Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

CVE-2013-3686

cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password via a list action...

CVE-2013-2578

cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12sign6 allows remote attackers to execute arbitrary commands via shell metacharacters in 1 the ServerName parameter and 2 other unspecified...

CVE-2013-3686

cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password via a list action...

PT-2013-3850

Name of the Vulnerable Software and Affected Versions TP-Link IP Cameras versions prior to beta firmware LM.1.6.18P12 sign6 Description The issue allows remote attackers to modify the firmware revision. This is achieved through the cgi-bin/firmwareupgrade endpoint, by utilizing a "preset" action...

PT-2013-4564

Name of the Vulnerable Software and Affected Versions AirLive WL2600CAM affected versions not specified Description The issue allows remote attackers to obtain the administrator password. This is achieved through the cgi-bin/operator/param endpoint, specifically by utilizing a list action...

PT-2013-3847

Name of the Vulnerable Software and Affected Versions TP-Link IP Cameras versions prior to beta firmware LM.1.6.18P12 sign6 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the ServerName parameter and other unspecified parameters in the...

CVE-2013-2581: Undefined Security Weakness

cgi-bin/firmwareupgrade in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12sign6 allows remote attackers to modify the firmware revision via a "preset" action...

PT-2013-3849

Name of the Vulnerable Software and Affected Versions TP-Link IP Cameras versions prior to beta firmware LM.1.6.18P12 sign6 Description The issue allows remote attackers to upload arbitrary files to the cgi-bin/uploadfile directory, which can then be accessed directly via a request to the file in...

CVE-2013-2578: Improper Neutralization of Special Elements used in an OS Command

cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12sign6 allows remote attackers to execute arbitrary commands via shell metacharacters in 1 the ServerName parameter and 2 other unspecified...

CVE-2013-2580: Undefined Security Weakness

Unrestricted file upload vulnerability in cgi-bin/uploadfile in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12sign6, allows remote attackers to upload arbitrary files, then accessing it via a direct request to the file ...

CVE-2013-3686: Undefined Security Weakness

cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password via a list action...

Samsung DVR authentication bypass

Title: Samsung DVR authentication bypass Version affected: firmware version = 1.10 Vendor: Samsung - www.samsung-security.com Discovered by: Andrea Fabrizi Email: [email protected] Web: http://www.andreafabrizi.it Twitter: @andreaf83 Status: unpatched Samsung provides a wide range of DVR...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

CVE-2013-3541

The CVE-2013-3541 entry concerns a directory traversal vulnerability in AirLive devices, specifically the cgi-bin/admin/fileread functionality. The documented flaw allows remote attackers to read arbitrary files by manipulating the READ.filePath parameter (using .. to traverse directories). Affec...

PT-2013-4471

Name of the Vulnerable Software and Affected Versions AirLive WL2600CAM affected versions not specified Description A directory traversal issue exists in the cgi-bin/admin/fileread endpoint, allowing remote attackers to read arbitrary files by including a .. dot dot in the READ.filePath parameter...

PT-2013-4470

Name of the Vulnerable Software and Affected Versions AirLive POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD, POE100HD affected versions not specified Description A cross-site request forgery CSRF issue exists in the cgi-bin/admin/usrgrp.cgi file. This allows remote attackers to...

CVE-2013-3541: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in cgi-bin/admin/fileread in AirLive WL2600CAM and possibly other camera models allows remote attackers to read arbitrary files via a .. dot dot in the READ.filePath parameter...

CVE-2013-3540: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in cgi-bin/admin/usrgrp.cgi in AirLive POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD, POE100HD, and possibly other camera models allows remote attackers to hijack the authentication of administrators for requests that add users...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...