1997 matches found
CVE-2019-13401: Cross-Site Request Forgery (CSRF)
Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...
CVE-2019-13400: Insufficiently Protected Credentials
Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. These credentials can be retrieved via cgi-bin/getuserinfo.cgi?mode=info...
CVE-2019-13398: Improper Neutralization of Special Elements used in an OS Command
Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrlsaveprofile.cgi save parameter and cgi-bin/ddns.cgi...
PT-2019-13312
Name of the Vulnerable Software and Affected Versions Dynacolor FCM-MB40 version 1.2.0.0 Description The issue concerns the storage of administrative web-interface credentials in cleartext. Specifically, the credentials are stored in the /etc/appWeb/appweb.pass file. An attacker can retrieve thes...
PT-2019-13313
Name of the Vulnerable Software and Affected Versions Dynacolor FCM-MB40 version 1.2.0.0 Description The issue concerns a CSRF problem present in all scripts under the cgi-bin/ directory. Recommendations For Dynacolor FCM-MB40 version 1.2.0.0, consider implementing proper CSRF protection...
PT-2019-13310
Name of the Vulnerable Software and Affected Versions Dynacolor FCM-MB40 version 1.2.0.0 Description The issue allows remote attackers to execute arbitrary commands by providing a crafted parameter to a CGI script. This can be achieved through sed injection in the cgi-bin/camctrl save profile.cgi...
The vulnerability of D-Link DI-524 router’s microprogramming software lies in the lack of protective measures for the website structure, allowing attackers to inject arbitrary JavaScript code into the device’s web interface pages.
The vulnerability of D-Link DI-524 router’s microprogram code exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject JavaScript code into the device’s web interface pages. The web configuration files,...
VulnCheck KEV: CVE-2009-5156
An issue was discovered on ASMAX AR-804gu 66.34.1 devices. There is Command Injection via the cgi-bin/script query string...
VulnCheck KEV: CVE-2009-2765
httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI...
CVE-2009-5156
An issue was discovered on ASMAX AR-804gu 66.34.1 devices. There is Command Injection via the cgi-bin/script query string...
CVE-2009-5156
A Command Injection vulnerability exists in ASMAX AR-804gu routers, specifically affecting version 66.34.1 . The flaw is triggered via the cgi-bin/script query string. A remote attacker can exploit this by sending a specially crafted request to the victim device, potentially allowing the executio...
CVE-2009-5156
An issue was discovered on ASMAX AR-804gu 66.34.1 devices. There is Command Injection via the cgi-bin/script query string...
CVE-2009-5156: Improper Neutralization of Special Elements used in a Command
An issue was discovered on ASMAX AR-804gu 66.34.1 devices. There is Command Injection via the cgi-bin/script query string...
PT-2019-6522
Name of the Vulnerable Software and Affected Versions ASMAX AR-804gu version 66.34.1 Description An issue was discovered in the ASMAX AR-804gu device, where there is a Command Injection vulnerability via the "cgi-bin/script" query string. Recommendations For ASMAX AR-804gu version 66.34.1, as a...
CVE-2019-12771
Command injection is possible in ThinStation through 6.1.1 via shell metacharacters after the cgi-bin/CdControl.cgi action= substring, or after the cgi-bin/VolControl.cgi OK= substring...
PT-2019-12934
Name of the Vulnerable Software and Affected Versions ThinStation versions prior to 6.1.2 Description Command injection is possible through shell metacharacters after the "cgi-bin/CdControl.cgi" action= substring, or after the "cgi-bin/VolControl.cgi" OK= substring. Recommendations For versions...
CVE-2019-12771: Improper Neutralization of Special Elements used in an OS Command
Command injection is possible in ThinStation through 6.1.1 via shell metacharacters after the cgi-bin/CdControl.cgi action= substring, or after the cgi-bin/VolControl.cgi OK= substring...
Deltek Maconomy 2.2.5 Local File Inclusion Vulnerability
Exploit for cgi platform in category web applications Exploit Title: Maconomy Erp local file include Exploit Author: JameelNabbo Website: jameelnabbo.com Vendor Homepage: https://www.deltek.com Software Link: https://www.deltek.com/en-gb/products/project-erp/maconomy CVE: CVE-2019-12314 POC: POC:...
