CVE-2023-37927

The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an authenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable device...

Bell Home Hub 3000 Security Vulnerability

Bell Home Hub 3000 is a virtual repair tool from Bell Canada. It is used to quickly detect and fix problems with Bell Fibe Internet, TV and home phone services. A security vulnerability exists in Bell Home Hub 3000 SG48222070, which originates from a remote user being able to retrieve a serial...

Synology SSL VPN Client Security Vulnerability

Synology SSL VPN Client is a VPN client software for secure connection to Synology NAS from China-based Synology Inc. A security vulnerability exists in Synology SSL VPN Client prior to version 1.4.7-0687, which stems from a buffer replication in the cgi component that does not check the input...

DEBIAN-CVE-2023-41260

Best Practical Request Tracker RT before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls...

PT-2023-6733 · Best Practical +2 · Request Tracker +2

Name of the Vulnerable Software and Affected Versions: Best Practical Request Tracker RT versions 4.4.6 and earlier Best Practical Request Tracker RT versions 5.0.4 and earlier Description: The issue allows Information Disclosure via fake or spoofed RT email headers in an email message or a...

Weintek cMT Operating System Command Injection Vulnerability

Weintek cMT is a human machine interface application from Weintek. A security vulnerability exists in the Weintek cMT3000 HMI Web CGI that originates from an anonymous attacker who can execute arbitrary commands while logged into the device...

The vulnerability of the CGI microprogramming interface of the D-Link DAP-1325 wireless signal booster allows a intruder to disclose protected information.

The vulnerability of the CGI microprogramming interface of the D-Link DAP-1325 wireless signal booster exists due to the lack of authentication checks before access to functions is granted. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

PT-2023-9272

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions prior to 9.4.52 Eclipse Jetty versions prior to 10.0.16 Eclipse Jetty versions prior to 11.0.16 Eclipse Jetty versions prior to 12.0.0-beta2 Description The issue is related to the formation of a command line that contai...

PT-2023-28081 · Synology · Synology Router Manager

Name of the Vulnerable Software and Affected Versions: Synology Router Manager SRM versions prior to 1.3.1-9346-6 Description: The issue is related to a Path Traversal vulnerability in the cgi component, allowing remote attackers to read specific files via unspecified vectors. Recommendations: Fo...

CVE-2023-33274

The authentication mechanism in PowerShield SNMP Web Pro 1.1 contains a vulnerability that allows unauthenticated users to directly access Common Gateway Interface CGI scripts without proper identification or authorization. This vulnerability arises from a lack of proper cookie verification and...

CVE-2023-33274

The authentication mechanism in PowerShield SNMP Web Pro 1.1 contains a vulnerability that allows unauthenticated users to directly access Common Gateway Interface CGI scripts without proper identification or authorization. This vulnerability arises from a lack of proper cookie verification and...

ruby/cgi-gem: HTTP response splitting in CGI

A vulnerability was found in Ruby that allows HTTP header injection. A CGI application using the CGI library may insert untrusted input into the HTTP response header. This issue can allow an attacker to insert a newline character to split a header and inject malicious content to deceive clients...

CVE-2023-29709

An issue was discovered in /cgi-bin/loginrj.cgi in Wildix WSG24POE version 103SP7D190822, allows attackers to bypass authentication...

ruby/cgi-gem: HTTP response splitting in CGI

A vulnerability was found in Ruby that allows HTTP header injection. A CGI application using the CGI library may insert untrusted input into the HTTP response header. This issue can allow an attacker to insert a newline character to split a header and inject malicious content to deceive clients...

Synology Router Manager 操作系统命令注入漏洞

Synology Router Manager SRM is a software for configuring and managing Synology routers from Synology Inc. in China. An operating system command injection vulnerability exists in Synology Router Manager SRM before version 1.2.5-8227-6. A remote attacker can exploit this vulnerability to execute...

The vulnerability of the WSGI Werkzeug web application library, related to the distribution of resources without restrictions or regulation, allows a hacker to replace the cookie file.

The vulnerability of the WSGI Werkzeug web application lies in the fact that the application does not properly control the consumption of internal resources when processing data with a complex structure and containing a large number of fields. Exploiting this vulnerability could allow an attacker...

The vulnerability of the CGI microprogramming interface of the Nighthawk WiFi 6 Router (RAX30) allows a hacker to execute arbitrary code.

The vulnerability of the CGI microprogramming interface of the Nighthawk WiFi 6 Router RAX30 lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2023-2268 · NetGear · Netgear Nighthawk Wifi6 Router

Name of the Vulnerable Software and Affected Versions: NETGEAR Nighthawk WiFi6 Router versions prior to V1.0.10.94 Description: The issue is related to a buffer overflow vulnerability in the CGI mechanisms of the router's software. This vulnerability could allow an attacker to execute arbitrary...

SUSE CVE-2003-0709

Buffer overflow in the whois client, which is not setuid but is sometimes called from within CGI programs, may allow remote attackers to execute arbitrary code via a long command line option...

SUSE CVE-2006-2489

Integer overflow in CGI scripts in Nagios 1.x before 1.4.1 and 2.x before 2.3.1 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a content length Content-Length HTTP header. NOTE: this is a different vulnerability than CVE-2006-2162...