CVE-2019-17663

D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection...

CVE-2019-17663

D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection...

CVE-2019-17663

The CVE-2019-17663 entries describe a cross-site scripting vulnerability in D-Link DIR-866L firmware (version 1.03B04) where HtmlResponseMessage in the device’s common gateway interface can be abused to perform a common injection. Root cause centers on how input data is processed by HtmlResponseM...

Unspecified Vulnerability in Compal CH7465LG

The Compal CH7465LG is a wireless router from Compal Computer Industries Compal of Taiwan, China. A security vulnerability exists in the setter.xml component of the Common Gateway Interface in the Compal CH7465LG version 6.12.18.25-2p4, which is caused by the program not properly validating the...

CVE-2019-17499

The setter.xml component of the Common Gateway Interface on Compal CH7465LG 6.12.18.25-2p4 devices does not properly validate ping command arguments, which allows remote authenticated users to execute OS commands as root via shell metacharacters in the TargetIP parameter...

CVE-2019-17499

The setter.xml component of the Common Gateway Interface on Compal CH7465LG 6.12.18.25-2p4 devices does not properly validate ping command arguments, which allows remote authenticated users to execute OS commands as root via shell metacharacters in the TargetIP parameter...

Command injection

Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers...

PT-2019-6104 · D Link · D-Link Dir-866L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-866L version 1.03B04 Description: The issue is related to errors in processing input data in the HtmlResponseMessage component of the D-Link DIR-866L wireless router's firmware. This can be exploited by a remote attacker to impleme...

PYSEC-2019-178

When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing...

Elastic APM agent for Python 5.1.0 security update

Elastic APM agent for Python client CGI proxy redirection flaw ESA-2019-11 When the Elastic APM agent for Python is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a prox...

CVE-2019-1579

CVE-2019-1579 is a Remote Code Execution in PAN-OS when GlobalProtect Portal or Gateway Interface is enabled. It affects PAN-OS 7.1.x before 7.1.19, 8.0.x before 8.0.12, and 8.1.x before 8.1.3, allowing an unauthenticated attacker to execute arbitrary code. The flaw’s root cause is an issue in th...

tomcat: Remote Code Execution on Windows

A flaw was discovered in Apache Tomcat, where a Java Runtime Environment can pass a command-line argument in the Windows operating system. The execution of arbitrary commands via Tomcat’s Common Gateway Interface CGI Servlet, allows an attacker to perform remote code execution...

Scanners-Box

This is a collection of open-source scanning tools and wordlists for web application security testing. The repository, Scanners-Box, is a collection of tools from various contributors, including lijiejie, ringzero, and others. The tools are categorized into subdomains, database vulnerability...

CVE-2018-19646

The Python CGI scripts in PWS in Imperva SecureSphere 13.0.10, 13.1.10, and 13.2.10 allow remote attackers to execute arbitrary OS commands because command-line arguments are mishandled...

httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for CGI applications

It has been discovered that the modsession module of Apache HTTP Server httpd, through version 2.4.29, has an improper input validation flaw in the way it handles HTTP session headers in some configurations. A remote attacker may influence their content by using a "Session" header...

NUUO NVRMini2 Remote Code Execution Vulnerability

NUUO is one of the surveillance solution providers and NUUO NVRMini 2 is the NVR solution with NAS functionality. A remote code execution vulnerability exists in NUUO NVRMini 2. Due to a flaw in program logic, a stack overflow was caused by processing a GET request from /cgi-bin/cgisystem without...

Schneider Electric Pelco Sarix Professional 1st generation cameras buffer overflow vulnerability

Schneider Electric Pelco Sarix Professional 1st generation cameras is an IP camera device from Schneider Electric France. A buffer overflow vulnerability exists in the cgi program 'set' in Schneider Electric Pelco Sarix Professional 1st generation cameras using firmware versions prior to 3.29.69...

Multiple Dell Products Brute Force Vulnerabilities

Dell EMC iDRAC6, among others, is a system management solution that includes both hardware and software from Dell USA. The solution provides remote management, crash system recovery and power control for Dell PowerEdge systems. A security vulnerability exists in multiple Dell products that stems...

USN-3665-1 tomcat7, tomcat8 vulnerabilities

It was discovered that Tomcat incorrectly handled being configured with HTTP PUTs enabled. A remote attacker could use this issue to upload a JSP file to the server and execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 17.10. CVE-2017-12616,...

DEBIAN-CVE-2017-0356

A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters...