AudioCode 400HD Cross Site scripting Vulnerability

Exploit for cgi platform in category web applications CVE-2018-10091 Stored XSS vulnerabilities in AudioCode IP phones Description The AudioCodes 400HD series of IP phones is a range of easy-to-use, feature-rich desktop devices for the service provider hosted services, enterprise IP telephony and...

CVE-2018-0641

Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via toolssystem.cgi date parameter, time parameter, and offset parameter...

D-Link DIR-818LW Rev.A and DIR-860L Rev.B Operating System Command Injection Vulnerability

The D-Link DIR-818LW Rev.A and DIR-860L Rev.B are both wireless router products from AUO D-Link. An operating system command injection vulnerability exists in the soap.cgi service of the cgibin binary in the D-Link DIR-818LW Rev.A version 2.05.B03 and DIR-860L Rev.B version 2.03.B03. A remote...

CVE-2018-20326

CVE-2018-20326 affects ChinaMobile PLC Wireless Router GPN2.4P21-C-CN running firmware W2001EN-00. The vulnerability is a Cross‑Site Scripting (XSS) issue exploitable via the CGI path cgi-bin/webproc?getpage=html/index.html with the var:subpage parameter (reflected/XSS). Public analyses and explo...

PT-2019-10047

Name of the Vulnerable Software and Affected Versions: ChinaMobile PLC Wireless Router GPN2.4P21-C-CN version W2001EN-00 Description: The issue concerns a problem with the cgi-bin/webproc endpoint, specifically the getpage parameter, where the var:subpage parameter is vulnerable. This allows for...

CVE-2018-20326: Improper Neutralization of Input During Web Page Generation

ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have XSS via the cgi-bin/webproc?getpage=html/index.html var:subpage parameter...

CVE-2018-20576

Orange Livebox 00.96.320S devices allow cgi-bin/autodialing.exe and cgi-bin/phonetest.exe CSRF, leading to arbitrary outbound telephone calls to an attacker-specified telephone number. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan...

CVE-2018-20577

Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe, cgi-bin/firewallSPI.exe, cgi-bin/setupremotemgmt.exe, cgi-bin/setuppass.exe, and cgi-bin/upgradep.exe CSRF. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T...

Cross site request forgery (csrf)

Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe, cgi-bin/firewallSPI.exe, cgi-bin/setupremotemgmt.exe, cgi-bin/setuppass.exe, and cgi-bin/upgradep.exe CSRF. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T...

CVE-2018-20577

Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe, cgi-bin/firewallSPI.exe, cgi-bin/setupremotemgmt.exe, cgi-bin/setuppass.exe, and cgi-bin/upgradep.exe CSRF. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T...

CVE-2018-20576

Orange Livebox 00.96.320S devices allow cgi-bin/autodialing.exe and cgi-bin/phonetest.exe CSRF, leading to arbitrary outbound telephone calls to an attacker-specified telephone number. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan...

CVE-2018-20577

CVE-2018-20577 affects Orange Livebox 00.96.320S devices. The vulnerability is described as CSRF allowing forged requests via endpoints: /cgi-bin/restore.exe, /cgi-bin/firewall_SPI.exe, /cgi-bin/setup_remote_mgmt.exe, /cgi-bin/setup_pass.exe, and /cgi-bin/upgradep.exe. The associated hardware/fir...

CVE-2018-20577

Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe, cgi-bin/firewallSPI.exe, cgi-bin/setupremotemgmt.exe, cgi-bin/setuppass.exe, and cgi-bin/upgradep.exe CSRF. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T...

PT-2018-15446

Name of the Vulnerable Software and Affected Versions Orange Livebox 00.96.320S devices affected versions not specified Description The issue allows for CSRF attacks through cgi-bin/autodialing.exe and cgi-bin/phone test.exe, leading to arbitrary outbound telephone calls to an attacker-specified...

PT-2018-15447

Name of the Vulnerable Software and Affected Versions Orange Livebox 00.96.320S devices Description The issue is related to several CGI binaries, including cgi-bin/restore.exe, cgi-bin/firewall SPI.exe, cgi-bin/setup remote mgmt.exe, cgi-bin/setup pass.exe, and cgi-bin/upgradep.exe, which are...

CVE-2018-20576: Cross-Site Request Forgery (CSRF)

Orange Livebox 00.96.320S devices allow cgi-bin/autodialing.exe and cgi-bin/phonetest.exe CSRF, leading to arbitrary outbound telephone calls to an attacker-specified telephone number. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan...

CVE-2018-20577: Cross-Site Request Forgery (CSRF)

Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe, cgi-bin/firewallSPI.exe, cgi-bin/setupremotemgmt.exe, cgi-bin/setuppass.exe, and cgi-bin/upgradep.exe CSRF. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T...

PT-2018-15325

Name of the Vulnerable Software and Affected Versions Barracuda Message Archiver version 2018 Description The issue concerns an XSS vulnerability in the error msg exception-handling value for the ldap user parameter to the cgi-mod/ldap load entry.cgi module. The injection point of the issue is th...

CVE-2018-20369: Improper Neutralization of Input During Web Page Generation

Barracuda Message Archiver 2018 has XSS in the errormsg exception-handling value for the ldapuser parameter to the cgi-mod/ldaploadentry.cgi module. The injection point of the issue is the AddUpdate module...

TRENDnet TEW-673GRU Command Injection Vulnerability

The TRENDnet TEW-673GRU is a dual-band green router. A command injection vulnerability exists in the TRENDnet TEW-673GRU. This allows remote attackers to inject commands via a POST request passed to the . .cgi binary file with three parameters dhcpdstart, dhcpdend, and lanipaddr to execute...