CVE-2017-1000471

EmbedThis GoAhead Webserver version 4.0.0 is vulnerable to a NULL pointer dereference in the CGI handler resulting in memory corruption or denial of service...

CVE-2017-1000471

EmbedThis GoAhead Webserver version 4.0.0 is vulnerable to a NULL pointer dereference in the CGI handler resulting in memory corruption or denial of service...

D-Link DNS-320 ShareCenter 1.06 - Backdoor Access

D-Link DNS-320 ShareCenter 1.06 - Backdoor Access DNS-320L ShareCenter Backdoor Vendor: D-Link Product: DNS-320L ShareCenter Version: = 1.06 -- Table of contents 00 - Introduction 00.1 Background 01 - Hard coded backdoor 01.1 - Vulnerable code analysis 01.2 -...

CVE-2017-1000471: NULL Pointer Dereference

EmbedThis GoAhead Webserver version 4.0.0 is vulnerable to a NULL pointer dereference in the CGI handler resulting in memory corruption or denial of service...

PT-2018-5237

Name of the Vulnerable Software and Affected Versions EmbedThis GoAhead Webserver version 4.0.0 Description The issue is related to a NULL pointer dereference in the CGI handler, which can result in memory corruption or denial of service. Recommendations For EmbedThis GoAhead Webserver version...

ajot.submit2aota.org XSS vulnerability

Open Bug Bounty ID: OBB-481231 Description| Value ---|--- Affected Website:| ajot.submit2aota.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Multi-Product Anti-We Remote Command Execution Vulnerability

NetBiter/HMS, etc. are gateway devices made by different companies. anti-Web is one of the anti-virus components used in them. A security vulnerability exists in the cgi-bin/write.cgi file of Anti-Web 3.8.7 and earlier versions in several products. The vulnerability can be exploited by remote...

NetWin SurgeFTP cgi/surgeftpmgr.cgi file cross-site scripting vulnerability

NetWin SurgeFTP is an FTP server from NetWin New Zealand. The server supports platforms such as Windows and Linux and provides SSL/TLS encryption. A cross-site scripting vulnerability exists in the cgi/surgeftpmgr.cgi file Web Manager interface on TCP port 7021 or 9021 in NetWin SurgeFTP version...

Meinberg LANTIME Web Configuration Utility Arbitrary File Read Vulnerability

Meinberg LANTIME is an NTP time server from Meinberg, Germany.Web Configuration Utility is one of the web configuration utilities. A security vulnerability exists in the Web Configuration Utility on Meinberg LANTIME with firmware prior to version 6.24.004. A remote attacker can exploit the...

Design/Logic Flaw

cgi/surgeftpmgr.cgi aka the Web Manager interface on TCP port 7021 or 9021 in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter...

CVE-2017-17933

NetWin SurgeFTP 23f2 contains a stored cross-site scripting (XSS) flaw in the Web Manager CGI at cgi/surgeftpmgr.cgi (ports 7021/9021). The vulnerability arises from insufficient input filtering for the classid, domainid, and username parameters, enabling an attacker to inject malicious scripts. ...

CVE-2017-17933: Improper Neutralization of Input During Web Page Generation

cgi/surgeftpmgr.cgi aka the Web Manager interface on TCP port 7021 or 9021 in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter...

PT-2017-15109

Name of the Vulnerable Software and Affected Versions SurgeFTP version 23f2 Description The issue concerns the Web Manager interface, specifically the cgi/surgeftpmgr.cgi, which is accessible on TCP port 7021 or 9021. It is susceptible to XSS attacks through the classid, domainid, or username...

CVE-2017-17888

cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 -- AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary ...

CVE-2017-17888: Improper Neutralization of Special Elements used in an OS Command

cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 -- AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary ...

CVE-2017-17888

cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 -- AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary ...

PT-2017-15075

Name of the Vulnerable Software and Affected Versions Anti-Web through version 3.8.7 Description The issue allows remote authenticated users to execute arbitrary OS commands via crafted multipart/form-data content. This affects devices from various manufacturers, including NetBiter / HMS, Ouman...

GoAhead Server CGI Remote Code Execution

Binary data goaheadcgirce.nbin...

Open redirect

TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/wportal command to cgi-bin/luci, related to the getdevicebyif function in /usr/lib/lua/luci/controller/admin/wportal.lua in uhttpd...

CVE-2017-17758

CVE-2017-17758 affects TP-Link TL-WVR and TL-WAR devices. A remote authenticated user can execute arbitrary commands via shell metacharacters in the interface field of an admin/dhcps command to cgi-bin/luci, tied to zone_get_iface_bydev in /usr/lib/lua/luci/controller/admin/dhcps.lua in uhttpd. C...