335 matches found
Design/Logic Flaw
cgiChkMasterPwd.exe before 8.0.0.142 in Trend Micro OfficeScan Corporate Edition 8.0 allows remote attackers to bypass the password requirement and gain access to the Management Console via an empty hash and empty encrypted password string, related to "stored decrypted user logon information."...
Network Security Series knowledge of CGI exploits collection on-vulnerability warning-the black bar safety net
Following the collection and collation of some of the famous CGI vulnerability and provided some security recommendations and solutions, if the server of the presence of these vulnerabilities not patched, then, each vulnerability is likely will fill the intruder utilization, increase Server been...
SysInfo 1.21 (sysinfo.cgi) Remote Command Execution Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "sysinfo.cgi 1.21 remote cmmnds xctn \r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; echo "dork: inurl:sysinfo.cgi ext:cgi\r\n\r\n"; if $argc4 echo "Usage: php ".$argv0...
SysInfo 1.21 - 'sysinfo.cgi' Remote Command Execution
!/usr/bin/php -q -d shortopentag=on 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else...
JVN#78363061 CAFEMILK Shopping Cart CGI cross-site scripting vulnerability
Impact A malicious script may be executed on the user's web browser. Personal information, recorded in cookies issued by CAFEMILK SHOPPING CART CGI, may be leaked. Solution Products Affected CAFEMILK SHOPPING CART version 3.80 and earlier...
Remember the Alma Mater of a non-marginalia attack-vulnerability warning-the black bar safety net
Editor's note: a very old article, The author has also not been released, I steal it out for everyone to draw on the following ideas． A． Causes. School of the FAI says he sent the on-campus DV reviews old deleted, so they want to test the forum security, then on the use side note got the...
readmsg.php detection
/base/webmail/readmsg.php was detected. SPDX-FileCopyrightText: 2002 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.11073";...
msmmask.exe
The msmmask.exe CGI is installed. Some versions allow an attacker to read the source of any file in your webserver's directories by using the 'mask' parameter. OpenVAS Vulnerability Test $Id: msmmask.nasl 5786 2017-03-30 10:08:58Z cfi $ Description: msmmask.exe Authors: Michel Arboi Copyright:...
E-Shopping Cart Arbitrary Command Execution (WebDiscount)
The eShop WebDiscount CGI is installed. A security problem in this CGI allows anyone to execute arbitrary commands with the privileges of the web server. SPDX-FileCopyrightText: 2001 Noam Rathaus SPDX-FileCopyrightText: 2001 SecuriTeam Some text descriptions might be excerpted from a referenced...
BadBlue invalid null byte vulnerability
It was possible to read the content of /EXT.INI BadBlue configuration file by sending an invalid GET request. A cracker may exploit this vulnerability to steal the passwords. OpenVAS Vulnerability Test $Id: badbluenullbyte.nasl 7175 2017-09-18 11:55:15Z cfischer $ Description: BadBlue invalid nul...
CVE-2002-2113
CVE-2002-2113 concerns AGH HTMLsearch 1.0. The vulnerability resides in the CGI script search.cgi, where the template parameter can be tainted to pass shell metacharacters. This enables a remote attacker to execute arbitrary commands on the affected system. The available documents consistently de...
CVE-2002-1753
csNewsPro.cgi in CGIScript.net csNews Professional csNewsPro allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function...
PHP, ASP, CGI web applications security vulnerabilities
PHP inclusions, SQL injections, directory traversals, crossite scripting, etc...
NewsScript newsscript.pl mode Parameter Privilege Escalation
The remote host is running a version of NewsScript.co.uk's NewsScript that allows a remote attacker to bypass authentication simply by setting the 'mode' parameter to 'admin', thereby allowing him to add, delete, or modify news stories and headlines at will. %NASLMINLEVEL 70300 C Tenable Network...
CVE-2005-0111
Stack-based buffer overflow in the websql CGI program in MySQL MaxDB 7.5.00 allows remote attackers to execute arbitrary code via a long password parameter...
FreeBSD : ruby -- CGI DoS (171)
The following package needs to be updated: ruby-1.7.0 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkgd656296b33ff11d9a9e70001020eed82.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright...
USN-20-1: Ruby CGI module vulnerability
The Ruby developers discovered a potential Denial of Service vulnerability in the CGI module cgi.rb. Specially crafted CGI requests could cause an infinite loop in the server process. Repetitive attacks could use most of the available processor resources, exhaust the number of allowed parallel...
CVE-2002-1147
The HTTP administration interface for HP Procurve 4000M Switch firmware before C.09.16, with stacking features and remote administration enabled, does not authenticate requests to reset the device, which allows remote attackers to cause a denial of service via a direct request to the devicereset...