cgiemail and cgiecho format string vulnerabilities

cPanel is a Web-based hosting control management system from the U.S. company cPanel. The management system is mainly used to automate the control of web sites and servers. cgiemail is one of the mail servers. A format string vulnerability exists in cgiemail and cgiecho. An attacker can exploit...

hrejsi.cz XSS vulnerability

Vulnerable URL: http://hrejsi.cz/cgi//mso/index.pl?rok=2003=ble=goo=uvod.htm=globtabl.pl=25.9.2013=en' Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2267258 VIP website status:| N...

TM RG4332 Wireless Router - Arbitrary File Disclosure Vulnerability

Exploit for hardware platform in category web applications Exploit Title: TM RG4332 Wireless Router Traversal Arbitrary File Read Date: 27/01/2017 Exploit Author: Saeid Atabaki Version: RG4332V2.7.0 Tested on: RG4332 with minihttp 1.19 = 1...

Debian DLA-790-1 : mapserver security update

It was discovered that mapserver, a CGI-based framework for Internet map services, was vulnerable to a stack-based overflow. This issue allowed a remote user to crash the service, or potentially execute arbitrary code. For Debian 7 'Wheezy', these problems have been fixed in version...

CVE-2015-8212

CGI handling flaw in bozohttpd in NetBSD 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows remote attackers to execute arbitrary code via crafted arguments, which are handled by a non-CGI aware program...

Code injection

CGI handling flaw in bozohttpd in NetBSD 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows remote attackers to execute arbitrary code via crafted arguments, which are handled by a non-CGI aware program...

CVE-2015-8212

CGI handling flaw in bozohttpd in NetBSD 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows remote attackers to execute arbitrary code via crafted arguments, which are handled by a non-CGI aware program...

CVE-2015-8212

CGI handling flaw in bozohttpd in NetBSD 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows remote attackers to execute arbitrary code via crafted arguments, which are handled by a non-CGI aware program...

CVE-2015-8212

CVE-2015-8212 affects bozohttpd (NetBSD: 6.0.x up to 6.0.6, 6.1.x up to 6.1.5, 7.0). The flaw is in the CGI suffix handler when the -C option is used, allowing crafted arguments to be processed by a non-CGI aware program and enabling remote code execution. Severity/impact cited across sources ali...

[SECURITY] [DSA 3766-1] mapserver security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3766-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 19, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3766-1] mapserver security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3766-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 19, 2017 https://www.debian.org/security/faq -...

CVE-2015-8212: Improper Input Validation

CGI handling flaw in bozohttpd in NetBSD 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows remote attackers to execute arbitrary code via crafted arguments, which are handled by a non-CGI aware program...

PT-2017-7358

Name of the Vulnerable Software and Affected Versions bozohttpd in NetBSD versions 6.0 through 6.0.6 bozohttpd in NetBSD versions 6.1 through 6.1.5 bozohttpd in NetBSD versions 7.0 Description A flaw in CGI handling in bozohttpd allows remote attackers to execute arbitrary code via crafted...

PT-2017-7311

Name of the Vulnerable Software and Affected Versions Icinga versions prior to 1.14 Description The issue is related to a cross-site scripting XSS vulnerability in the Classic-UI, specifically with the CSV export link and pagination feature. This allows remote attackers to inject arbitrary web...

Zeroshell 3.6.0/3.7.0 Net Services - Remote Code Execution

Exploit Title: Zeroshell - Net Services Unauthenticated Remote Code Execution | RCE Date: 13.01.2017 Exploit Author: Ozer Goker Vendor Homepage: http://www.zeroshell.org Software Link: www.zeroshell.org/download/ Version: 3.6.0 & 3.7.0 Introduction Zeroshell is a small Linux distribution for...

Ubiquiti Inc.: [EdgeSwitch] Web GUI command injection as root with Privilege-1 and Privilege-15 users

The researcher found a privilege escalation in the EdgeSwitch prior to version 1.7.1, an CGI script don't fully sanitize the user input resulting in local commands execution, allowing an operator user Privilege-1 to escalate privileges and became administrator Privilege-15. OS command injection i...

PT-2017-7712

Name of the Vulnerable Software and Affected Versions ikiwiki version 3.20161219 Description The issue arises from inadequate checking of revision changes to access permissions for a page on sites utilizing the git and recentchanges plugins with the CGI interface enabled. This allows remote...

PT-2018-5114

Name of the Vulnerable Software and Affected Versions ikiwiki versions prior to 3.20161229 Description The issue arises from an incorrect call to the CGI::FormBuilder-field method, similar to the CGI-param API issue that led to Bugzilla's vulnerability. This can be exploited to forge commit...

PT-2018-5119

Name of the Vulnerable Software and Affected Versions ikiwiki versions prior to 3.20170111 Description A flaw exists in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters. Recommendations For versions prior to 3.20170111, updat...

ikiwiki -- authentication bypass vulnerability

ikiwiki reports: The ikiwiki maintainers discovered further flaws similar to CVE-2016-9646 in the passwordauth plugin's use of CGI::FormBuilder, with a more serious impact: An attacker who can log in to a site with a password can log in as a different and potentially more privileged user. An...