1993 matches found
CVE-2016-11015: Cross-Site Request Forgery (CSRF)
NETGEAR JNR1010 devices before 1.0.0.32 allow cgi-bin/webproc CSRF via the :InternetGatewayDevice.XTWSZ-COMURLFilter.BlackList.1.URL parameter...
PT-2019-14990
Name of the Vulnerable Software and Affected Versions FiberHome HG2201T version 1.00.M5007 JS 201804 Description The issue allows for pre-authentication remote code execution on the /var/WEB-GUI/cgi-bin/telnet.cgi endpoint. Recommendations For FiberHome HG2201T version 1.00.M5007 JS 201804, as a...
PT-2019-14991
Name of the Vulnerable Software and Affected Versions FiberHome HG2201T version 1.00.M5007 JS 201804 Description The issue allows pre-authentication Directory Traversal for reading arbitrary files via the /var/WEB-GUI/cgi-bin/downloadfile.cgi API endpoint. Recommendations For FiberHome HG2201T...
ACTi ACM-5611 Video Camera Remote Command Execution Exploit
Exploit for hardware platform in category web applications !/usr/bin/perl ACTi ACM-5611 Video Camera Remote Command Execution Exploit Copyright 2019 c Todor Donev Firmware Version = A1D-220-V3.08.08-AC Production ID = ACM5611-08G-X-00485 Factory Default Type = NTSC, Composite, Two Ways Audio 0x71...
PT-2019-13320
Name of the Vulnerable Software and Affected Versions Advan VD-1 firmware versions up to 230 Description A relative path traversal issue allows attackers to download arbitrary files without authentication via the API endpoint "/cgi-bin/ExportSettings.cgi" with the Download parameter set to...
PT-2019-13227
Name of the Vulnerable Software and Affected Versions Xymon versions prior to 4.3.29 Description A buffer overflow issue exists in the csvinfo CGI script. This can be exploited by sending a crafted GET request to the "/cgi-bin/csvinfo" API endpoint, which triggers an sprintf of the srcdb paramete...
Design/Logic Flaw
cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh...
PT-2019-14226
Name of the Vulnerable Software and Affected Versions Vera Edge Home Controller version 1.7.4452 Description The issue allows remote unauthenticated users to execute arbitrary OS commands. This is achieved through argument injection in the username parameter to the "/cgi-bin/cmh/webcam.sh" API...
CVE-2019-15498: Improper Neutralization of Argument Delimiters in a Command
cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh...
Dynacolor FCM-MB40 Cross-Site Request Forgery Vulnerability
Dynacolor FCM-MB40 is an IP camera from Dynacolor, Taiwan, China. A cross-site request forgery vulnerability exists in scripts under cgi-bin/ in the Dynacolor FCM-MB40 v1.2.0.0, which arises from a network system or product that does not adequately verify the origin or authenticity of data, and c...
CVE-2019-13401
Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...
CVE-2019-13401
Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...
Cross site request forgery (csrf)
Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...
CVE-2019-13401
Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...
CVE-2019-13400
CVE-2019-13400 affects Dynacolor FCM-MB40 v1.2.0.0. The issue arises from storing administrative web-interface credentials in cleartext at /etc/appWeb/appweb.pass, which can be retrieved by accessing cgi-bin/getuserinfo.cgi?mode=info. The vulnerability is evidenced in multiple sources (NVD entry ...
PT-2019-13312
Name of the Vulnerable Software and Affected Versions Dynacolor FCM-MB40 version 1.2.0.0 Description The issue concerns the storage of administrative web-interface credentials in cleartext. Specifically, the credentials are stored in the /etc/appWeb/appweb.pass file. An attacker can retrieve thes...
PT-2019-13313
Name of the Vulnerable Software and Affected Versions Dynacolor FCM-MB40 version 1.2.0.0 Description The issue concerns a CSRF problem present in all scripts under the cgi-bin/ directory. Recommendations For Dynacolor FCM-MB40 version 1.2.0.0, consider implementing proper CSRF protection...
PT-2019-13310
Name of the Vulnerable Software and Affected Versions Dynacolor FCM-MB40 version 1.2.0.0 Description The issue allows remote attackers to execute arbitrary commands by providing a crafted parameter to a CGI script. This can be achieved through sed injection in the cgi-bin/camctrl save profile.cgi...
PT-2019-13314
Name of the Vulnerable Software and Affected Versions Dynacolor FCM-MB40 version 1.2.0.0 Description The issue concerns an incomplete factory-reset process implemented by /usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on the affected device. This incompleteness c...