PT-2015-7491

Name of the Vulnerable Software and Affected Versions ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k PE Description The issue allows remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code. Recommendations For ZTE ZXHN H108N R1A devices...

PT-2015-7492

Name of the Vulnerable Software and Affected Versions ZTE ZXHN H108N R1A versions before ZTE.bhs.ZXHNH108NR1A.k PE Description The issue allows remote authenticated users to bypass intended access restrictions via a modified request. This can be demonstrated by leveraging the support account to...

PT-2015-7493

Name of the Vulnerable Software and Affected Versions ZTE ZXHN H108N R1A versions before ZTE.bhs.ZXHNH108NR1A.k PE Description The issue is related to an absolute path traversal vulnerability in the cgi-bin/webproc component. This allows remote attackers to read arbitrary files by providing a ful...

PT-2015-7495

Name of the Vulnerable Software and Affected Versions ZTE ZXHN H108N R1A versions before ZTE.bhs.ZXHNH108NR1A.k PE Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the errorpage parameter in the cgi-bin/webproc endpoint...

Mail.ru: reflected in xss

hello i found vulnerability cross site scripting https://touch.mail.ru This vulnerability affects /cgi-bin/passremind. Attack details Cookie input VID was set to 14svrC28zu5Q1MWh0r"prompt979663" The input is reflected inside tag between single quotes. Request GET /cgi-bin/passremind HTTP/1.1...

secure.worc.ac.uk XSS vulnerability

Vulnerable URL: https://secure.worc.ac.uk/cgi-bin/library/digitization/login.pl?errmsg=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 11:49 GMT Vulnerability type:| XSS Vulnerability status:|...

integral.esac.esa.int XSS vulnerability

Vulnerable URL: http://integral.esac.esa.int/cgi-scripts/cc/sgssearchccs.cgi?reference=%3CSCRIPT%3Ealert%28String.fromCharCode%2888,%2083,%2083,%2080,%2079,%2083,%2069,%2068%29%29%3C/SCRIPT%3E=v3.0screw=XSS Details: Description| Value ---|--- Patched:| Yes, at 25.01.2016 Latest check for patch:|...

motorcycleguide.net Open Redirect vulnerability

Vulnerable URL: http://www.motorcycleguide.net/cgi-sec/urlext.cgi?https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 8454331 Google Pagerank| 4 VIP...

guitar.import-sales.com vulnerability

Vulnerable URL: http://www.guitar.import-sales.com/cgi/cala/indi.cgi?spot=7=http%3A%2F%2Fxssposed.org Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google Pagerank| 2 VIP website...

sugarriverraceway.com vulnerability

Vulnerable URL: http://sugarriverraceway.com/cgi-bin/FrameIt.cgi?url=http://xssposed.org Details: Description| Value ---|--- Patched:| Yes, at 26.01.2016 Latest check for patch:| 26.01.2016 03:42 GMT Vulnerability status:| Publicly disclosed Alexa Rank| 1204206 Google Pagerank| 2 VIP website...

council.nyc.gov XSS vulnerability

Vulnerable URL: http://council.nyc.gov/cgi-bin/goto.cgi?agency=Council=data:text/html;base64,PHNjcmlwdD5hbGVydCgvWFNTUE9TRUQvKTwvc2NyaXB0Pg== Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Ale...

boatoem.com XSS vulnerability

Open Bug Bounty ID: OBB-117146 Description| Value ---|--- Affected Website:| boatoem.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

WIMAX Modem Multiple Vulnerabilities (Dec 2015) - Active Check

WIMAX Modem is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Linksys EA6100 Wireless Router Authentication Bypass Vulnerability

Linksys EA6100 Wireless Router suffers from an authentication bypass vulnerability. Title: Linksys EA6100 Wireless Router Authentication Bypass Advisory ID: KL-001-2015-006 Publication Date: 2015.12.04 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2015-006.txt 1...

Aethra SV2242E XXE Injection Vulnerability

Aethra SV2242E suffers from an XML external entity injection vulnerability. Author : Ahmed Sultan Email : email protected Vuln. software : Aethra SV2242E Vendor site : aethra.it CVE : Requested , but haven't been assigned yet tested on : ATOS 5.6.x The bug rise because of the remote user input to...

Code injection

The Debian build procedure for the smokeping package in wheezy before 2.6.8-2+deb7u1 and jessie before 2.6.9-1+deb8u1 does not properly configure the way Apache httpd passes arguments to smokepingcgi, which allows remote attackers to execute arbitrary code via crafted CGI arguments...

CVE-2015-0859

The Debian build procedure for the smokeping package in wheezy before 2.6.8-2+deb7u1 and jessie before 2.6.9-1+deb8u1 does not properly configure the way Apache httpd passes arguments to smokepingcgi, which allows remote attackers to execute arbitrary code via crafted CGI arguments...

CVE-2015-0859

The Debian build procedure for the smokeping package in wheezy before 2.6.8-2+deb7u1 and jessie before 2.6.9-1+deb8u1 does not properly configure the way Apache httpd passes arguments to smokepingcgi, which allows remote attackers to execute arbitrary code via crafted CGI arguments...

CVE-2015-0859

The Debian build procedure for the smokeping package in wheezy before 2.6.8-2+deb7u1 and jessie before 2.6.9-1+deb8u1 does not properly configure the way Apache httpd passes arguments to smokepingcgi, which allows remote attackers to execute arbitrary code via crafted CGI arguments...

CVE-2015-0859

The Debian build procedure for the smokeping package in wheezy before 2.6.8-2+deb7u1 and jessie before 2.6.9-1+deb8u1 does not properly configure the way Apache httpd passes arguments to smokepingcgi, which allows remote attackers to execute arbitrary code via crafted CGI arguments...