1704 matches found
CVE-2009-4720: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in cgi-bin/gnudip.cgi in GnuDIP 2.1.1 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...
gitWeb 1.x Remote Command Execution
Exploit Title: gitWeb remote command execution Date: 2009.06.19 Author: S2 Crew Hungary Software Link: - Version: GIT 1.X Tested on: debian linux, GIT 1.5.2 CVE: CVE-2008-5516 - CVE-2008-5517 Code:...
CVE-2001-1586
CVE-2001-1586 affects SimpleServer:WWW 1.13 and earlier. It is a directory traversal flaw where encoded ../ sequences in requests to the cgi-bin/ directory allow remote attackers to run arbitrary commands with the server’s privileges. OpenVAS/Nessus entries describe remote command execution, conf...
CVE-2001-1586: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in SimpleServer:WWW 1.13 and earlier allows remote attackers to execute arbitrary programs via encoded ../ "%2E%2E%2F%" sequences in a request to the cgi-bin/ directory, a different vulnerability than CVE-2000-0664...
CVE-2008-7115
The web interface to the Belkin Wireless G router and ADSL2 modem F5D7632-4V6 with firmware 6.01.08 allows remote attackers to bypass authentication and gain administrator privileges via a direct request to 1 statusprocess.exe, 2 systemall.exe, or 3 restore.exe in cgi-bin/. NOTE: the setupdns.exe...
CVE-2008-7115: Undefined Security Weakness
The web interface to the Belkin Wireless G router and ADSL2 modem F5D7632-4V6 with firmware 6.01.08 allows remote attackers to bypass authentication and gain administrator privileges via a direct request to 1 statusprocess.exe, 2 systemall.exe, or 3 restore.exe in cgi-bin/. NOTE: the setupdns.exe...
CVE-2009-2765
httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI...
CVE-2009-2766
httpd.c in httpd in the management GUI in DD-WRT 24 sp1 does not require administrative authentication for programs under cgi-bin/, which allows remote attackers to change settings via HTTP requests...
CVE-2009-2765
The DD-WRT firmware (versions 24 sp1 and others before build 12533 ) is vulnerable to a remote command injection flaw in the httpd.c component of the management GUI. The root cause is a failure to adequately sanitize user-supplied input data, allowing unauthenticated attackers to execute arbitrar...
PT-2009-5129
Name of the Vulnerable Software and Affected Versions DD-WRT versions prior to build 12533 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a "cgi-bin/" URI. This is due to a problem in the httpd.c in httpd in the management GUI...
CVE-2009-2765: Improper Input Validation
httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI...
CVE-2009-2367: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
cgi-bin/makecgi-pro in Iomega StorCenter Pro generates predictable session IDs, which allows remote attackers to hijack active sessions and gain privileges via brute force guessing attacks on the sessionid parameter...
CVE-2009-2322
The CVE-2009-2322 entry concerns the Axesstel MV 410R router. A vulnerability in the CGI script cgi-bin/sysconf.cgi enables cross-site scripting (XSS), allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. The NVD metrics indicate a Medium severity (CVSS v2: AV...
CVE-2009-2322: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in cgi-bin/sysconf.cgi on the Axesstel MV 410R allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2009-2323: Cross-Site Request Forgery (CSRF)
The web interface on the Axesstel MV 410R redirects users back to the referring page after execution of some CGI scripts, which makes it easier for remote attackers to avoid detection of cross-site request forgery CSRF attacks, as demonstrated by a redirect from the cgi-bin/wireless.cgi script...
CVE-2009-2321: Undefined Security Weakness
cgi-bin/sysconf.cgi on the Axesstel MV 410R allows remote attackers to cause a denial of service configuration reset via a RESTORE=RESTORE query string...
CVE-2009-2256: Improper Input Validation
The administrative web interface on the Netgear DG632 with firmware 3.4.0ap allows remote attackers to cause a denial of service web outage via an HTTP POST request to cgi-bin/firmwarecfg...
CVE-2009-2258: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in cgi-bin/webcm in the administrative web interface on the Netgear DG632 with firmware 3.4.0ap allows remote attackers to list arbitrary directories via a .. dot dot in the nextpage parameter...
