1997 matches found
CVE-2009-2765
httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI...
CVE-2009-2765
The DD-WRT firmware (versions 24 sp1 and others before build 12533 ) is vulnerable to a remote command injection flaw in the httpd.c component of the management GUI. The root cause is a failure to adequately sanitize user-supplied input data, allowing unauthenticated attackers to execute arbitrar...
CVE-2009-2765: Improper Input Validation
httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI...
PT-2009-5129
Name of the Vulnerable Software and Affected Versions DD-WRT versions prior to build 12533 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a "cgi-bin/" URI. This is due to a problem in the httpd.c in httpd in the management GUI...
CVE-2009-2367: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
cgi-bin/makecgi-pro in Iomega StorCenter Pro generates predictable session IDs, which allows remote attackers to hijack active sessions and gain privileges via brute force guessing attacks on the sessionid parameter...
CVE-2009-2322
The CVE-2009-2322 entry concerns the Axesstel MV 410R router. A vulnerability in the CGI script cgi-bin/sysconf.cgi enables cross-site scripting (XSS), allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. The NVD metrics indicate a Medium severity (CVSS v2: AV...
CVE-2009-2323: Cross-Site Request Forgery (CSRF)
The web interface on the Axesstel MV 410R redirects users back to the referring page after execution of some CGI scripts, which makes it easier for remote attackers to avoid detection of cross-site request forgery CSRF attacks, as demonstrated by a redirect from the cgi-bin/wireless.cgi script...
CVE-2009-2321: Undefined Security Weakness
cgi-bin/sysconf.cgi on the Axesstel MV 410R allows remote attackers to cause a denial of service configuration reset via a RESTORE=RESTORE query string...
CVE-2009-2322: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in cgi-bin/sysconf.cgi on the Axesstel MV 410R allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2009-2256: Improper Input Validation
The administrative web interface on the Netgear DG632 with firmware 3.4.0ap allows remote attackers to cause a denial of service web outage via an HTTP POST request to cgi-bin/firmwarecfg...
CVE-2009-2258: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in cgi-bin/webcm in the administrative web interface on the Netgear DG632 with firmware 3.4.0ap allows remote attackers to list arbitrary directories via a .. dot dot in the nextpage parameter...
Command injection
cgi-bin/webutil.pl in The Puppet Master WebUtil 2.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the whois command...
CVE-2008-6555
cgi-bin/webutil.pl in The Puppet Master WebUtil allows remote attackers to execute arbitrary commands via shell metacharacters in the dig command...
CVE-2008-6556: Improper Input Validation
cgi-bin/webutil.pl in The Puppet Master WebUtil 2.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the whois command...
CVE-2008-6554: Improper Neutralization of Special Elements used in an OS Command
cgi-bin/script in Aztech ADSL2/2+ 4-port router 3.7.0 build 070426 allows remote attackers to execute arbitrary commands via shell metacharacters in the query string...
CVE-2008-6555: Improper Input Validation
cgi-bin/webutil.pl in The Puppet Master WebUtil allows remote attackers to execute arbitrary commands via shell metacharacters in the dig command...
CVE-2008-6557: Improper Input Validation
cgi-bin/webutil.pl in The Puppet Master WebUtil 2.7 allows remote attackers to execute arbitrary commands via shell metacharacters in the details command...
CVE-2009-0680: Improper Limitation of a Pathname to a Restricted Directory
cgi-bin/welcome/VPNonly in the web interface in Netgear SSL312 allows remote attackers to cause a denial of service device crash via a crafted query string, as demonstrated using directory traversal sequences...
i-dreams GB 5.4 Final (admin.dat) File Disclosure Vulnerability
Exploit for cgi platform in category web applications =============================================================== i-dreams GB 5.4 Final admin.dat File Disclosure Vulnerability ===============================================================...