CVE-2014-9431: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Smoothwall Express 3.1 and 3.0 SP3 allow remote attackers to hijack the authentication of administrators for requests that change the 1 admin or 2 dial password via a request to httpd/cgi-bin/changepw.cgi...

CVE-2014-9430: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in httpd/cgi-bin/vpn.cgi/vpnconfig.dat in Smoothwall Express 3.0 SP3 allows remote attackers to inject arbitrary web script or HTML via the COMMENT parameter in an Add action...

CVE-2011-5284: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the web management interface in httpd/cgi-bin/shutdown.cgi in Smoothwall Express 3.1 and 3.0 SP3 and earlier allows remote attackers to hijack the authentication of administrators for requests that perform a reboot via a request to...

SmoothWall 3.1 Cross Site Request Forgery / Cross Site Scripting

Exploit Title: SmoothWall 3.1 Multiple vulnerabilities Date: 21/12/2014 Author: Yann CAM @ Synetis Vendor or Software Link: www.smoothwall.org - www.smoothwall.org/download/ Version: 3.1 Category: CSRF password reset & XSS persistent Google dork: Tested on: Smoothwall Linux distribution Smoothwal...

CVE-2014-9234: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in cgi-bin/sddownload.cgi in D-link IP camera DCS-2103 with firmware 1.0.0 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

CVE-2014-9238: Improper Limitation of a Pathname to a Restricted Directory

D-link IP camera DCS-2103 with firmware 1.0.0 allows remote attackers to obtain the installation path via the file parameter to cgi-bin/sddownload.cgi, as demonstrated by a / forward slash character...

CVE-2014-2081: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the login in webreports/cgi-bin/InfoStation.cgi in Innovative vtls-Virtua before 2013.2.4 and 2014.x before 2014.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password parameter...

CVE-2013-3083: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in cgi-bin/systemsetting.exe in Belkin F5D8236-4 v2 allows remote attackers to hijack the authentication of administrators for requests that open the remote management interface on arbitrary ports via the remotemgmtenabled and remotemgmtport parameter...

CVE-2012-1417: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com...

Aztech Routers - '/cgi-bin/AZ_Retrain.cgi' Denial of Service

/ source: https://www.securityfocus.com/bid/69809/info Multiple Aztech routers are prone to a denial-of-service vulnerability. Attackers may exploit this issue to cause an affected device to crash, resulting in a denial-of-service condition. Aztech DSL5018EN, DSL705E and DSL705EU are vulnerable. ...

VM-Turbo-Operations-Manager 4.5.x /cgi-bin/help/doIt.cgi 任意文件读取漏洞

No description provided by source...

CVE-2014-3851: Exposure of Sensitive Information to an Unauthorized Actor

usr/lib/cgi-bin/createpasswdfile.py in Pyplate 0.08 uses world-readable permissions for passwd.db, which allows local users to obtain the administrator password by reading this file...

Path traversal

Absolute path traversal vulnerability in Yealink VoIP Phone SIP-T38G allows remote authenticated users to read arbitrary files via a full pathname in the dumpConfigFile function in the command parameter to cgi-bin/cgiServer.exx...

CVE-2013-5756

Directory traversal vulnerability in Yealink VoIP Phone SIP-T38G allows remote authenticated users to read arbitrary files via a .. dot dot in the page parameter to cgi-bin/cgiServer.exx...

CVE-2013-5756

The provided sources confirm CVE-2013-5756 affects Yealink VoIP Phone SIP-T38G via a directory traversal in the web interface (cgi-bin/cgiServer.exx). An authenticated remote attacker can read arbitrary files by supplying a crafted …/ page parameter, enabling access to sensitive files such as /et...

CVE-2013-5758: Improper Neutralization of Special Elements used in an OS Command

cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by calling the system method in the body of a request, as demonstrated by running unauthorized services, changing directory permissions, and modifying files...

CVE-2013-5757: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in Yealink VoIP Phone SIP-T38G allows remote authenticated users to read arbitrary files via a full pathname in the dumpConfigFile function in the command parameter to cgi-bin/cgiServer.exx...

CVE-2013-5756: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Yealink VoIP Phone SIP-T38G allows remote authenticated users to read arbitrary files via a .. dot dot in the page parameter to cgi-bin/cgiServer.exx...

PT-2014-2953

Name of the Vulnerable Software and Affected Versions Yealink VoIP Phone SIP-T38G Description The issue allows remote authenticated users to execute arbitrary commands by calling the system method in the body of a request. This can be used to run unauthorized services, change directory permission...

CVE-2014-4977

Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the 1 selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the 2 userid parameter in the changeUnit function, 3 methodDeta...