CVE-2019-13455

Xymon is affected by CVE-2019-13455:

CVE-2019-13455

In Xymon through 4.3.28, a stack-based buffer overflow vulnerability exists in the alert acknowledgment CGI tool because of expansion in acknowledge.c...

CVE-2019-13484

In Xymon through 4.3.28, a buffer overflow exists in the status-log viewer CGI because of expansion in appfeed.c...

CVE-2019-13484

Xymon ≤ 4.3.28 contains a buffer overflow in the status-log viewer CGI caused by expansion in appfeed.c. This CVE-2019-13484 entry is documented across multiple sources (NVD, OSV, Debian/Ubuntu trackers, Nessus/NASL plugins, etc.), consistently stating the flaw exists in the status-log viewer com...

CVE-2019-13455: Out-of-bounds Write

In Xymon through 4.3.28, a stack-based buffer overflow vulnerability exists in the alert acknowledgment CGI tool because of expansion in acknowledge.c...

CVE-2019-13274: Improper Neutralization of Input During Web Page Generation

In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to insufficient filtering of the db parameter...

CVE-2019-13484: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Xymon through 4.3.28, a buffer overflow exists in the status-log viewer CGI because of expansion in appfeed.c...

CVE-2019-13273: Out-of-bounds Write

In Xymon through 4.3.28, a buffer overflow vulnerability exists in the csvinfo CGI script. The overflow may be exploited by sending a crafted GET request that triggers an sprintf of the srcdb parameter...

CVE-2019-15503

The CVE-2019-15503 in AltaVoz Prontus (ProntusCMS) up to version 12.0.3.0 is tied to an Improper Neutralization of Special Elements used in an OS Command (command injection) in cgi-cpn/xcoding/prontus_videocut.cgi. It allows an attacker to execute OS commands via an HTTP GET parameter, enabling r...

PT-2019-13362

Name of the Vulnerable Software and Affected Versions Xymon versions prior to 4.3.29 Description A buffer overflow issue exists in the status-log viewer CGI of Xymon due to expansion in appfeed.c. Recommendations For versions prior to 4.3.29, update to version 4.3.29 or later to resolve the issue...

PT-2019-13228

Name of the Vulnerable Software and Affected Versions Xymon versions prior to 4.3.29 Description The issue is related to an XSS vulnerability in the csvinfo CGI script. This vulnerability exists due to insufficient filtering of the db parameter. Recommendations For versions prior to 4.3.29, updat...

PT-2019-13345

Name of the Vulnerable Software and Affected Versions Xymon versions prior to 4.3.29 Description A stack-based buffer overflow issue exists in the alert acknowledgment CGI tool due to expansion in acknowledge.c. Recommendations For versions prior to 4.3.29, update to version 4.3.29 or later to...

PT-2019-13227

Name of the Vulnerable Software and Affected Versions Xymon versions prior to 4.3.29 Description A buffer overflow issue exists in the csvinfo CGI script. This can be exploited by sending a crafted GET request to the "/cgi-bin/csvinfo" API endpoint, which triggers an sprintf of the srcdb paramete...

Design/Logic Flaw

cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh...

PT-2019-14226

Name of the Vulnerable Software and Affected Versions Vera Edge Home Controller version 1.7.4452 Description The issue allows remote unauthenticated users to execute arbitrary OS commands. This is achieved through argument injection in the username parameter to the "/cgi-bin/cmh/webcam.sh" API...

CVE-2019-15498: Improper Neutralization of Argument Delimiters in a Command

cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh...

CVE-2019-7617

When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing...

CVE-2019-7617

When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing...

PYSEC-2019-178

When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing...

Design/Logic Flaw

When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing...