CVE-2014-6616

Cross-site scripting XSS vulnerability in Softing FG-100 PROFIBUS Single Channel FG-100-PB with firmware FG-x00-PBV2.02.0.00 allows remote attackers to inject arbitrary web script or HTML via the DEVICENAME parameter to cgi-bin/CFGhttp/...

Edimax PS-1206MF - Web Admin Auth Bypass Vulnerability

Exploit for hardware platform in category web applications Title: Edimax PS-1206MF - Web Admin Auth Bypass Date: 30.08.15 Vendor: edimax.com Firmware version: 4.8.25 Author: Smash Contact: smash at devilteam.pl HTTP authorization is not being properly verified while sendind POST requests to .cgi,...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Ferrari - PHP CGI Argument Injection (RCE) Vulnerability

Document Title: =============== Ferrari - PHP CGI Argument Injection RCE Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1562 Video: http://www.vulnerability-lab.com/getcontent.php?id=1561 Vulnerability Magazine:...

Security Advisory - DoS Vulnerability in Huawei MBB Product

Huawei MBB Mobile Broadband product E3272s has a Denial of Service DoS vulnerability. An attacker could send a malicious packet to the Common Gateway Interface CGI of target device and make it fail while setting port attribute, which cause a DoS attack. Vulnerability ID: HWPSIRT-2015-05103 This...

[SECURITY] Fedora 21 Update: lighttpd-1.4.36-1.fc21

Secure, fast, compliant and very flexible web-server which has been optimiz ed for high-performance environments. It has a very low memory footprint compa red to other webservers and takes care of cpu-load. Its advanced feature-set FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many mo...

Ferrari Simulator PHP CGI Argument Injection

Document Title: =============== Ferrari - PHP CGI Argument Injection RCE Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1562 Video: http://www.vulnerability-lab.com/getcontent.php?id=1561 Vulnerability Magazine:...

Ferrari - PHP CGI Argument Injection (RCE) Vulnerability

Document Title: =============== Ferrari - PHP CGI Argument Injection RCE Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1562 Video: http://www.vulnerability-lab.com/getcontent.php?id=1561 Vulnerability Magazine:...

QNAP TS_x09 Turbo NAS Devices XSS Vulnerability (Jul 2015) - Active Check

QNAP TS-x09 Turbo NAS devices are prone to a reflected cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

python: CGIHTTPServer module does not properly handle URL-encoded path separators in URLs

It was discovered that the CGIHTTPServer module incorrectly handled URL encoded paths. A remote attacker could use this flaw to execute scripts outside of the cgi-bin directory, or disclose source of scripts in the cgi-bin directory...

15 TOTOLINK Router Models - Multiple RCE Vulnerabilities

15 TOTOLINK router models are vulnerable to multiple remote command execution vulnerabilities. Advisory Information Title: 15 TOTOLINK router models vulnerable to multiple RCEs Advisory URL: https://pierrekim.github.io/advisories/2015-totolink-0x00.txt Blog URL:...

D-Link Cookie Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'D-Link Cookie Command Execution', 'Description' = %q This module exploits an anonymous remote upload and code execution vulnerabilit...

OvisLink AirLive IP Cameras WL-2000CAM and Airlive IP Cameras POE-200CAM Operating System Command Injection Vulnerability

OvisLink Airlive IP Cameras WL-2000CAM and Airlive IP Cameras POE-200CAM are both network camera products from OvisLink. An operating system command injection vulnerability exists in the /cgi-bin/mft/wirelessmft.cgi binary file in the OvisLink AirLive IP Cameras WL-2000CAM and Airlive IP Cameras...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

[CORE-2015-0012] - AirLive Multiple Products OS Command Injection

Advisory Information Title: AirLive Multiple Products OS Command Injection Advisory ID: CORE-2015-0012 Advisory URL: http://www.coresecurity.com/advisories/airlive-multiple-products-os-command-injection Date published: 2015-07-06 Date of last update: 2015-07-06 Vendors contacted: AirLive Release...

[CORE-2015-0011] - AirLink101 SkyIPCam1620W OS Command Injection

Advisory Information Title: AirLink101 SkyIPCam1620W OS Command Injection Advisory ID: CORE-2015-0011 Advisory URL: http://www.coresecurity.com/advisories/airlink101-skyipcam1620w-os-command-injection Date published: 2015-07-08 Date of last update: 2015-07-08 Vendors contacted: AirLink101...

AirLive (Multiple Products) - OS Command Injection

AirLive Multiple Products - OS Command Injection 1. Advisory Information Title: AirLive Multiple Products OS Command Injection Advisory ID: CORE-2015-0012 Advisory URL: http://www.coresecurity.com/advisories/airlive-multiple-products-os-command-injection Date published: 2015-07-06 Date of last...

AirLive 系列 IP 摄像头命令注入漏洞

大量AirLive IP监控摄像机被曝存在命令注入漏洞，攻击者可利用该漏洞窃取用户登录凭证并控制设备。漏洞原理及影响范围OvisLink公司制造的大量AirLive IP监控摄像机中都存在着命令注入漏洞，通过该漏洞，网络攻击者可以解码用户登录凭证，并可以完全控制监控设备。根据Core安全公司的专家们的消息，至少5种不同型号的AirLive监控摄像机都受此漏洞的影响。这5种型号的监控摄像机分别如下：1、AirLive BU-2015，固件版本1.03.18 16.06.20142、AirLive BU-3026，固件版本1.43 21.08.20143、AirLive...

AirLink101 SkyIPCam1620W - OS Command Injection

AirLink101 SkyIPCam1620W - OS Command Injection 1. Advisory Information Title: AirLink101 SkyIPCam1620W OS Command Injection Advisory ID: CORE-2015-0011 Advisory URL: http://www.coresecurity.com/advisories/airlink101-skyipcam1620w-os-command-injection Date published: 2015-07-08 Date of last updat...