12617 matches found
Debian GNU/Linux Data Compromise
The multiple vulnerabilities in the ecartis-cgi package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...
Solar-Log software Unauthorized Access
The vulnerability of the Microprogramming Software in the Solar-log photovoltaic system arises from the lack of password protection for CGI scripts used for data backup, restoration, and system configuration. Exploiting this vulnerability allows a malicious individual to gain unauthorized access ...
Debian GNU/Linux Data Compromise
The multiple vulnerabilities in the listar-cgi package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...
Python Data Compromise
The vulnerability exists in the Python CGIHTTPServer module due to incorrect handling of URL-encoded path separators. Exploiting this vulnerability allows attackers to obtain the original CGI script code or execute any CGI script in the server’s web directory...
Cisco Nexus 1000V Code Execution
The GNU Bash command shell, as of version 4.3 and later, incorrectly handles lines that follow the declaration of a function exported as a variable. This allows a malicious actor to execute arbitrary code by interfering with environment variables. Security researchers have confirmed that this...
Cisco Unified Communications Manager Information Disclosure
The GNU Bash command shell, as of version 4.3 bash43-025 and later, incorrectly handles lines that follow the declaration of a specially crafted function, which is exported as a variable. This allows a malicious actor to read and write arbitrary files, as well as perform other unconfirmed actions...
Cisco Nexus 7000 Code Execution
The GNU Bash command shell, as of version 4.3 and later, incorrectly handles lines that follow the declaration of a function exported as a variable. This allows a malicious actor to execute arbitrary code by interfering with environment variables. Security researchers have confirmed that this...
Cisco Nexus Information Disclosure
The GNU Bash command shell, as of version 4.3 bash43-025 and later, incorrectly handles lines that follow the declaration of a specially crafted function, which is exported as a variable. This allows a malicious actor to read and write arbitrary files, as well as perform other undefined actions...
PHP Privilege Escalation
The fpmunix.c library of the FastCGI Process Manager FPM component for the PHP interpreter uses access rights 0666 for the UNIX socket. This allows a malicious attacker to increase their privileges by using a specially crafted FastCGI client...
[SECURITY] Fedora 24 Update: php-5.6.23-1.fc24
PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...
Apache Httpd < 2.2.32 : HTTP_PROXY environment variable "httpoxy" mitigation
HTTPPROXY is a well-defined environment variable in a CGI process, which collided with a number of libraries which failed to avoid colliding with this CGI namespace. A mitigation is provided for the httpd CGI environment to avoid populating the "HTTPPROXY" variable from a "Proxy:" header, which h...
Apache Httpd < 2.4.25 : HTTP_PROXY environment variable "httpoxy" mitigation
HTTPPROXY is a well-defined environment variable in a CGI process, which collided with a number of libraries which failed to avoid colliding with this CGI namespace. A mitigation is provided for the httpd CGI environment to avoid populating the "HTTPPROXY" variable from a "Proxy:" header, which h...
CVE-2015-8289
The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows remote attackers to discover the cleartext administrator password by reading the cgi-bin/passrec.asp HTML source code...
PT-2016-3880
Name of the Vulnerable Software and Affected Versions NETGEAR D3600 version 1.0.0.49 NETGEAR D6000 versions 1.0.0.49 and earlier Description The issue concerns the password-recovery feature, which allows remote attackers to discover the cleartext administrator password by reading the HTML source...
CVE-2015-8289: Exposure of Sensitive Information to an Unauthorized Actor
The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows remote attackers to discover the cleartext administrator password by reading the cgi-bin/passrec.asp HTML source code...
IPFire - Bash Environment Variable Injection (Shellshock)
Exploit for cgi platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'IPFire Bash Environment Variable Injection Shellshock', 'Description' = %q...
Sun Secure Global Desktop / Oracle Global Desktop Shellshock
Exploit Title: ShellShock On Sun Secure Global Desktop & Oracle Global desktop Google Dork: intitle:Install the Sun Secure Global Desktop Native Client Date: 6/4/2016 Exploit Author: [email protected] Vendor Homepage: http://www.sun.com/ & http://www.oracle.com/ Software Link:...
CVE-2016-1212
Directory traversal vulnerability in futomi MP Form Mail CGI Professional Edition 3.2.3 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors...
CVE-2016-1212
CVE-2016-1212 affects Futomi MP Form Mail CGI Professional Edition up to version 3.2.3, exposing a directory traversal vulnerability (CWE-22). The flaw allows remote authenticated administrators to read arbitrary files on the server via unspecified vectors. Public records from NVD/JVN describe th...
CVE-2016-1212: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in futomi MP Form Mail CGI Professional Edition 3.2.3 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors...