CVE-2013-7417

Cross-site scripting XSS vulnerability in cgi-bin/ipinfo.cgi in IPCop aka IPCop Firewall before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING. NOTE: this can be used to bypass the cross-site request forgery CSRF protection mechanism by setting the Refere...

CVE-2013-7417: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in cgi-bin/ipinfo.cgi in IPCop aka IPCop Firewall before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING. NOTE: this can be used to bypass the cross-site request forgery CSRF protection mechanism by setting the Refere...

CVE-2013-7418: Improper Neutralization of Special Elements used in a Command

cgi-bin/iptablesgui.cgi in IPCop aka IPCop Firewall before 2.1.5 allows remote authenticated users to execute arbitrary code via shell metacharacters in the TABLE parameter. NOTE: this can be exploited remotely by leveraging a separate cross-site scripting XSS vulnerability...

PT-2015-3578

Name of the Vulnerable Software and Affected Versions IPCop aka IPCop Firewall versions prior to 2.1.3 Description The issue allows remote attackers to inject arbitrary web script or HTML via the QUERY STRING in the cgi-bin/ipinfo.cgi endpoint. This can be used to bypass the cross-site request...

PT-2015-3579

Name of the Vulnerable Software and Affected Versions IPCop aka IPCop Firewall versions prior to 2.1.5 Description The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in the TABLE parameter of the "cgi-bin/iptablesgui.cgi" endpoint. This can be exploited...

CVE-2011-5306: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in cgi-bin/admin/setupedit.cgi in CosmoShop ePRO 10.05.00 allows remote attackers to hijack the authentication of administrators for requests that modify settings via a setup action...

PT-2015-3502

Name of the Vulnerable Software and Affected Versions CosmoShop ePRO version 10.05.00 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that modify settings via a setup action. Recommendations For version 10.05.00, a...

PT-2015-3501

Name of the Vulnerable Software and Affected Versions CosmoShop ePRO version 10.05.00 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved via the rcopy parameter to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Smoothwall Express 3.1 and 3.0 SP3 allow remote attackers to inject arbitrary web script or HTML via the 1 PROFILENAME parameter in a Save action to httpd/cgi-bin/pppsetup.cgi or 2 COMMENT parameter in an Add action to httpd/cgi-bin/ddns.cgi...

CVE-2011-5284

CVE-2011-5284 describes a Cross-site Request Forgery vulnerability in Smoothwall Express 3.1 and 3.0 SP3 and earlier, specifically in the web management interface’s httpd/cgi-bin/shutdown.cgi. The vulnerability allows an attacker to hijack an administrator’s authenticated session to perform reboo...

CVE-2011-5284: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the web management interface in httpd/cgi-bin/shutdown.cgi in Smoothwall Express 3.1 and 3.0 SP3 and earlier allows remote attackers to hijack the authentication of administrators for requests that perform a reboot via a request to...

CVE-2014-9430: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in httpd/cgi-bin/vpn.cgi/vpnconfig.dat in Smoothwall Express 3.0 SP3 allows remote attackers to inject arbitrary web script or HTML via the COMMENT parameter in an Add action...

CVE-2014-9431: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Smoothwall Express 3.1 and 3.0 SP3 allow remote attackers to hijack the authentication of administrators for requests that change the 1 admin or 2 dial password via a request to httpd/cgi-bin/changepw.cgi...

CVE-2011-5283: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the web management interface in httpd/cgi-bin/ipinfo.cgi in Smoothwall Express 3.1 and 3.0 SP3 and earlier allows remote attackers to inject arbitrary web script or HTML via the IP parameter in a Run action...

PT-2014-9008

Name of the Vulnerable Software and Affected Versions Smoothwall Express versions 3.0 SP3 through 3.1 Description The issue allows remote attackers to hijack the authentication of administrators for requests that change the admin or dial password via a request to "httpd/cgi-bin/changepw.cgi"...

PT-2014-2198

Name of the Vulnerable Software and Affected Versions Smoothwall Express versions 3.0 SP3 and earlier, Smoothwall Express version 3.1 Description A cross-site request forgery CSRF issue exists in the web management interface, specifically in the httpd/cgi-bin/shutdown.cgi endpoint. This allows...

PT-2014-2197

Name of the Vulnerable Software and Affected Versions Smoothwall Express versions 3.0 SP3 and earlier, Smoothwall Express version 3.1 Description A cross-site scripting XSS issue exists in the web management interface, specifically in the httpd/cgi-bin/ipinfo.cgi file. This allows remote attacker...

PT-2014-9007

Name of the Vulnerable Software and Affected Versions Smoothwall Express version 3.0 SP3 Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML via the COMMENT parameter in an Add action in the httpd/cgi-bin/vpn.cgi/vpnconfig.dat endpoint...

SmoothWall 3.1 Cross Site Request Forgery / Cross Site Scripting

Exploit Title: SmoothWall 3.1 Multiple vulnerabilities Date: 21/12/2014 Author: Yann CAM @ Synetis Vendor or Software Link: www.smoothwall.org - www.smoothwall.org/download/ Version: 3.1 Category: CSRF password reset & XSS persistent Google dork: Tested on: Smoothwall Linux distribution Smoothwal...

PT-2014-8889

Name of the Vulnerable Software and Affected Versions D-link IP camera DCS-2103 version 1.0.0 Description The issue allows remote attackers to read arbitrary files via a .. dot dot in the file parameter of the cgi-bin/sddownload.cgi endpoint. Recommendations For D-link IP camera DCS-2103 version...