PT-2014-3276

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 4.1.0 Description The issue allows remote attackers to read arbitrary files via a full pathname in the f parameter in the /cgi-bin/jc.cgi API endpoint. Recommendations For versions prior to 4.1.0, update to version...

CVE-2013-7174: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in cgi-bin/jc.cgi in QNAP QTS before 4.1.0 allows remote attackers to read arbitrary files via a full pathname in the f parameter...

PT-2013-6268

Name of the Vulnerable Software and Affected Versions McAfee Email Gateway version 7.6 Description The issue concerns SQL injection vulnerabilities in the /admin/cgi-bin/rpc/doReport/18 endpoint. Remote authenticated users can execute arbitrary SQL commands by manipulating specific JSON keys,...

Cross site request forgery (csrf)

cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrftoken parameter, which allows remote attackers to perform cross-site request forgery CSRF attacks...

CVE-2013-6826: Cross-Site Request Forgery (CSRF)

cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrftoken parameter, which allows remote attackers to perform cross-site request forgery CSRF attacks...

PT-2013-6135

Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions prior to 5.0.5 Description The issue is related to the improper validation of the csrf token parameter in the cgi-bin/module//sysmanager/admin/SYSAdminUserDialog endpoint. This allows remote attackers to perform cross-si...

Apache + PHP 5.3.12 5.4.2 - cgi-bin Remote Code Execution

Apache + PHP 5.3.12 5.4.2 - cgi-bin Remote Code Execution / Apache Magica by Kingcope / / gcc apache-magika.c -o apache-magika -lssl / / This is a code execution bug in the combination of Apache and PHP. On Debian and Ubuntu the vulnerability is present in the default install of the php5-cgi...

Apache + PHP < 5.3.12 / < 5.4.2 - cgi-bin Remote Code Execution

/ Apache Magica by Kingcope / / gcc apache-magika.c -o apache-magika -lssl / / This is a code execution bug in the combination of Apache and PHP. On Debian and Ubuntu the vulnerability is present in the default install of the php5-cgi package. When the php5-cgi package is installed on Debian and...

CVE-2013-3686

cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password via a list action...

CVE-2013-2578

cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12sign6 allows remote attackers to execute arbitrary commands via shell metacharacters in 1 the ServerName parameter and 2 other unspecified...

CVE-2013-3686

cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password via a list action...

PT-2013-3850

Name of the Vulnerable Software and Affected Versions TP-Link IP Cameras versions prior to beta firmware LM.1.6.18P12 sign6 Description The issue allows remote attackers to modify the firmware revision. This is achieved through the cgi-bin/firmwareupgrade endpoint, by utilizing a "preset" action...

PT-2013-3847

Name of the Vulnerable Software and Affected Versions TP-Link IP Cameras versions prior to beta firmware LM.1.6.18P12 sign6 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the ServerName parameter and other unspecified parameters in the...

PT-2013-4564

Name of the Vulnerable Software and Affected Versions AirLive WL2600CAM affected versions not specified Description The issue allows remote attackers to obtain the administrator password. This is achieved through the cgi-bin/operator/param endpoint, specifically by utilizing a list action...

CVE-2013-2578: Improper Neutralization of Special Elements used in an OS Command

cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12sign6 allows remote attackers to execute arbitrary commands via shell metacharacters in 1 the ServerName parameter and 2 other unspecified...

CVE-2013-2581: Undefined Security Weakness

cgi-bin/firmwareupgrade in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12sign6 allows remote attackers to modify the firmware revision via a "preset" action...

CVE-2013-3686: Undefined Security Weakness

cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password via a list action...

CVE-2013-2580: Undefined Security Weakness

Unrestricted file upload vulnerability in cgi-bin/uploadfile in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12sign6, allows remote attackers to upload arbitrary files, then accessing it via a direct request to the file ...

PT-2013-3849

Name of the Vulnerable Software and Affected Versions TP-Link IP Cameras versions prior to beta firmware LM.1.6.18P12 sign6 Description The issue allows remote attackers to upload arbitrary files to the cgi-bin/uploadfile directory, which can then be accessed directly via a request to the file in...

CVE-2013-3541

The CVE-2013-3541 entry concerns a directory traversal vulnerability in AirLive devices, specifically the cgi-bin/admin/fileread functionality. The documented flaw allows remote attackers to read arbitrary files by manipulating the READ.filePath parameter (using .. to traverse directories). Affec...