1997 matches found
PT-2014-2197
Name of the Vulnerable Software and Affected Versions Smoothwall Express versions 3.0 SP3 and earlier, Smoothwall Express version 3.1 Description A cross-site scripting XSS issue exists in the web management interface, specifically in the httpd/cgi-bin/ipinfo.cgi file. This allows remote attacker...
PT-2014-2198
Name of the Vulnerable Software and Affected Versions Smoothwall Express versions 3.0 SP3 and earlier, Smoothwall Express version 3.1 Description A cross-site request forgery CSRF issue exists in the web management interface, specifically in the httpd/cgi-bin/shutdown.cgi endpoint. This allows...
CVE-2014-9430: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in httpd/cgi-bin/vpn.cgi/vpnconfig.dat in Smoothwall Express 3.0 SP3 allows remote attackers to inject arbitrary web script or HTML via the COMMENT parameter in an Add action...
CVE-2014-9431: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in Smoothwall Express 3.1 and 3.0 SP3 allow remote attackers to hijack the authentication of administrators for requests that change the 1 admin or 2 dial password via a request to httpd/cgi-bin/changepw.cgi...
CVE-2011-5284: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in the web management interface in httpd/cgi-bin/shutdown.cgi in Smoothwall Express 3.1 and 3.0 SP3 and earlier allows remote attackers to hijack the authentication of administrators for requests that perform a reboot via a request to...
SmoothWall 3.1 Cross Site Request Forgery / Cross Site Scripting
Exploit Title: SmoothWall 3.1 Multiple vulnerabilities Date: 21/12/2014 Author: Yann CAM @ Synetis Vendor or Software Link: www.smoothwall.org - www.smoothwall.org/download/ Version: 3.1 Category: CSRF password reset & XSS persistent Google dork: Tested on: Smoothwall Linux distribution Smoothwal...
PT-2014-8889
Name of the Vulnerable Software and Affected Versions D-link IP camera DCS-2103 version 1.0.0 Description The issue allows remote attackers to read arbitrary files via a .. dot dot in the file parameter of the cgi-bin/sddownload.cgi endpoint. Recommendations For D-link IP camera DCS-2103 version...
PT-2014-8893
Name of the Vulnerable Software and Affected Versions D-link IP camera DCS-2103 version 1.0.0 Description The issue allows remote attackers to obtain the installation path. This can be achieved by exploiting the "file" parameter to the "cgi-bin/sddownload.cgi" API endpoint, for example, by using ...
CVE-2014-9234: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in cgi-bin/sddownload.cgi in D-link IP camera DCS-2103 with firmware 1.0.0 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...
CVE-2014-9238: Improper Limitation of a Pathname to a Restricted Directory
D-link IP camera DCS-2103 with firmware 1.0.0 allows remote attackers to obtain the installation path via the file parameter to cgi-bin/sddownload.cgi, as demonstrated by a / forward slash character...
CVE-2014-2081: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in the login in webreports/cgi-bin/InfoStation.cgi in Innovative vtls-Virtua before 2013.2.4 and 2014.x before 2014.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password parameter...
PT-2014-4472
Name of the Vulnerable Software and Affected Versions Innovative vtls-Virtua versions prior to 2013.2.4 Innovative vtls-Virtua versions 2014.x prior to 2014.1.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the username or password parameter...
CVE-2013-3083: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in cgi-bin/systemsetting.exe in Belkin F5D8236-4 v2 allows remote attackers to hijack the authentication of administrators for requests that open the remote management interface on arbitrary ports via the remotemgmtenabled and remotemgmtport parameter...
PT-2014-2227
Name of the Vulnerable Software and Affected Versions Yealink VOIP Phones affected versions not specified Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the Local Phone book and Blacklist form of Yealink VOIP Phones. These vulnerabilities allow remote...
CVE-2012-1417: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com...
Aztech Routers - '/cgi-bin/AZ_Retrain.cgi' Denial of Service
/ source: https://www.securityfocus.com/bid/69809/info Multiple Aztech routers are prone to a denial-of-service vulnerability. Attackers may exploit this issue to cause an affected device to crash, resulting in a denial-of-service condition. Aztech DSL5018EN, DSL705E and DSL705EU are vulnerable. ...
VM-Turbo-Operations-Manager 4.5.x /cgi-bin/help/doIt.cgi 任意文件读取漏洞
No description provided by source...
CVE-2014-3851: Exposure of Sensitive Information to an Unauthorized Actor
usr/lib/cgi-bin/createpasswdfile.py in Pyplate 0.08 uses world-readable permissions for passwd.db, which allows local users to obtain the administrator password by reading this file...
Path traversal
Absolute path traversal vulnerability in Yealink VoIP Phone SIP-T38G allows remote authenticated users to read arbitrary files via a full pathname in the dumpConfigFile function in the command parameter to cgi-bin/cgiServer.exx...
