CVE-2020-9020: Improper Neutralization of Special Elements used in an OS Command

Iteris Vantage Velocity Field Unit 2.3.1, 2.4.2, and 3.0 devices allow the injection of OS commands into cgi-bin/timeconfig.py via shell metacharacters in the NTP Server field...

PT-2020-20440

Name of the Vulnerable Software and Affected Versions Iteris Vantage Velocity Field Unit version 2.4.2 Description The issue concerns multiple stored XSS problems in all parameters of the Start Data Viewer feature, specifically within the /cgi-bin/loaddata.py script. Recommendations For Iteris...

PT-2020-20435

Name of the Vulnerable Software and Affected Versions Iteris Vantage Velocity Field Unit versions 2.3.1, 2.4.2, and 3.0 Description The issue allows the injection of OS commands into "cgi-bin/timeconfig.py" via shell metacharacters in the NTP Server field. Recommendations For Iteris Vantage...

PT-2020-20437

Name of the Vulnerable Software and Affected Versions Xirrus XR520 Xirrus XR620 Xirrus XR2436 Xirrus XH2-120 Description An issue was discovered that allows XSS through the "cgi-bin/ViewPage.cgi" API endpoint, specifically via the user parameter. Recommendations For Xirrus XR520, consider disabli...

CVE-2020-9025: Improper Neutralization of Input During Web Page Generation

Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /cgi-bin/loaddata.py script...

CVE-2020-9022: Improper Neutralization of Input During Web Page Generation

An issue was discovered on Xirrus XR520, XR620, XR2436, and XH2-120 devices. The cgi-bin/ViewPage.cgi user parameter allows XSS...

The vulnerability of the cgi-bin/index2.asp component of Genexis Platinum-P4410-V2 and Genexis Platinum-4410 routing software allows a hacker to obtain authentication data necessary to access the router administration panel.

The vulnerability of the cgi-bin/index2.asp component of Genexis Platinum-P4410-V2 and Genexis Platinum-4410 routing software is related to authentication deficiencies. Exploiting this vulnerability could allow an attacker to obtain authentication credentials necessary to access the router...

CVE-2020-8515

DrayTek Vigor2960 1.3.1Beta, Vigor3900 1.4.4Beta, and Vigor300B 1.3.3Beta, 1.4.2.1Beta, and 1.4.4Beta devices allow remote code execution as root without authentication via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1...

CVE-2020-8515

DrayTek Vigor2960 1.3.1Beta, Vigor3900 1.4.4Beta, and Vigor300B 1.3.3Beta, 1.4.2.1Beta, and 1.4.4Beta devices allow remote code execution as root without authentication via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1...

CVE-2020-8515

DrayTek Vigor2960 1.3.1Beta, Vigor3900 1.4.4Beta, and Vigor300B 1.3.3Beta, 1.4.2.1Beta, and 1.4.4Beta devices allow remote code execution as root without authentication via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1...

CVE-2020-8515

DrayTek Vigor2960 1.3.1Beta, Vigor3900 1.4.4Beta, and Vigor300B 1.3.3Beta, 1.4.2.1Beta, and 1.4.4Beta devices allow remote code execution as root without authentication via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1. Recent...

CVE-2020-8515: Improper Neutralization of Special Elements used in an OS Command

DrayTek Vigor2960 1.3.1Beta, Vigor3900 1.4.4Beta, and Vigor300B 1.3.3Beta, 1.4.2.1Beta, and 1.4.4Beta devices allow remote code execution as root without authentication via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1...

CVE-2014-3718

Multiple cross-site scripting XSS vulnerabilities in cgi-bin/tagm.cgi in Ex Libris ALEPH 500 Integrated library management system 18.1 and 20 allow remote attackers to inject arbitrary web script or HTML via the 1 find, 2 lib, or 3 sid parameter...

CVE-2014-3719

Multiple SQL injection vulnerabilities in cgi-bin/reviewm.cgi in Ex Libris ALEPH 500 Integrated library management system 18.1 and 20 allow remote attackers to execute arbitrary SQL commands via the 1 find, 2 lib, or 3 sid parameter...

PT-2020-7654

Name of the Vulnerable Software and Affected Versions Ex Libris ALEPH 500 versions 18.1 through 20 Description The issue allows remote attackers to inject arbitrary web script or HTML via the find, lib, or sid parameters in the cgi-bin/tag m.cgi endpoint. This enables attackers to perform...

CVE-2014-3718: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in cgi-bin/tagm.cgi in Ex Libris ALEPH 500 Integrated library management system 18.1 and 20 allow remote attackers to inject arbitrary web script or HTML via the 1 find, 2 lib, or 3 sid parameter...

CVE-2014-3719: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in cgi-bin/reviewm.cgi in Ex Libris ALEPH 500 Integrated library management system 18.1 and 20 allow remote attackers to execute arbitrary SQL commands via the 1 find, 2 lib, or 3 sid parameter...

PT-2020-7655

Name of the Vulnerable Software and Affected Versions Ex Libris ALEPH 500 versions 18.1 through 20 Description The issue concerns multiple SQL injection vulnerabilities in the cgi-bin/review m.cgi component of Ex Libris ALEPH 500. These vulnerabilities allow remote attackers to execute arbitrary...

CVE-2019-20215

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi in /htdocs/cgibin, because HTTPST is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker t...

CVE-2013-2573: Improper Neutralization of Special Elements used in an OS Command

A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wirelessmft.cgi file in TP-Link IP Cameras TL-SC 3130, TL-SC 3130G, 3171G. and 4171G 1.6.18P12s, which could let a malicious user execute arbitrary code...