SYNCK GRAPHICA Download Log CGI vulnerable to directory traversal

Overview Download Log CGI provided by SYNCK GRAPHICA contains an issue in processing file names, which may result in a directory traversal vulnerability. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

PT-2015-3672 · D Link · D-Link Dap-1360

Name of the Vulnerable Software and Affected Versions: D-Link DAP-1360 router versions 2.5.4 and later Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the res buf parameter to "index.cgi" when res config id is set to 41. This could...

PT-2015-3655

Name of the Vulnerable Software and Affected Versions TRENDnet SecurView camera TV-IP422WN affected versions not specified Description The issue is a stack-based buffer overflow in the UltraCamLib of the UltraCam ActiveX Control. This can be exploited by remote attackers who send a long string to...

PHP Out of Bounds Read Vulnerability (Jan 2015)

PHP is prone to an out of bounds read vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; ifdescription...

PHP 'cgi_main.c' Out-of-Bounds Read Denial of Service Vulnerability

PHP is a popular programming language. An out-of-bounds read denial of service vulnerability exists in PHP 'cgimain.c', which can be exploited by a remote attacker to crash the application, resulting in a denial of service...

Sitecom-MD-25x

Exploit Title: Sitecom MD-253 and MD-254 Network Storage Reverse Shell Exploit Date: 09/11/12 Exploit Author: Mattijs van Ommeren mattijs at alcyon dot nl Vendor Homepage: http://www.sitecom.com Software Link: http://www.sitecom.com/download/5012/SitecomNas.2.4.17.bin Version: 2.4.17 and below...

Nagios-history.cgi-Exec-Code

CVE-2012-6096 - Nagios history.cgi Remote Command Execution Another year, another reincarnation of classic and trivial bugs to exploit. This time we attack Nagios.. or more specifically, one of its CGI scripts. !/usr/bin/python CVE-2012-6096 - Nagios history.cgi Remote Command Execution...

IPCop Firewall cgi-bin/iptablesgui.cgi Arbitrary Code Execution Vulnerability

IPCop Firewall is a firewall suite for the Linux environment , mainly for home and SOHO Small Office/Home Office users . An arbitrary code execution vulnerability exists in cgi-bin/iptablesgui.cgi in IPCop Firewall, which allows remote authenticated users to execute arbitrary code via the TABLE...

Apache-mod_cgi-Shellshock

Shellshock apache modcgi remote exploit rhost: victim host rport: victim port for TCP shell binding lhost: attacker host for TCP shell reversing lport: attacker port for TCP shell reversing pages: specific cgi vulnerable pages separated by comma proxy: host:port proxy ! /usr/bin/env python from...

CVE-2014-9427

sapi/cgi/cgimain.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not properly consider the mapping's length during processing of an invalid file that begins with a character and lacks a newline character, whi...

Out-of-bounds

sapi/cgi/cgimain.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not properly consider the mapping's length during processing of an invalid file that begins with a character and lacks a newline character, whi...

CVE-2014-9427

sapi/cgi/cgimain.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not properly consider the mapping's length during processing of an invalid file that begins with a character and lacks a newline character, whi...

CVE-2014-9427

sapi/cgi/cgimain.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not properly consider the mapping's length during processing of an invalid file that begins with a character and lacks a newline character, whi...

CVE-2014-9427

The CVE-2014-9427 issue affects PHP CGI (sapi/cgi/cgi_main.c). In PHP 5.4.36 and 5.5.x up to 5.5.20, and 5.6.x up to 5.6.4, mmap-based reading of a .php file can miss the mapping length for certain invalid inputs starting with ‘#’ and lacking a newline. This yields an out-of-bounds read that coul...

CVE-2014-9427: Improper Restriction of Operations within the Bounds of a Memory Buffer

sapi/cgi/cgimain.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not properly consider the mapping's length during processing of an invalid file that begins with a character and lacks a newline character, whi...

Cross site scripting

Cross-site scripting XSS vulnerability in cgi-bin/ipinfo.cgi in IPCop aka IPCop Firewall before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING. NOTE: this can be used to bypass the cross-site request forgery CSRF protection mechanism by setting the Refere...

CVE-2013-7417

Cross-site scripting XSS vulnerability in cgi-bin/ipinfo.cgi in IPCop aka IPCop Firewall before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING. NOTE: this can be used to bypass the cross-site request forgery CSRF protection mechanism by setting the Refere...

CVE-2013-7417

Cross-site scripting XSS vulnerability in cgi-bin/ipinfo.cgi in IPCop aka IPCop Firewall before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING. NOTE: this can be used to bypass the cross-site request forgery CSRF protection mechanism by setting the Refere...

CVE-2013-7417

Affected software: IPCop Firewall (IPCop). Vulnerable component: web interface script at cgi-bin/ipinfo.cgi. Root cause: Cross-site scripting (XSS) via QUERY_STRING, with note that CSRF protection can be bypassed by Referer. Impact: remote attacker can inject arbitrary web scripts/HTML in users’ ...