CVE-2009-2323

The web interface on the Axesstel MV 410R redirects users back to the referring page after execution of some CGI scripts, which makes it easier for remote attackers to avoid detection of cross-site request forgery CSRF attacks, as demonstrated by a redirect from the cgi-bin/wireless.cgi script...

CVE-2009-2322

The CVE-2009-2322 entry concerns the Axesstel MV 410R router. A vulnerability in the CGI script cgi-bin/sysconf.cgi enables cross-site scripting (XSS), allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. The NVD metrics indicate a Medium severity (CVSS v2: AV...

CVE-2009-2323: Cross-Site Request Forgery (CSRF)

The web interface on the Axesstel MV 410R redirects users back to the referring page after execution of some CGI scripts, which makes it easier for remote attackers to avoid detection of cross-site request forgery CSRF attacks, as demonstrated by a redirect from the cgi-bin/wireless.cgi script...

CVE-2009-2321: Undefined Security Weakness

cgi-bin/sysconf.cgi on the Axesstel MV 410R allows remote attackers to cause a denial of service configuration reset via a RESTORE=RESTORE query string...

CVE-2009-2322: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in cgi-bin/sysconf.cgi on the Axesstel MV 410R allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Multiple Flaws in Axesstel MV 410R

Multiple Flaws in Axesstel MV 410R by Filip Palian filip dot palian at pjwstk dot edu dot pl Description: Axesstel MV 410R is a device offered by the two leading polish telecom operators Orange and Polish Telecom to provide broadband Internet in CDMA technology and it's already widely in use...

Axesstel MV 410R Bypass / XSS

Multiple Flaws in Axesstel MV 410R by Filip Palian filip dot palian at pjwstk dot edu dot pl Description: Axesstel MV 410R is a device offered by the two leading polish telecom operators Orange and Polish Telecom to provide broadband Internet in CDMA technology and it's already widely in use...

CVE-2009-2298

Stack-based buffer overflow in rping in HP OpenView Network Node Manager OV NNM 7.53 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, possibly involving a CGI request to webappmon.exe. NOTE: this may overlap CVE-2009-1420...

CVE-2009-2300

The management interface in the phion airlock Web Application Firewall WAF 4.1-10.41 does not properly handle CGI requests that specify large width and height parameters for an image, which allows remote attackers to execute arbitrary commands or cause a denial of service resource consumption via...

Stack overflow

Stack-based buffer overflow in rping in HP OpenView Network Node Manager OV NNM 7.53 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, possibly involving a CGI request to webappmon.exe. NOTE: this may overlap CVE-2009-1420...

CVE-2009-2300

The management interface in the phion airlock Web Application Firewall WAF 4.1-10.41 does not properly handle CGI requests that specify large width and height parameters for an image, which allows remote attackers to execute arbitrary commands or cause a denial of service resource consumption via...

Sourcefire 3D Sensor & Defense Center 4.8.x Privilege Escalation Vuln

Exploit for cgi platform in category web applications ===================================================================== Sourcefire 3D Sensor & Defense Center 4.8.x Privilege Escalation Vuln ===================================================================== Affected product ----------------...

CVE-2009-2300: Undefined Security Weakness

The management interface in the phion airlock Web Application Firewall WAF 4.1-10.41 does not properly handle CGI requests that specify large width and height parameters for an image, which allows remote attackers to execute arbitrary commands or cause a denial of service resource consumption via...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

CVE-2009-2258: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in cgi-bin/webcm in the administrative web interface on the Netgear DG632 with firmware 3.4.0ap allows remote attackers to list arbitrary directories via a .. dot dot in the nextpage parameter...

CVE-2009-2256: Improper Input Validation

The administrative web interface on the Netgear DG632 with firmware 3.4.0ap allows remote attackers to cause a denial of service web outage via an HTTP POST request to cgi-bin/firmwarecfg...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. LinksExchanger - Crossite scripting. phpMyAdmin - Crossite scripting...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. CMS SiteLogic: SQL injection, crossite scripting, information leak...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...