12596 matches found
CVE-2017-17550: Cross-Site Request Forgery (CSRF)
ZyXEL ZyWALL USG 2.12 AQQ.2 and 3.30 AQQ.7 devices are affected by a CSRF vulnerability via a cgi-bin/zysh-cgi cmd action to add a user account. This account's access could, for example, subsequently be used for stored XSS...
PT-2018-6532
Name of the Vulnerable Software and Affected Versions: ZyXEL ZyWALL USG versions 2.12 AQQ.2 through 3.30 AQQ.7 Description: The issue allows for a CSRF attack via the "cgi-bin/zysh-cgi" endpoint with a cmd action to add a user account. This added account could then be used for stored XSS attacks...
Apache Tomcat 7.0.79 < 7.0.84 Insecure CGI Servlet Search Algorithm Description Weakness
The version of Apache Tomcat installed on the remote host is 7.0.x prior to 7.0.84. It is, therefore, affected by a flaw that is due to the program containing an incorrect description for the CGI Servlet search algorithm, which may cause an administrator to leave the system in an insecure state...
Apache Tomcat 8.5.16 < 8.5.24 Insecure CGI Servlet Search Algorithm Description Weakness
The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.24. It is, therefore, affected by a flaw that is due to the program containing an incorrect description for the CGI Servlet search algorithm, which may cause an administrator to leave the system in an insecure state...
D-link DSL-2640T Cross-Site Scripting Vulnerability
The D-link DSL-2640T is a wireless router from AUO D-Link. A cross-site scripting vulnerability exists in the cgi-bin/webcm page in the D-link DSL-2640T. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the 'var:RelaodHref' or 'var:conid' parameter...
CVE-2018-18636
XSS exists in cgi-bin/webcm on D-link DSL-2640T routers via the var:RelaodHref or var:conid parameter...
Cross site scripting
XSS exists in cgi-bin/webcm on D-link DSL-2640T routers via the var:RelaodHref or var:conid parameter...
CVE-2018-18636
The CVE-2018-18636 entry concerns the D-Link DSL-2640T router. A cross-site scripting (XSS) vulnerability exists in the cgi-bin/webcm page reachable on the device, exploitable via the var:RelaodHref or var:conid parameters. Affected product: D-Link DSL-2640T routers (CGI web management interface)...
CVE-2018-18636: Improper Neutralization of Input During Web Page Generation
XSS exists in cgi-bin/webcm on D-link DSL-2640T routers via the var:RelaodHref or var:conid parameter...
CVE-2018-12667
The SV3C HD Camera L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B is affected by an improper authentication vulnerability that allows requests to be made to back-end CGI scripts without a valid session. This vulnerability could be used to read and modify the...
Authentication flaw
The SV3C HD Camera L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B is affected by an improper authentication vulnerability that allows requests to be made to back-end CGI scripts without a valid session. This vulnerability could be used to read and modify the...
CVE-2018-12667
The SV3C HD Camera L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B is affected by an improper authentication vulnerability that allows requests to be made to back-end CGI scripts without a valid session. This vulnerability could be used to read and modify the...
PT-2018-11317
Name of the Vulnerable Software and Affected Versions SV3C HD Camera versions prior to the fixed version Description The issue is related to improper authentication, allowing unauthorized requests to be made to back-end CGI scripts without a valid session. This could potentially be used to read a...
CVE-2018-12667: Improper Authentication
The SV3C HD Camera L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B is affected by an improper authentication vulnerability that allows requests to be made to back-end CGI scripts without a valid session. This vulnerability could be used to read and modify the...
PT-2018-11319
Name of the Vulnerable Software and Affected Versions SV3C L-SERIES HD CAMERA versions V2.3.4.2103-S50-NTD-B20170508B through V2.3.4.2103-S50-NTD-B20170823B Description The issue allows remote authenticated users to reset arbitrary accounts. This can be achieved by sending a request to the...
CVE-2018-12669: Undefined Security Weakness
SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B devices allow remote authenticated users to reset arbitrary accounts via a request to web/cgi-bin/hi3510/param.cgi...
Imperva SecureSphere 13 - Remote Command Execution Exploit
Exploit for linux platform in category web applications Title: Imperva SecureSphere 13 - Remote Command Execution Author: rsp3ar Vendor: https://www.imperva.com/products/securesphere/ CVE: N/A Version: 13.0.10, 13.1.10, 13.2.10 Tested on: SecureSphere Virtual Appliance Description PWS is a...
Imperva SecureSphere 13 Remote Command Execution
Title: Imperva SecureSphere 13 - Remote Command Execution Author: rsp3ar Date: 2018-10-08 Vendor: https://www.imperva.com/products/securesphere/ CVE: N/A Version: 13.0.10, 13.1.10, 13.2.10 Tested on: SecureSphere Virtual Appliance Description PWS is a component in SecureSphere v13, which consists...
Design/Logic Flaw
The Port Forwarding functionality on DASAN H660GW devices allows remote attackers to execute arbitrary code via shell metacharacters in the cgi-bin/advnatvirsvr.asp Addr parameter aka the Local IP Address field...