12555 matches found
Mailman < 2.1.33 Content Injection Vulnerability
Mailman is prone to a content injection vulnerability via the cgi/private.py private archive login page. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
CVE-2020-15011
CVE-2020-15011 affects GNU Mailman prior to 2.1.33. The vulnerability allows arbitrary content injection via the Cgi/private.py private archive login page. Affected product: GNU Mailman 2.1.x (before 2.1.33). Impact described in sources as arbitrary content injection, with other related CVEs ofte...
CVE-2020-15046: Cross-Site Request Forgery (CSRF)
The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/configuser.cgi CSRF issue to add new admin users. The fixed versions are BIOS 3.2 and firmware 03.88...
CVE-2020-15011: Improper Neutralization of Special Elements in Output Used by a Downstream Component
GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page...
Zivif Camera 2.3.4.2103 iptest.cgi Blind Remote Command Execution Exploit
This Metasploit module exploits a remote command execution vulnerability in Zivif webcams. This is known to impact versions prior to and including 2.3.4.2103. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...
CVE-2020-13977
Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files. NOTE: this vulnerability has been...
DEBIAN-CVE-2020-13977
Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files. NOTE: this vulnerability has been...
CVE-2020-13977
Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files. NOTE: this vulnerability has been...
CVE-2020-13977
Mode C: Nagios 4.4.5 is affected by CVE-2020-13977. An attacker with existing administrative access can modify the ArchiveJSON/StatusJSON/CGI logic by crafting archivejson.cgi, objectjson.cgi, and statusjson.cgi, enabling changes to the Alert Histogram and Trends code. Mageia advisory MGASA-2021-...
CVE-2020-13977
Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files. NOTE: this vulnerability has been...
PT-2020-3002
Name of the Vulnerable Software and Affected Versions GNU Mailman versions prior to 2.1.33 Description The issue exists due to insufficient input validation in the Cgi/private.py private archive login page of the GNU Mailman mailing list management system. This allows a remote attacker to inject...
Secure Computing SnapGear Management Console SG560 3.1.5 Arbitrary File Read / Write
Secure Computing SnapGear Management Console SG560 v3.1.5 Arbitrary File Read/Write Vendor: Secure Computing Corp. Product web page: http://www.securecomputing.com Affected version: 3.1.5u1 Summary: The SG gateway appliance range provides Internet security and privacy of communications for small...
Secure Computing SnapGear Management Console SG560 3.1.5 - Arbitrary File Read
Title: Secure Computing SnapGear Management Console SG560 3.1.5 - Arbitrary File Read Author:LiquidWorm Date: 2020-06-04 Vendor: http://www.securecomputing.com CVE: N/A Secure Computing SnapGear Management Console SG560 v3.1.5 Arbitrary File Read/Write Vendor: Secure Computing Corp. Product web...
Fedora: Security Advisory for perl-Mojolicious (FEDORA-2020-cc7deffbf1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora: Security Advisory for perl-Mojolicious (FEDORA-2020-8d3b359179)
The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei Data Communication: A CGI application vulnerability in Some Huawei Products (huawei-sa-20171129-01-httpproxy)
Some open source software used by Huawei does not attempt to address RFC 3875 section 4.1.18 namespace conflicts. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
PT-2020-10770 · Cherokee · Cherokee
Name of the Vulnerable Software and Affected Versions: Cherokee versions 1.2.104 and earlier Description: The issue allows remote attackers to trigger an out-of-bounds write in cherokee handler cgi add env pair in handler cgi.c by sending many request headers, as demonstrated by a GET request wit...
LinuxKI Toolset 6.01 Remote Command Execution
This module exploits a vulnerability in LinuxKI Toolset use exploit/linux/http/linuxki/rce msf undefinedrce show actions ...actions... msf undefinedrce set ACTION msf undefinedrce show options ...show and set options... msf undefinedrce run This module requires Metasploit:...
CVE-2020-10973
WAVLINK WN530HG4 / WN531G3 / WN533A8 / WN551K1 are affected by an improper access control vulnerability in /cgi-bin/ExportAllSettings.sh. A crafted POST request, without authentication, returns the device’s current configuration including the administrator password; the attacker must perform a de...
