CVE-2025-40907: Dependency on Vulnerable Third-Party Component

FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 aka fcgi library. The included FastCGI library is affected by CVE-2025-23016, causing an integer overflow and resultant heap-based buffer overflow via crafted nameLen or valueLen values in data to the IPC...

CBL Mariner 2.0 Security Update: fcgi (CVE-2025-23016)

The version of fcgi installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-23016 advisory. - FastCGI fcgi2 aka fcgi 2.x through 2.4.4 has an integer overflow and resultant heap-based buffer overflow via...

Azure Linux 3.0 Security Update: fcgi (CVE-2025-23016)

The version of fcgi installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-23016 advisory. - FastCGI fcgi2 aka fcgi 2.x through 2.4.4 has an integer overflow and resultant heap-based buffer overflow via...

CVE-2025-23016 affecting package fcgi for versions less than 2.4.5-1

CVE-2025-23016 affecting package fcgi for versions less than 2.4.5-1. An upgraded version of the package is available that resolves this issue...

Mageia: Security Advisory (MGASA-2025-0144)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-23016 affecting package fcgi for versions less than 2.4.5-1

CVE-2025-23016 affecting package fcgi for versions less than 2.4.5-1. An upgraded version of the package is available that resolves this issue...

The vulnerability of the ReadParams function in the implementation of the FastCGI protocol, provided by the fcgii2 library (fcgi), allows a hacker to execute arbitrary code.

The vulnerability of the ReadParams function in the FastCGI protocol implementation of the fcgii2 fcgi library is related to integer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending requests containing specially crafted values for parameters...

CVE-2025-3546

A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affected by this vulnerability is the function FCGICheckStringIfContainsSemicolon of the file /api/wizard/getLanguage of the component HTTP POS...

CVE-2025-3540 H3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request getCapability FCGI_WizardProtoProcess command injection

A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by this vulnerability is the function FCGIWizardProtoProcess of the file /api/wizard/getCapability of the component HTTP POST Request Handler. The manipulation...

PT-2025-21645

Name of the Vulnerable Software and Affected Versions: FCGI versions 0.44 through 0.82 Description: The included FastCGI library in FCGI is affected, causing an integer overflow and resultant heap-based buffer overflow via crafted nameLen or valueLen values in data to the IPC socket. This occurs ...

CBL Mariner 2.0 Security Update: fcgi (CVE-2012-6687)

The version of fcgi installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2012-6687 advisory. - FastCGI aka fcgi and libfcgi 2.4.0 allows remote attackers to cause a denial of service segmentation fault and...

CVE-2012-6687 affecting package fcgi for versions less than 2.4.0-7

CVE-2012-6687 affecting package fcgi for versions less than 2.4.0-7. A patched version of the package is available...

BIT-TYPO3-2023-24814

TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 core component GeneralUtility::getIndpEnv uses the unfiltered server environment variable PATHINFO, which allows attackers to inject malicious content. In...

BIT-GOLANG-2020-24553

Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header...

Oracle Linux 9 : haproxy (ELSA-2023-6496)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-6496 advisory. 2.4.22-1 - Update to 2.4.22 2196530 2.4.17-7 - Fix uninitizalized resevered bytes CVE-2023-0836, 2180861 Tenable has extracted the preceding description block...

RHEL 9 : haproxy (RHSA-2023:6496)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6496 advisory. The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy: data le...

CVE-2023-46396

Audimex 15.0.0 is vulnerable to Cross Site Scripting XSS in /audimex/cgi-bin/wal.fcgi via company parameter search filters...

PT-2023-27875 · Plixer · Plixer Scrutinizer

Name of the Vulnerable Software and Affected Versions: Plixer Scrutinizer versions prior to 19.3.1 Description: An issue was discovered in the /fcgi/scrut fcgi.fcgi endpoint, specifically in the csvExportReport endpoint action generateCSV, which is vulnerable to SQL injection through the sorting...

CVE-2023-41261: Improper Authentication

An issue was discovered in /fcgi/scrutfcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV does not require authentication and allows an unauthenticated user to export a report and access the results...

Information disclosure

An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGIBEGINREQUEST record. Sensitive data may be disclos...