Design/Logic Flaw

cgi-bin/tsaws.cgi in Franklin Fueling Systems TS-550 evo with firmware 2.0.0.6833 and other versions before 2.4.0 allows remote attackers to discover sensitive information user names and password hashes via the cmdWebGetConfiguration action in a TSAREQUEST...

CVE-2013-7247: Undefined Security Weakness

cgi-bin/tsaws.cgi in Franklin Fueling Systems TS-550 evo with firmware 2.0.0.6833 and other versions before 2.4.0 allows remote attackers to discover sensitive information user names and password hashes via the cmdWebGetConfiguration action in a TSAREQUEST...

PT-2014-3302

Name of the Vulnerable Software and Affected Versions Franklin Fueling Systems TS-550 evo versions prior to 2.4.0 Description The issue allows remote attackers to discover sensitive information, including user names and password hashes, via the "cmdWebGetConfiguration" action in a "TSA REQUEST" t...

Path traversal

Absolute path traversal vulnerability in cgi-bin/jc.cgi in QNAP QTS before 4.1.0 allows remote attackers to read arbitrary files via a full pathname in the f parameter...

CVE-2013-7174: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in cgi-bin/jc.cgi in QNAP QTS before 4.1.0 allows remote attackers to read arbitrary files via a full pathname in the f parameter...

PT-2014-3276

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 4.1.0 Description The issue allows remote attackers to read arbitrary files via a full pathname in the f parameter in the /cgi-bin/jc.cgi API endpoint. Recommendations For versions prior to 4.1.0, update to version...

PT-2013-6268

Name of the Vulnerable Software and Affected Versions McAfee Email Gateway version 7.6 Description The issue concerns SQL injection vulnerabilities in the /admin/cgi-bin/rpc/doReport/18 endpoint. Remote authenticated users can execute arbitrary SQL commands by manipulating specific JSON keys,...

Cross site request forgery (csrf)

cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrftoken parameter, which allows remote attackers to perform cross-site request forgery CSRF attacks...

CVE-2013-6826: Cross-Site Request Forgery (CSRF)

cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrftoken parameter, which allows remote attackers to perform cross-site request forgery CSRF attacks...

PT-2013-6135

Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions prior to 5.0.5 Description The issue is related to the improper validation of the csrf token parameter in the cgi-bin/module//sysmanager/admin/SYSAdminUserDialog endpoint. This allows remote attackers to perform cross-si...

Apache + PHP 5.3.12 5.4.2 - cgi-bin Remote Code Execution

Apache + PHP 5.3.12 5.4.2 - cgi-bin Remote Code Execution / Apache Magica by Kingcope / / gcc apache-magika.c -o apache-magika -lssl / / This is a code execution bug in the combination of Apache and PHP. On Debian and Ubuntu the vulnerability is present in the default install of the php5-cgi...

Apache + PHP < 5.3.12 / < 5.4.2 - cgi-bin Remote Code Execution

/ Apache Magica by Kingcope / / gcc apache-magika.c -o apache-magika -lssl / / This is a code execution bug in the combination of Apache and PHP. On Debian and Ubuntu the vulnerability is present in the default install of the php5-cgi package. When the php5-cgi package is installed on Debian and...

CVE-2013-3686

cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password via a list action...

CVE-2013-2578

cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12sign6 allows remote attackers to execute arbitrary commands via shell metacharacters in 1 the ServerName parameter and 2 other unspecified...

CVE-2013-3686

cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password via a list action...

PT-2013-3847

Name of the Vulnerable Software and Affected Versions TP-Link IP Cameras versions prior to beta firmware LM.1.6.18P12 sign6 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the ServerName parameter and other unspecified parameters in the...

PT-2013-3850

Name of the Vulnerable Software and Affected Versions TP-Link IP Cameras versions prior to beta firmware LM.1.6.18P12 sign6 Description The issue allows remote attackers to modify the firmware revision. This is achieved through the cgi-bin/firmwareupgrade endpoint, by utilizing a "preset" action...

CVE-2013-3686: Undefined Security Weakness

cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password via a list action...

CVE-2013-2581: Undefined Security Weakness

cgi-bin/firmwareupgrade in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12sign6 allows remote attackers to modify the firmware revision via a "preset" action...

CVE-2013-2578: Improper Neutralization of Special Elements used in an OS Command

cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12sign6 allows remote attackers to execute arbitrary commands via shell metacharacters in 1 the ServerName parameter and 2 other unspecified...