TRENDnet TEW-673GRU Command Injection Vulnerability

The TRENDnet TEW-673GRU is a dual-band green router. A command injection vulnerability exists in the TRENDnet TEW-673GRU. This allows remote attackers to inject commands via a POST request passed to the . .cgi binary file with three parameters dhcpdstart, dhcpdend, and lanipaddr to execute...

[SECURITY] Fedora 28 Update: php-7.2.13-2.fc28

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

Perl Modules Detection (Linux/Unix SSH Login)

SSH login-based detection of various installed Perl modules. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

FutureNet NXR-G240 Series ShellShock Command Injection

-- coding: utf-8 -- Title: FutureNet NXR-G240 Series - "ShellShock" Remote Command Injection Date: 2018-06-12 Author: Nassim Asrir You have a Q ? Contact me at: https://www.linkedin.com/in/nassim-asrir-b73a57122/ Vendor: http://www.centurysys.co.jp/ CVE: CVE-2014-6271 Greetz to : Nadia BENCHIKHA...

ASUSTOR ADM OS Command Injection Vulnerability (CNVD-2018-26927)

ASUSTOR ADM is an operating system from ASUSTOR dedicated to ASUSTOR NAS storage devices. An operating system command injection vulnerability exists in the user.cgi file in ASUSTOR ADM version 3.1.1, which can be exploited to execute system commands with the help of the 'name' POST parameter...

OpenWrt and LEDE Cross-Site Scripting Vulnerabilities

Both OpenWrt and LEDE are Linux operating systems for embedded devices. The systems are capable of providing fully writable file systems and package management. A cross-site scripting vulnerability exists in the 'cgihandlerequest' function in OpenWrt versions 18.06.1 and earlier and LEDE versions...

CVE-2018-19646

The Python CGI scripts in PWS in Imperva SecureSphere 13.0.10, 13.1.10, and 13.2.10 allow remote attackers to execute arbitrary OS commands because command-line arguments are mishandled...

Design/Logic Flaw

The Python CGI scripts in PWS in Imperva SecureSphere 13.0.10, 13.1.10, and 13.2.10 allow remote attackers to execute arbitrary OS commands because command-line arguments are mishandled...

CVE-2018-19646

CVE-2018-19646 affects Imperva SecureSphere Personal Web Server (PWS) CGI scripts. Vulnerable component: Python CGI scripts in PWS versions 13.0.10, 13.1.10, and 13.2.10. Root cause: command-line arguments are mishandled, allowing remote attackers to execute arbitrary OS commands. Impact: high se...

CVE-2018-19646

The Python CGI scripts in PWS in Imperva SecureSphere 13.0.10, 13.1.10, and 13.2.10 allow remote attackers to execute arbitrary OS commands because command-line arguments are mishandled...

CVE-2018-19630

cgihandlerequest in uhttpd in OpenWrt through 18.06.1 and LEDE through 17.01 has unauthenticated reflected XSS via the URI, as demonstrated by a cgi-bin/?XSS URI...

Part of the middleware vulnerability summary-vulnerability warning-the black bar safety net

! Do the spectators for a long time, found that there has been no better middleware vulnerability of the summary of the article, just recently doing this to learn, this only summarizes a small portion of the middleware common vulnerabilities for learning reference, follow-up will complement the...

PT-2018-15026

Name of the Vulnerable Software and Affected Versions OpenWrt versions through 18.06.1 LEDE versions through 17.01 Description The issue is related to unauthenticated reflected XSS via the URI. This can be demonstrated by a cgi-bin/?XSS URI, where an attacker can inject malicious code...

CVE-2018-19646: Improper Neutralization of Special Elements used in an OS Command

The Python CGI scripts in PWS in Imperva SecureSphere 13.0.10, 13.1.10, and 13.2.10 allow remote attackers to execute arbitrary OS commands because command-line arguments are mishandled...

PT-2018-15027

Name of the Vulnerable Software and Affected Versions Imperva SecureSphere versions 13.0.10 through 13.2.10 Description The issue in Imperva SecureSphere allows remote attackers to execute arbitrary OS commands due to the mishandling of command-line arguments in the Python CGI scripts...

cgi.tu-chemnitz.de XSS vulnerability

Open Bug Bounty ID: OBB-701313 Description| Value ---|--- Affected Website:| cgi.tu-chemnitz.de Open Bug Bounty Program:| View Open Bug Bounty Program Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Cross site request forgery (csrf)

ZyXEL ZyWALL USG 2.12 AQQ.2 and 3.30 AQQ.7 devices are affected by a CSRF vulnerability via a cgi-bin/zysh-cgi cmd action to add a user account. This account's access could, for example, subsequently be used for stored XSS...

CVE-2017-17550

ZyXEL ZyWALL USG 2.12 AQQ.2 and 3.30 AQQ.7 devices are affected by a CSRF vulnerability via a cgi-bin/zysh-cgi cmd action to add a user account. This account's access could, for example, subsequently be used for stored XSS...

CVE-2017-17550

The vulnerability is in ZyXEL ZyWALL USG devices (2.12 AQQ.2 and 3.30 AQQ.7) where a CSRF flaw in the cgi-bin/zysh-cgi cmd action allows an attacker to add a user account. This newly created account could subsequently be used to perform stored XSS, as described in multiple sources. Affected softw...

CVE-2017-17550

ZyXEL ZyWALL USG 2.12 AQQ.2 and 3.30 AQQ.7 devices are affected by a CSRF vulnerability via a cgi-bin/zysh-cgi cmd action to add a user account. This account's access could, for example, subsequently be used for stored XSS...