CVE-2018-17563

A Malformed Input String to /cgi-bin/api-getlinestatus on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's configuration in cleartext...

Input validation

A Malformed Input String to /cgi-bin/api-getlinestatus on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's configuration in cleartext...

PT-2019-9505

Name of the Vulnerable Software and Affected Versions Grandstream GXP16xx VoIP version 1.0.4.128 Description The issue arises from a malformed input string sent to the "/cgi-bin/delete CA" API endpoint, allowing attackers to delete configuration parameters and gain admin access to the device...

PT-2019-9539

Name of the Vulnerable Software and Affected Versions D-Link DSL-3782 version 1.01 Description A stored XSS issue exists in the web interface, allowing authenticated attackers to inject JavaScript or HTML payload inside the ACL page. The injected payload is executed in a user's browser when the...

Linux/x86 - NOT Encoder / Decoder - execve(/bin/sh) Shellcode (44 bytes)

/ ; NOT-Encoder.py ; Author: Daniele Votta ; Description: This program encode shellcode with NOT technique. ; Tested on: i686 GNU/Linux ; Shellcode Length:25 !/usr/bin/python Python NOT Encoder Execve /bin/sh shellcode...

PT-2019-9504

Name of the Vulnerable Software and Affected Versions Grandstream GXP16xx VoIP version 1.0.4.128 Description The issue allows attackers to dump the device's configuration in cleartext by sending a malformed input string to the "cgi-bin/api-get line status" API endpoint. Recommendations For...

CVE-2018-17563: Missing Encryption of Sensitive Data

A Malformed Input String to /cgi-bin/api-getlinestatus on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's configuration in cleartext...

CVE-2018-17989: Improper Neutralization of Input During Web Page Generation

A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to inject a JavaScript or HTML payload inside the ACL page. The injected payload would be executed in a user's browser when "/cgi-bin/NewGUI/Acl.asp" is request...

PT-2019-9941

Name of the Vulnerable Software and Affected Versions Teltonika RTU9XX e.g., RUT950 versions R 31.04.89 through R 00.05.00.4 Description The issue concerns the authentication functionality in the /cgi-bin/luci endpoint, which is not protected against automated login attempts. This allows an...

CVE-2018-19879: Improper Restriction of Excessive Authentication Attempts

An issue was discovered in /cgi-bin/luci on Teltonika RTU9XX e.g., RUT950 R31.04.89 before R00.05.00.5 devices. The authentication functionality is not protected from automated tools used to make login attempts to the application. An anonymous attacker has the ability to make unlimited login...

CVE-2019-7383

An issue was discovered on Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W devices with firmware V1.1-R2.1TRUNK-20181105.bin. A shell command injection occurs by editing the description of an ISP file. The file network/isp/ispupdateedit.php does not properly validate user input, which leads to...

CVE-2019-6967

AirTies Air5341 1.0.0.12 devices allow cgi-bin/login CSRF...

Design/Logic Flaw

cgi-bin/qcmapwebcgi on JioFi 4G M2S 1.0.2 devices allows a DoS Hang via the mask POST parameter...

CVE-2018-14575

Trash Bin plugin 1.1.3 for MyBB has cross-site scripting XSS via a thread subject and a cross-site request forgery CSRF via a post subject...

CVE-2018-14575

Trash Bin plugin 1.1.3 for MyBB has cross-site scripting XSS via a thread subject and a cross-site request forgery CSRF via a post subject...

CVE-2019-7440

Affected product: JioFi 4G M2S 1.0.2. Vulnerability: Cross-Site Request Forgery (CSRF) via the SSID name and Security Key field in Edit Wi‑Fi Settings (SetWiFi_Setting to cgi-bin/qcmap_web_cgi). Root cause: HTTP requests processed without proper validity checks enabling state-changing actions. Im...

CVE-2019-7439

CVE-2019-7439 affects JioFi 4G M2S 1.0.2 devices. The vulnerability is in cgi-bin/qcmap_web_cgi and allows a DoS (Hang) via the mask POST parameter. Multiple sources (NVD CVE entry, Exploit-DB listing, Packet Storm) document the issue and a DoS exposure. No remediation or patch information is pro...

PT-2019-18611

Name of the Vulnerable Software and Affected Versions JioFi 4G M2S version 1.0.2 Description The issue concerns the cgi-bin/qcmap web cgi endpoint on the affected device, where an attacker can exploit XSS and HTML injection vulnerabilities via the mask POST parameter. Recommendations For version...

CVE-2019-7439: Undefined Security Weakness

cgi-bin/qcmapwebcgi on JioFi 4G M2S 1.0.2 devices allows a DoS Hang via the mask POST parameter...

CVE-2019-7440: Cross-Site Request Forgery (CSRF)

JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings aka a SetWiFiSetting request to cgi-bin/qcmapwebcgi...