1997 matches found
PT-2020-13053
Name of the Vulnerable Software and Affected Versions WAVLINK WN530H4 M30H4.V5030.190403 Description The issue allows an attacker to leak router settings, including cleartext login details, DNS settings, and other sensitive information without authentication through the "API Endpoint:...
PT-2020-13051
Name of the Vulnerable Software and Affected Versions WAVLINK WN530H4 M30H4.V5030.190403 Description A remote buffer overflow issue exists in the "/cgi-bin/makeRequest.cgi" API endpoint, allowing an attacker to execute arbitrary machine instructions as root without authentication. Recommendations...
CVE-2020-12126: Improper Authentication
Multiple authentication bypass vulnerabilities in the /cgi-bin/ endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allow an attacker to leak router settings, change configuration variables, and cause denial of service via an unauthenticated endpoint...
CVE-2020-25079
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddnsenc.cgi allows authenticated command injection...
Command injection
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddnsenc.cgi allows authenticated command injection...
CVE-2020-25079: Improper Neutralization of Special Elements used in a Command
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddnsenc.cgi allows authenticated command injection...
VulnCheck KEV: CVE-2013-2578
cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12sign6 allows remote attackers to execute arbitrary commands via shell metacharacters in 1 the ServerName parameter and 2 other unspecified...
CVE-2020-15415: Improper Neutralization of Special Elements used in an OS Command
On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472...
CVE-2020-10973
WAVLINK WN530HG4 / WN531G3 / WN533A8 / WN551K1 are affected by an improper access control vulnerability in /cgi-bin/ExportAllSettings.sh. A crafted POST request, without authentication, returns the device’s current configuration including the administrator password; the attacker must perform a de...
PT-2020-12458
Name of the Vulnerable Software and Affected Versions Wavlink WN530HG4 Wavlink WN531G3 Wavlink WN533A8 Wavlink WN551K1 Wavlink WL-WN530HG4 version M30HG4.V5030.191116 Description An issue was discovered affecting the /cgi-bin/ExportAllSettings.sh endpoint, where a crafted POST request can return...
VulnCheck KEV: CVE-2014-9727
AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter to cgi-bin/webcm...
CVE-2020-5738: Improper Link Resolution Before File Access
Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/uploadvpntar interface...
PT-2020-18660
Name of the Vulnerable Software and Affected Versions Grandstream GXP1600 series firmware versions 1.0.4.152 and below Description The issue allows for authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/upload vpntar interface...
CVE-2020-11734
cgi-bin/go in CyberSolutions CyberMail 5 or later allows XSS via the ACTION parameter...
CVE-2020-11734
cgi-bin/go in CyberSolutions CyberMail 5 or later allows XSS via the ACTION parameter...
CVE-2020-11734
cgi-bin/go in CyberSolutions CyberMail 5 or later allows XSS via the ACTION parameter...
PT-2020-12814
Name of the Vulnerable Software and Affected Versions CyberSolutions CyberMail versions 5.0 and later Description The issue allows for cross-site scripting XSS via the ACTION parameter in the /cgi-bin/go endpoint. This could potentially lead to malicious script execution on the client-side...
CVE-2020-11734: Improper Neutralization of Input During Web Page Generation
cgi-bin/go in CyberSolutions CyberMail 5 or later allows XSS via the ACTION parameter...
CVE-2020-10826: Improper Neutralization of Special Elements used in a Command
/cgi-bin/activate.cgi on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve command injection via a remote HTTP request in DEBUG mode...