CVE-2017-16564

Stored Cross-site scripting XSS vulnerability in /cgi-bin/config2 on Vonage Grandstream HT802 devices allows remote authenticated users to inject arbitrary web script or HTML via the DHCP vendor class ID field P148...

CVE-2017-16563

Cross-Site Request Forgery CSRF in the Basic Settings screen on Vonage Grandstream HT802 devices allows attackers to modify settings, related to cgi-bin/update...

CVE-2017-16565: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF in /cgi-bin/login on Vonage Grandstream HT802 devices allows attackers to authenticate a user via the login screen using the default password of 123 and submit arbitrary requests...

PT-2017-14448

Name of the Vulnerable Software and Affected Versions Vonage Grandstream HT802 devices affected versions not specified Description The issue concerns a Cross-Site Request Forgery CSRF in the Basic Settings screen. This allows attackers to modify settings related to the cgi-bin/update endpoint...

PT-2017-14449

Name of the Vulnerable Software and Affected Versions Vonage Grandstream HT802 devices affected versions not specified Description A stored Cross-site scripting XSS issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via the DHCP vendor class ID field,...

CVE-2017-16563: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF in the Basic Settings screen on Vonage Grandstream HT802 devices allows attackers to modify settings, related to cgi-bin/update...

PT-2017-14450

Name of the Vulnerable Software and Affected Versions Vonage Grandstream HT802 devices affected versions not specified Description The issue concerns a Cross-Site Request Forgery CSRF in the /cgi-bin/login API endpoint. This allows attackers to authenticate a user via the login screen using the...

CVE-2017-16564: Improper Neutralization of Input During Web Page Generation

Stored Cross-site scripting XSS vulnerability in /cgi-bin/config2 on Vonage Grandstream HT802 devices allows remote authenticated users to inject arbitrary web script or HTML via the DHCP vendor class ID field P148...

localwebindex.com XSS vulnerability

Open Bug Bounty ID: OBB-391109 Description| Value ---|--- Affected Website:| localwebindex.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

fah-web.stanford.edu XSS vulnerability

Open Bug Bounty ID: OBB-389094 Description| Value ---|--- Affected Website:| fah-web.stanford.edu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

EMC VMAX VASA Provider Virtual Appliance < 8.4.0.512 Authentication Bypass Vulnerability

The version of EMC VMAX VASA Provider Virtual Appliance running on the remote host is prior to 8.4.0.512. It is, therefore, affected by an authentication bypass vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid104391; scriptversion"1.10";...

Cesanta Mongoose HTTP Server CGI Remote Code Execcution Vulnerability

Summary An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI target can cause a reuse of previously freed pointer potentially resulting in remote code execution. An attacker needs to send this HTTP...

cinemed.tm.fr XSS vulnerability

Open Bug Bounty ID: OBB-369662 Description| Value ---|--- Affected Website:| cinemed.tm.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

webevents.uow.edu.au XSS vulnerability

Open Bug Bounty ID: OBB-369650 Description| Value ---|--- Affected Website:| webevents.uow.edu.au Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

Webmin Cross-Site Request Forgery Vulnerability

Webmin is a web-based system administration tool for Unix-like operating systems developed by Australian software developer Jamie Cameron and the Webmin community. A cross-site request forgery vulnerability exists in Webmin version 1.850. A remote attacker can exploit this vulnerability by sendin...

CVE-2017-15647: Improper Limitation of a Pathname to a Restricted Directory

On FiberHome routers, Directory Traversal exists in /cgi-bin/webproc via the getpage parameter in conjunction with a crafted var:page value...

PT-2017-14139

Name of the Vulnerable Software and Affected Versions FiberHome routers affected versions not specified Description A Directory Traversal issue exists in the /cgi-bin/webproc endpoint via the getpage parameter in conjunction with a crafted var:page value. Recommendations At the moment, there is n...

Trend Micro OfficeScan cgiShowClientAdm Remote Memory Corruption

The version of Trend Micro OfficeScan running on the remote host is 11.x prior to 11.0 SP1 CP 6426, or 12.x prior to 12.0 CP 1708. It is, therefore, affected by a remote memory corruption flaw in cgiShowClientAdm.exe due to improper input validation. An unauthenticated remote attacker can corrupt...

FiberHome Directory Traversal

Vulnerability Summary The following advisory describes a directory traversal vulnerability found in FiberHome routers. FiberHome Technologies Group “was established in 1974. After continuous and intensive development for over 40 years, its business has been extended to R&D, manufacturing, marketi...

UTStar WA3002G4 ADSL Broadband Modem - Authentication Bypass(CVE-2017-14243)

Exploit Title: UTStar WA3002G4 ADSL Broadband Modem Authentication Bypass Vulnerability CVE: CVE-2017-14243 Date: 15-09-2017 Exploit Author: Gem George Author Contact: https://www.linkedin.com/in/gemgrge Vulnerable Product: UTStar WA3002G4 ADSL Broadband Modem Firmware version: WA3002G4-0021.01...