DEBIAN-CVE-2016-1000111

Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect a CGI application's outbou...

DEBIAN-CVE-2014-4650

The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as...

CVE-2020-8126

A privilege escalation in the EdgeSwitch prior to version 1.7.1, an CGI script don't fully sanitize the user input resulting in local commands execution, allowing an operator user Privilege-1 to escalate privileges and became administrator Privilege-15...

CVE-2019-19143

TP-LINK TL-WR849N 0.9.1 4.16 devices do not require authentication to replace the firmware via a POST request to the cgi/softup URI...

The vulnerability of the Apache Tomcat application server arises from insufficient validation of input data, allowing attackers to execute arbitrary code.

The vulnerability of the Apache Tomcat application server exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely, as a result of the default enabled parameter “enableCmdLineArguments” of the CGI server...

CVE-2019-17663

D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection...

CVE-2019-17663

D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection...

CVE-2019-17663

The CVE-2019-17663 entries describe a cross-site scripting vulnerability in D-Link DIR-866L firmware (version 1.03B04) where HtmlResponseMessage in the device’s common gateway interface can be abused to perform a common injection. Root cause centers on how input data is processed by HtmlResponseM...

CVE-2019-17663: Improper Neutralization of Input During Web Page Generation

D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection...

Unspecified Vulnerability in Compal CH7465LG

The Compal CH7465LG is a wireless router from Compal Computer Industries Compal of Taiwan, China. A security vulnerability exists in the setter.xml component of the Common Gateway Interface in the Compal CH7465LG version 6.12.18.25-2p4, which is caused by the program not properly validating the...

CVE-2019-17499

The setter.xml component of the Common Gateway Interface on Compal CH7465LG 6.12.18.25-2p4 devices does not properly validate ping command arguments, which allows remote authenticated users to execute OS commands as root via shell metacharacters in the TargetIP parameter...

CVE-2019-17499

The setter.xml component of the Common Gateway Interface on Compal CH7465LG 6.12.18.25-2p4 devices does not properly validate ping command arguments, which allows remote authenticated users to execute OS commands as root via shell metacharacters in the TargetIP parameter...

CVE-2019-17499: Improper Neutralization of Special Elements used in an OS Command

The setter.xml component of the Common Gateway Interface on Compal CH7465LG 6.12.18.25-2p4 devices does not properly validate ping command arguments, which allows remote authenticated users to execute OS commands as root via shell metacharacters in the TargetIP parameter...

Command injection

Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers...

PT-2019-6104 · D Link · D-Link Dir-866L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-866L version 1.03B04 Description: The issue is related to errors in processing input data in the HtmlResponseMessage component of the D-Link DIR-866L wireless router's firmware. This can be exploited by a remote attacker to impleme...

PYSEC-2019-178

When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing...

Elastic APM agent for Python 5.1.0 security update

Elastic APM agent for Python client CGI proxy redirection flaw ESA-2019-11 When the Elastic APM agent for Python is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a prox...

CVE-2019-1579

CVE-2019-1579 is a Remote Code Execution in PAN-OS when GlobalProtect Portal or Gateway Interface is enabled. It affects PAN-OS 7.1.x before 7.1.19, 8.0.x before 8.0.12, and 8.1.x before 8.1.3, allowing an unauthenticated attacker to execute arbitrary code. The flaw’s root cause is an issue in th...

CVE-2019-1579: Use of Externally-Controlled Format String

Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code...

tomcat: Remote Code Execution on Windows

A flaw was discovered in Apache Tomcat, where a Java Runtime Environment can pass a command-line argument in the Windows operating system. The execution of arbitrary commands via Tomcat’s Common Gateway Interface CGI Servlet, allows an attacker to perform remote code execution...