CVE-2016-10839: Improper Neutralization of Special Elements used in an SQL Command

cPanel before 11.54.0.4 allows SQL injection in bin/hordeupdateusernames SEC-71...

CVE-2018-20945: Improper Authorization

bin/csvprocess in cPanel before 68.0.27 allows insecure file operations SEC-354...

PT-2019-7637

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 11.54.0.4 Description The issue concerns the disclosure of password hashes due to a problem in the bin/mkvhostspasswd script. Recommendations For versions prior to 11.54.0.4, update to version 11.54.0.4 or later to...

Dynacolor FCM-MB40 Cross-Site Request Forgery Vulnerability

Dynacolor FCM-MB40 is an IP camera from Dynacolor, Taiwan, China. A cross-site request forgery vulnerability exists in scripts under cgi-bin/ in the Dynacolor FCM-MB40 v1.2.0.0, which arises from a network system or product that does not adequately verify the origin or authenticity of data, and c...

CVE-2019-13401

Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...

CVE-2019-13401

Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...

Cross site request forgery (csrf)

Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...

CVE-2019-13401

Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...

CVE-2019-13400

CVE-2019-13400 affects Dynacolor FCM-MB40 v1.2.0.0. The issue arises from storing administrative web-interface credentials in cleartext at /etc/appWeb/appweb.pass, which can be retrieved by accessing cgi-bin/getuserinfo.cgi?mode=info. The vulnerability is evidenced in multiple sources (NVD entry ...

PT-2019-13314

Name of the Vulnerable Software and Affected Versions Dynacolor FCM-MB40 version 1.2.0.0 Description The issue concerns an incomplete factory-reset process implemented by /usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on the affected device. This incompleteness c...

CVE-2019-13401: Cross-Site Request Forgery (CSRF)

Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...

CVE-2019-13400: Insufficiently Protected Credentials

Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. These credentials can be retrieved via cgi-bin/getuserinfo.cgi?mode=info...

CVE-2019-13398: Improper Neutralization of Special Elements used in an OS Command

Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrlsaveprofile.cgi save parameter and cgi-bin/ddns.cgi...

PT-2019-13312

Name of the Vulnerable Software and Affected Versions Dynacolor FCM-MB40 version 1.2.0.0 Description The issue concerns the storage of administrative web-interface credentials in cleartext. Specifically, the credentials are stored in the /etc/appWeb/appweb.pass file. An attacker can retrieve thes...

PT-2019-13313

Name of the Vulnerable Software and Affected Versions Dynacolor FCM-MB40 version 1.2.0.0 Description The issue concerns a CSRF problem present in all scripts under the cgi-bin/ directory. Recommendations For Dynacolor FCM-MB40 version 1.2.0.0, consider implementing proper CSRF protection...

PT-2019-13310

Name of the Vulnerable Software and Affected Versions Dynacolor FCM-MB40 version 1.2.0.0 Description The issue allows remote attackers to execute arbitrary commands by providing a crafted parameter to a CGI script. This can be achieved through sed injection in the cgi-bin/camctrl save profile.cgi...

CVE-2018-14529

Invoxia NVX220 devices allow access to /bin/sh via escape from a restricted CLI, leading to disclosure of password hashes...

CVE-2018-14529

CVE-2018-14529 affects Invoxia NVX220 devices via an escape from a restricted CLI that grants access to /bin/sh, enabling disclosure of password hashes. Multiple connected sources corroborate the core issue, with the root cause described as improper access to a restricted shell leading to sensiti...

CVE-2018-14529

Invoxia NVX220 devices allow access to /bin/sh via escape from a restricted CLI, leading to disclosure of password hashes...

CVE-2018-14529: Exposure of Sensitive Information to an Unauthorized Actor

Invoxia NVX220 devices allow access to /bin/sh via escape from a restricted CLI, leading to disclosure of password hashes...