Aztech Routers - '/cgi-bin/AZ_Retrain.cgi' Denial of Service

/ source: https://www.securityfocus.com/bid/69809/info Multiple Aztech routers are prone to a denial-of-service vulnerability. Attackers may exploit this issue to cause an affected device to crash, resulting in a denial-of-service condition. Aztech DSL5018EN, DSL705E and DSL705EU are vulnerable. ...

IBM WebSphere Application Server (WAS) Integrated Solutions Console Login Page username Parameter Reflected XSS Security Vulnerability

INFO: Class: Input Validation Error CVE: Remote: Yes Local: No Published: Aug 27 2014 12:00AM Updated: Aug 27 2014 12:00AM Credit: G. S. McNamara, CGI Federal Emerging Technologies Security Practice ETSP Vulnerable: IBM WebSphere Application Server WAS Integrated Solutions Console 7.0.0.19...

Ubuntu: Security Advisory (USN-2344-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Novell GroupWise 'FileUploadServlet' Arbitrary File Access Vulnerability

The remote Novell GroupWise administration console is affected by an arbitrary file access vulnerability that allows attackers to access and delete arbitrary files on the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc';...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

httpd: mod_cgid denial of service

A denial of service flaw was found in the way httpd's modcgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely...

httpd: mod_cgid denial of service

A denial of service flaw was found in the way httpd's modcgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely...

VM-Turbo-Operations-Manager 4.5.x /cgi-bin/help/doIt.cgi 任意文件读取漏洞

No description provided by source...

openSUSE: Security Advisory for security (openSUSE-SU-2014:0969-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

security issues addressed, most notably the mod_security heap overflow known as CVE-2014-0226 (important)

apache2: - ECC support was added to modssl - fix for a race condition in modstatus known as CVE-2014-0226 can lead to information disclosure; modstatus is not active by default, and is normally only open for connects from localhost. - fix for bug known as CVE-2014-0098 that can crash the apache...

CVE-2014-3851: Exposure of Sensitive Information to an Unauthorized Actor

usr/lib/cgi-bin/createpasswdfile.py in Pyplate 0.08 uses world-readable permissions for passwd.db, which allows local users to obtain the administrator password by reading this file...

protecgaz.fr XSS vulnerability

Open Bug Bounty ID: OBB-47638 Description| Value ---|--- Affected Website:| protecgaz.fr Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

Path traversal

Absolute path traversal vulnerability in Yealink VoIP Phone SIP-T38G allows remote authenticated users to read arbitrary files via a full pathname in the dumpConfigFile function in the command parameter to cgi-bin/cgiServer.exx...

CVE-2013-5756

Directory traversal vulnerability in Yealink VoIP Phone SIP-T38G allows remote authenticated users to read arbitrary files via a .. dot dot in the page parameter to cgi-bin/cgiServer.exx...

CVE-2013-5757

Yealink VoIP Phone SIP-T38G is affected by CVE-2013-5757 (absolute path traversal) via the cgiServer.exx command parameter (dumpConfigFile). The vulnerability allows remote authenticated users to read arbitrary files by supplying a full pathname, with corroborating references describing /etc/pass...

CVE-2013-5756

The provided sources confirm CVE-2013-5756 affects Yealink VoIP Phone SIP-T38G via a directory traversal in the web interface (cgi-bin/cgiServer.exx). An authenticated remote attacker can read arbitrary files by supplying a crafted …/ page parameter, enabling access to sensitive files such as /et...

PT-2014-2953

Name of the Vulnerable Software and Affected Versions Yealink VoIP Phone SIP-T38G Description The issue allows remote authenticated users to execute arbitrary commands by calling the system method in the body of a request. This can be used to run unauthorized services, change directory permission...

PT-2014-2951

Name of the Vulnerable Software and Affected Versions Yealink VoIP Phone SIP-T38G version affected versions not specified Description A directory traversal issue allows remote authenticated users to read arbitrary files by using a .. dot dot in the page parameter to the "cgi-bin/cgiServer.exx"...

PT-2014-2952

Name of the Vulnerable Software and Affected Versions Yealink VoIP Phone SIP-T38G version affected versions not specified Description The issue concerns an absolute path traversal vulnerability. It allows remote authenticated users to read arbitrary files by providing a full pathname in the...

CVE-2013-5756: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Yealink VoIP Phone SIP-T38G allows remote authenticated users to read arbitrary files via a .. dot dot in the page parameter to cgi-bin/cgiServer.exx...