than 20 blank spaces in the password field during an admin login attempt...

CVE-2017-9100

CVE-2017-9100 affects D-Link DIR-600M devices running firmware 3.04. The vulnerability is an authentication bypass in login.cgi that allows a remote attacker to bypass login by submitting more than 20 blank spaces in the password field during an admin login attempt. Impact is unauthenticated admi...

PT-2017-18702

Name of the Vulnerable Software and Affected Versions D-Link DIR-600M firmware 3.04 Description The issue allows remote attackers to bypass authentication on the device by entering more than 20 blank spaces in the password field during an admin login attempt to the "login.cgi" endpoint...

CVE-2017-9100: Improper Authentication

login.cgi on D-Link DIR-600M devices with firmware 3.04 allows remote attackers to bypass authentication by entering more than 20 blank spaces in the password field during an admin login attempt...

Ubiquiti Inc.: AirFibre products vulnerable to HTTP Header injection

The uri GET parameter of Login.cgi is directly used on login to generate HTTP headers without sanitisation. An user could be tricked into logging into the device and then redirected to a malicious location or attacked through other HTTP Header injection attacks. Vulnerable code: if isset$uri &&...

CVE-2016-5639: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in cgi-bin/login.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to read arbitrary files via a .. dot dot in the src parameter...

PT-2016-6611

Name of the Vulnerable Software and Affected Versions Crestron AirMedia AM-100 versions prior to 1.4.0.13 Description A directory traversal issue exists in the cgi-bin/login.cgi file, allowing remote attackers to read arbitrary files by including a .. dot dot in the src parameter of the affected...

Belkin AC1200 Router Firmware 1.00.27 - Authentication Bypass

''' Exploit Title: Belkin Router AC1200, Firmware: 1.00.27 - Authentication Bypass Date: 5/11/2016 Exploit Author: Gregory Smiley Contact: [email protected] Vendor Homepage: http://www.belkin.com Version: Firmware: 1.00.27 Tested on:F9K1113 v1 1. Description: The Belkin AC1200 is vulnerable to...

PT-2015-4259

Name of the Vulnerable Software and Affected Versions D-Link DIR-655 rev Bx versions prior to 2.12b01 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the html response page parameter in the login.cgi page. Recommendations F...

CVE-2014-9518: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in login.cgi in D-Link router DIR-655 rev Bx with firmware before 2.12b01 allows remote attackers to inject arbitrary web script or HTML via the htmlresponsepage parameter...

CVE-2014-1635

Buffer overflow in login.cgi in MiniHttpd in Belkin N750 Router with firmware before F9K1103WW1.10.17m allows remote attackers to execute arbitrary code via a long string in the jump parameter...

CVE-2014-1635: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in login.cgi in MiniHttpd in Belkin N750 Router with firmware before F9K1103WW1.10.17m allows remote attackers to execute arbitrary code via a long string in the jump parameter...

Authentication flaw

The D-Link DSL-2740B Gateway with firmware EU1.0, when an active administrator session exists, allows remote attackers to bypass authentication and gain administrator access via a request to login.cgi...

CVE-2013-2271

The D-Link DSL-2740B Gateway with firmware EU1.0, when an active administrator session exists, allows remote attackers to bypass authentication and gain administrator access via a request to login.cgi...

PT-2013-3632

Name of the Vulnerable Software and Affected Versions D-Link DSL-2740B Gateway version EU 1.0 Description The issue allows remote attackers to bypass authentication and gain administrator access when an active administrator session exists. This can be achieved by sending a request to the...

CVE-2013-2271: Undefined Security Weakness

The D-Link DSL-2740B Gateway with firmware EU1.0, when an active administrator session exists, allows remote attackers to bypass authentication and gain administrator access via a request to login.cgi...