434 matches found
SUSE CVE-2008-0599
The initrequestinfo function in sapi/cgi/cgimain.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATHTRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI...
SUSE CVE-2008-1111
modcgi in lighttpd 1.4.18 sends the source code of CGI scripts instead of a 500 error when a fork failure occurs, which might allow remote attackers to obtain sensitive information...
SUSE CVE-2008-1360
Cross-site scripting XSS vulnerability in Nagios before 2.11 allows remote attackers to inject arbitrary web script or HTML via unknown vectors to unspecified CGI scripts, a different issue than CVE-2007-5624...
SUSE CVE-2012-2335
php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a protection mechanism in PHP 5.3.12 and 5.4.2 and execute arbitrary code by leveraging improper interaction between the PHP sapi/cgi/cgimain.c component and a query string beginning with a +...
SUSE CVE-2013-3738
A File Inclusion vulnerability exists in Zabbix 2.0.6 due to inadequate sanitization of request strings in CGI scripts, which could let a remote malicious user execute arbitrary code...
SUSE CVE-2016-1000108
yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound...
SUSE CVE-2018-1283
In Apache httpd 2.4.0 to 2.4.29, when modsession is configured to forward its session data to CGI applications SessionEnv on, not the default, a remote user may influence their content by using a "Session" header. This comes from the "HTTPSESSION" variable name used by modsession to forward its...
SUSE CVE-2020-24553
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header...
SUSE CVE-2021-20209
A memory leak vulnerability was found in Privoxy before 3.0.29 in the show-status CGI handler when no action files are configured...
SUSE CVE-2021-20273
A flaw was found in privoxy before 3.0.32. A crash can occur via a crafted CGI request if Privoxy is toggled off...
SUSE CVE-2022-2255
A vulnerability was found in modwsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing...
PT-2023-14796 · Opentext · Opentext Content Suite Platform
Name of the Vulnerable Software and Affected Versions: OpenText Content Suite Platform version 16.2.19.1803 Description: An issue was discovered in the Common Gateway Interface CGI program cs.exe, allowing an attacker to increase or decrease an arbitrary memory address by 1 and trigger a call to ...
USN-5806-1 ruby2.3 vulnerability
Hiroshi Tokumaru discovered that Ruby did not properly handle certain user input for applications which generate HTTP responses using cgi gem. An attacker could possibly use this issue to maliciously modify the response a user would receive from a vulnerable application...
CVE-2022-43391
A buffer overflow vulnerability in the parameter of the CGI program in Zyxel NR7101 firmware prior to V1.15ACCC.3C0, which could allow an authenticated attacker to cause denial-of-service DoS conditions by sending a crafted HTTP request...
Zyxel NR7101 操作系统命令注入漏洞
The Zyxel NR7101 is a router from Hopkins Zyxel. The operating system command injection vulnerability in the Zyxel NR7101 firmware prior to v1.15 ACCC.3 C0 stems from a vulnerability in its CGI program that allows an authenticated attacker to achieve command injection leading to the execution of...
PT-2023-1416 · Zyxel · Zyxel Nr7101
Name of the Vulnerable Software and Affected Versions: Zyxel NR7101 firmware versions prior to V1.15ACCC.3C0 Description: The issue is caused by a buffer overflow vulnerability in the parameter of the CGI program. This could allow an authenticated attacker to cause denial-of-service DoS condition...
PT-2022-26929 · Buffalo · Wsr-2533Dhp3 +4
Name of the Vulnerable Software and Affected Versions: Buffalo network devices WSR-3200AX4S versions 1.26 and earlier Buffalo network devices WSR-3200AX4B version 1.25 Buffalo network devices WSR-2533DHP2 versions 1.22 and earlier Buffalo network devices WSR-A2533DHP2 versions 1.22 and earlier...
The vulnerability of the Common Gateway Interface (CGI) interface of microprogramming software for network devices such as ZyXEL USG, ZyWALL, USG FLEX, ATP, and VPN allows attackers to execute cross-site scripting attacks.
The vulnerability of the Common Gateway Interface CGI interface of microprogrammed network devices such as ZyXEL USG, ZyWALL, USG FLEX, ATP, and VPN is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-sit...
ALPINE-CVE-2021-33621
The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object...
