PT-2021-13865 · Privoxy +4 · Privoxy +4

Name of the Vulnerable Software and Affected Versions: privoxy versions prior to 3.0.32 Description: A flaw was found in the software, which can cause a crash via a crafted CGI request if it is toggled off. Recommendations: For versions prior to 3.0.32, update to version 3.0.32 or later to resolv...

UBUNTU-CVE-2020-35681

Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channe...

CVE-2021-3149

On Netshield NANO 25 10.2.18 devices, /usr/local/webmin/System/manualping.cgi allows OS command injection after authentication by the attacker because the system C library function is used unsafely...

CVE-2021-27210

TP-Link Archer C5v 1.7181221 devices allows remote attackers to retrieve cleartext credentials via USERCFG0,0,0,0,0,00,0,0,0,0,00,0 to the /cgi?1&5 URI...

Seeds Acmailer Db and Seeds Acmailer Security Vulnerabilities

Seeds Acmailer and Seeds Acmailer Db are both products of Seeds Japan, Seeds Acmailer is a CGI software for supporting mail services, Seeds Acmailer Db is a CGI software for supporting mail services. This software will add Mysql database connectivity compared to the standard version and will...

The vulnerability of D-Link DSL-2640B router software’s CGI modules allows attackers to increase their privileges.

The vulnerability of D-Link DSL-2640B router software’s CGI modules is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers, operating remotely, to gain increased privileges...

CVE-2020-29058

An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices...

Pulse Secure Pulse Connect Secure Cross-Site Scripting Vulnerability (CNVD-2020-60094)

Pulse Secure Pulse Connect Secure a.k.a. PCS, formerly known as Juniper Junos Pulse is a suite of SSL VPN solutions from Pulse Secure in the United States. A cross-site scripting vulnerability exists in Pulse Connect Secure versions prior to 9.1R9, which stems from a vulnerability in the web...

httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for CGI applications

It has been discovered that the modsession module of Apache HTTP Server httpd, through version 2.4.29, has an improper input validation flaw in the way it handles HTTP session headers in some configurations. A remote attacker may influence their content by using a "Session" header...

CVE-2020-24553

...

AZL-79064 CVE-2020-24553 affecting package golang 1.25.7-1

Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header...

PT-2020-6513 · D Link · D-Link Dap-2020

Name of the Vulnerable Software and Affected Versions: D-Link DAP-2020 version 1.01rc001 Description: The issue is related to a buffer overflow on the stack in the webproc getpage scenario of the D-Link DAP-2020 Wi-Fi access point's firmware. This can be exploited by network-adjacent attackers to...

The vulnerability of the uhttpd function in the embedded operating system OpenWrt allows a hacker to trigger a service failure.

The vulnerability of the uhttpd function in the embedded operating system OpenWrt relates to the execution of operations outside the buffer boundaries. Exploiting this vulnerability allows a malicious actor to trigger a service failure by sending a specially crafted HTTP POST request to the CGI...

UBUNTU-CVE-2020-13977

Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files. NOTE: this vulnerability has been...

Cherokee Buffer Overflow Vulnerability

Cherokee is an open source web server. A buffer overflow vulnerability exists in the cherokeehandlercgiaddenvpair of the handlercgi.c file in Cherokee 1.2.104 and earlier versions. The vulnerability stems from a network system or product performing operations in memory without properly validating...

DEBIAN-CVE-2016-1000111

Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect a CGI application's outbou...

DEBIAN-CVE-2014-4650

The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as...

CVE-2020-8126

A privilege escalation in the EdgeSwitch prior to version 1.7.1, an CGI script don't fully sanitize the user input resulting in local commands execution, allowing an operator user Privilege-1 to escalate privileges and became administrator Privilege-15...

CVE-2019-19143

TP-LINK TL-WR849N 0.9.1 4.16 devices do not require authentication to replace the firmware via a POST request to the cgi/softup URI...

The vulnerability of the Apache Tomcat application server arises from insufficient validation of input data, allowing attackers to execute arbitrary code.

The vulnerability of the Apache Tomcat application server exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely, as a result of the default enabled parameter “enableCmdLineArguments” of the CGI server...