PT-2019-10345

Name of the Vulnerable Software and Affected Versions: cPanel versions prior to 70.0.23 Description: The issue allows attackers to read the root accesshash. This can be achieved via the WHM /cgi/trustclustermaster.cgi endpoint. Recommendations: For versions prior to 70.0.23, update to version...

CVE-2018-20913: Exposure of Sensitive Information to an Unauthorized Actor

cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi SEC-364...

Xymon useradm Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Xymon useradm Command Execution', 'Description' = %q This module exploits a command injection vulnerability in Xymon versions before 4.3.25 which...

Xymon 4.3.25 - useradm Command Execution Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Xymon useradm Command Execution', 'Description' = %q This module exploits a command injection vulnerability in Xymon versions before 4.3.25 which...

Dynacolor FCM-MB40 Cross-Site Request Forgery Vulnerability

Dynacolor FCM-MB40 is an IP camera from Dynacolor, Taiwan, China. A cross-site request forgery vulnerability exists in scripts under cgi-bin/ in the Dynacolor FCM-MB40 v1.2.0.0, which arises from a network system or product that does not adequately verify the origin or authenticity of data, and c...

CVE-2019-13401

Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...

CVE-2019-13401

Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...

CVE-2019-13398

Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrlsaveprofile.cgi save parameter and cgi-bin/ddns.cgi...

CVE-2019-13398

Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrlsaveprofile.cgi save parameter and cgi-bin/ddns.cgi...

Cross site request forgery (csrf)

Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...

Sql injection

Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrlsaveprofile.cgi save parameter and cgi-bin/ddns.cgi...

CVE-2019-13401

Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...

CVE-2019-13400

CVE-2019-13400 affects Dynacolor FCM-MB40 v1.2.0.0. The issue arises from storing administrative web-interface credentials in cleartext at /etc/appWeb/appweb.pass, which can be retrieved by accessing cgi-bin/getuserinfo.cgi?mode=info. The vulnerability is evidenced in multiple sources (NVD entry ...

CVE-2019-13398

CVE-2019-13398 affects Dynacolor FCM-MB40 v1.2.0.0 devices. The vulnerability is a command-injection flaw in CGI scripts (cgi-bin/camctrl_save_profile.cgi and cgi-bin/ddns.cgi) that allows a remote attacker to execute arbitrary commands by supplying crafted parameters. This stems from unsafe inpu...

CVE-2019-13398

Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrlsaveprofile.cgi save parameter and cgi-bin/ddns.cgi...

PT-2019-13310

Name of the Vulnerable Software and Affected Versions Dynacolor FCM-MB40 version 1.2.0.0 Description The issue allows remote attackers to execute arbitrary commands by providing a crafted parameter to a CGI script. This can be achieved through sed injection in the cgi-bin/camctrl save profile.cgi...

PT-2019-13313

Name of the Vulnerable Software and Affected Versions Dynacolor FCM-MB40 version 1.2.0.0 Description The issue concerns a CSRF problem present in all scripts under the cgi-bin/ directory. Recommendations For Dynacolor FCM-MB40 version 1.2.0.0, consider implementing proper CSRF protection...

CVE-2019-13401: Cross-Site Request Forgery (CSRF)

Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...

CVE-2019-13398: Improper Neutralization of Special Elements used in an OS Command

Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrlsaveprofile.cgi save parameter and cgi-bin/ddns.cgi...

PT-2019-13314

Name of the Vulnerable Software and Affected Versions Dynacolor FCM-MB40 version 1.2.0.0 Description The issue concerns an incomplete factory-reset process implemented by /usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on the affected device. This incompleteness c...