137 matches found
CVE-2016-8593
Trend Micro Threat Discovery Appliance (TDA)
CVE-2016-8593: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via a .. dot dot in the dID parameter...
CVE-2014-9184
CVE-2014-9184 affects ZTE ZXDSL 831CII. The vulnerability allows remote attackers to bypass authentication by directly requesting CGI files (main.cgi, adminpasswd.cgi, userpasswd.cgi, upload.cgi, conprocess.cgi, connect.cgi). Evidence across sources confirms this authentication bypass issue with ...
CVE-2014-9184: Improper Authentication
ZTE ZXDSL 831CII allows remote attackers to bypass authentication via a direct request to 1 main.cgi, 2 adminpasswd.cgi, 3 userpasswd.cgi, 4 upload.cgi, 5 conprocess.cgi, or 6 connect.cgi...
Code injection
lib/TWiki/Sandbox.pm in TWiki 6.0.0 and earlier, when running on Windows, allows remote attackers to bypass intended access restrictions and upload files with restricted names via a null byte %00 in a filename to bin/upload.cgi, as demonstrated using .htaccess to execute arbitrary code...
CVE-2014-7237: Undefined Security Weakness
lib/TWiki/Sandbox.pm in TWiki 6.0.0 and earlier, when running on Windows, allows remote attackers to bypass intended access restrictions and upload files with restricted names via a null byte %00 in a filename to bin/upload.cgi, as demonstrated using .htaccess to execute arbitrary code...
CVE-2010-1709
Multiple cross-site scripting XSS vulnerabilities in upload.cgi in G5-Scripts Auto-Img-Gallery 1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 user and 2 pass parameters...
CVE-2010-1709
The CVE-2010-1709 entry pertains to multiple XSS vulnerabilities in the upload.cgi handler of G5-Scripts Auto-Img-Gallery 1.1. The underlying issue is input handling in the upload.cgi script, allowing an attacker to inject arbitrary web script or HTML via the (1) user and (2) pass parameters. Aff...
CVE-2010-1709: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in upload.cgi in G5-Scripts Auto-Img-Gallery 1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 user and 2 pass parameters...
CVE-2007-5734
Unrestricted file upload vulnerability in eFileMan 7.1.0.87-88 allows remote attackers to upload arbitrary files, with "uploads/uploadfile." destination filenames, via unspecified vectors to upload.cgi, accessed from upload.html...
CVE-2007-5734: Improper Input Validation
Unrestricted file upload vulnerability in eFileMan 7.1.0.87-88 allows remote attackers to upload arbitrary files, with "uploads/uploadfile." destination filenames, via unspecified vectors to upload.cgi, accessed from upload.html...
CVE-2004-2743
CVE-2004-2743 concerns upload.cgi in Mega Upload Progress Bar before 1.45. It allows remote attackers to copy or overwrite arbitrary files via parameters related to uploaded file names. The NVD entry lists a CVSSv2 base score of 6.4 (Medium), with Network attack vector, Low complexity, and no aut...
CVE-2004-2743
upload.cgi in Mega Upload Progress Bar before 1.45 allows remote attackers to copy or overwrite arbitrary files via unspecified parameters related to names of uploaded files...
CVE-2004-2743: Undefined Security Weakness
upload.cgi in Mega Upload Progress Bar before 1.45 allows remote attackers to copy or overwrite arbitrary files via unspecified parameters related to names of uploaded files...
CVE-2006-1485
gm-upload.cgi in Greymatter 1.3.1 allows remote authenticated users with upload privileges to execute arbitrary programs by uploading files to locations within the web root. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2006-1485: Undefined Security Weakness
gm-upload.cgi in Greymatter 1.3.1 allows remote authenticated users with upload privileges to execute arbitrary programs by uploading files to locations within the web root. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
