CVE-2016-10795

The CVE-2016-10795 entry affects cPanel/WHM, where a stored XSS vulnerability exists in the WHM tail_upcp2.cgi interface. Affected versions are prior to 59.9999.145. The issue stems from insufficient validation of client-side data in the web application, enabling an attacker to execute client-sid...

CVE-2016-10795

cPanel before 59.9999.145 allows stored XSS in the WHM tailupcp2.cgi interface SEC-156...

PT-2019-7591

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 59.9999.145 Description The issue allows for stored XSS in the WHM tail upcp2.cgi interface. Recommendations For versions prior to 59.9999.145, update to version 59.9999.145 or later to resolve the issue...

CVE-2016-10795: Improper Neutralization of Input During Web Page Generation

cPanel before 59.9999.145 allows stored XSS in the WHM tailupcp2.cgi interface SEC-156...

CVE-2016-10769

cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi SEC-162...

PT-2019-7565

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 60.0.25 Description The issue allows an open redirect via the /cgi-sys/FormMail-clone.cgi API endpoint. Recommendations For versions prior to 60.0.25, update to version 60.0.25 or later to resolve the issue. As a...

PT-2019-10345

Name of the Vulnerable Software and Affected Versions: cPanel versions prior to 70.0.23 Description: The issue allows attackers to read the root accesshash. This can be achieved via the WHM /cgi/trustclustermaster.cgi endpoint. Recommendations: For versions prior to 70.0.23, update to version...

CVE-2018-20913: Exposure of Sensitive Information to an Unauthorized Actor

cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi SEC-364...

Xymon useradm Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Xymon useradm Command Execution', 'Description' = %q This module exploits a command injection vulnerability in Xymon versions before 4.3.25 which...

Xymon 4.3.25 - useradm Command Execution Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Xymon useradm Command Execution', 'Description' = %q This module exploits a command injection vulnerability in Xymon versions before 4.3.25 which...

Dynacolor FCM-MB40 Cross-Site Request Forgery Vulnerability

Dynacolor FCM-MB40 is an IP camera from Dynacolor, Taiwan, China. A cross-site request forgery vulnerability exists in scripts under cgi-bin/ in the Dynacolor FCM-MB40 v1.2.0.0, which arises from a network system or product that does not adequately verify the origin or authenticity of data, and c...

CVE-2019-13401

Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...

CVE-2019-13401

Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...

CVE-2019-13398

Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrlsaveprofile.cgi save parameter and cgi-bin/ddns.cgi...

CVE-2019-13398

Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrlsaveprofile.cgi save parameter and cgi-bin/ddns.cgi...

Cross site request forgery (csrf)

Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...

Sql injection

Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrlsaveprofile.cgi save parameter and cgi-bin/ddns.cgi...

CVE-2019-13401

Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...

CVE-2019-13400

CVE-2019-13400 affects Dynacolor FCM-MB40 v1.2.0.0. The issue arises from storing administrative web-interface credentials in cleartext at /etc/appWeb/appweb.pass, which can be retrieved by accessing cgi-bin/getuserinfo.cgi?mode=info. The vulnerability is evidenced in multiple sources (NVD entry ...

CVE-2019-13398

CVE-2019-13398 affects Dynacolor FCM-MB40 v1.2.0.0 devices. The vulnerability is a command-injection flaw in CGI scripts (cgi-bin/camctrl_save_profile.cgi and cgi-bin/ddns.cgi) that allows a remote attacker to execute arbitrary commands by supplying crafted parameters. This stems from unsafe inpu...