CVE-2016-5639: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in cgi-bin/login.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to read arbitrary files via a .. dot dot in the src parameter...

xeanon.com XSS vulnerability

Vulnerable URL: http://www.xeanon.com/cgi-bin/xsn.cgi?l=rus=account Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 669335 VIP website status:| No Check xeanon.com SSL connection:|...

The vulnerability of the Microprogramming Software of the AirTies router allows a hacker to execute arbitrary code.

The vulnerability of the AirTies router’s microprogramming software arises from an overflow in the buffer in the dynamic memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending an incorrect parameter to the cgi-bin/login subcomponent remotely...

CVE-2015-8289

The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows remote attackers to discover the cleartext administrator password by reading the cgi-bin/passrec.asp HTML source code...

CVE-2015-8289: Exposure of Sensitive Information to an Unauthorized Actor

The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows remote attackers to discover the cleartext administrator password by reading the cgi-bin/passrec.asp HTML source code...

PT-2016-3880

Name of the Vulnerable Software and Affected Versions NETGEAR D3600 version 1.0.0.49 NETGEAR D6000 versions 1.0.0.49 and earlier Description The issue concerns the password-recovery feature, which allows remote attackers to discover the cleartext administrator password by reading the HTML source...

TP-Link SC2020n Authenticated Telnet Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'TP-Link SC2020n Authenticated Telnet Injection', 'Description' = %q The TP-Link SC2020n Network Video Camera is vulnerable to O...

CVE-2015-7248

ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.kPE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code, a different vulnerability than CVE-2015-8703...

CVE-2015-7249: Undefined Security Weakness

ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.kPE allow remote authenticated users to bypass intended access restrictions via a modified request, as demonstrated by leveraging the support account to change a password via a cgi-bin/webproc accountpsd action...

PT-2015-7492

Name of the Vulnerable Software and Affected Versions ZTE ZXHN H108N R1A versions before ZTE.bhs.ZXHNH108NR1A.k PE Description The issue allows remote authenticated users to bypass intended access restrictions via a modified request. This can be demonstrated by leveraging the support account to...

PT-2015-7491

Name of the Vulnerable Software and Affected Versions ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k PE Description The issue allows remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code. Recommendations For ZTE ZXHN H108N R1A devices...

PT-2015-7495

Name of the Vulnerable Software and Affected Versions ZTE ZXHN H108N R1A versions before ZTE.bhs.ZXHNH108NR1A.k PE Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the errorpage parameter in the cgi-bin/webproc endpoint...

PT-2015-7493

Name of the Vulnerable Software and Affected Versions ZTE ZXHN H108N R1A versions before ZTE.bhs.ZXHNH108NR1A.k PE Description The issue is related to an absolute path traversal vulnerability in the cgi-bin/webproc component. This allows remote attackers to read arbitrary files by providing a ful...

CVE-2015-7250: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.kPE allows remote attackers to read arbitrary files via a full pathname in the getpage parameter...

CVE-2015-7248: Exposure of Sensitive Information to an Unauthorized Actor

ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.kPE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code, a different vulnerability than CVE-2015-8703...

CVE-2015-7252: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.kPE allows remote attackers to inject arbitrary web script or HTML via the errorpage parameter...

secure.worc.ac.uk XSS vulnerability

Vulnerable URL: https://secure.worc.ac.uk/cgi-bin/library/digitization/login.pl?errmsg=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 11:49 GMT Vulnerability type:| XSS Vulnerability status:|...

PT-2015-3057

Name of the Vulnerable Software and Affected Versions Endian Firewall versions prior to 3.0 Description The issue is related to the lack of input validation in the Endian Firewall. It allows a remote attacker to execute arbitrary commands by passing metacharacters through the NEW PASSWORD 1 or NE...

CVE-2014-6616

Cross-site scripting XSS vulnerability in Softing FG-100 PROFIBUS Single Channel FG-100-PB with firmware FG-x00-PBV2.02.0.00 allows remote attackers to inject arbitrary web script or HTML via the DEVICENAME parameter to cgi-bin/CFGhttp/...

CVE-2014-6616: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Softing FG-100 PROFIBUS Single Channel FG-100-PB with firmware FG-x00-PBV2.02.0.00 allows remote attackers to inject arbitrary web script or HTML via the DEVICENAME parameter to cgi-bin/CFGhttp/...