CVE-2013-3540: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in cgi-bin/admin/usrgrp.cgi in AirLive POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD, POE100HD, and possibly other camera models allows remote attackers to hijack the authentication of administrators for requests that add users...

PT-2013-4566

Name of the Vulnerable Software and Affected Versions TP-Link IP Cameras versions prior to beta firmware LM.1.6.18P12 sign6 Description The issue allows remote attackers to cause a denial of service. This can be achieved in two ways: by sending a request to "cgi-bin/reboot" which causes the devic...

CVE-2013-3688: Undefined Security Weakness

The TP-Link IP Cameras TL-SC3171, TL-SC3130, TL-SC3130G, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12sign6, does not properly restrict access to certain administrative functions, which allows remote attackers to 1 cause a denial of service device reboot via a request to...

CVE-2013-3690: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in cgi-bin/users.cgi in Brickcom FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E, and possibly other camera models with firmware 3.1.0.8 and earlier, allows remote attackers to hijack the authentication of administrators for requests that...

PT-2013-4568

Name of the Vulnerable Software and Affected Versions Brickcom FB-100Ap versions 3.1.0.8 and earlier Brickcom WCB-100Ap versions 3.1.0.8 and earlier Brickcom MD-100Ap versions 3.1.0.8 and earlier Brickcom WFB-100Ap versions 3.1.0.8 and earlier Brickcom OB-100Ae versions 3.1.0.8 and earlier Brickc...

ZeroShell cgi-binkerbynet - Local File Disclosure

ZeroShell cgi-binkerbynet - Local File Disclosure Introduction to the PoC : ====================================================================== In this distribution, the managment website is a binary file named "kerbynet" interpreted in cgi-bin directory here :...

PT-2013-2129

Name of the Vulnerable Software and Affected Versions QNAP VioStor NVR devices version 4.0.3 QNAP NAS affected versions not specified, specifically in the Surveillance Station Pro component Description The issue allows remote authenticated users to execute arbitrary commands. This is achieved by...

CVE-2013-0143: Improper Control of Generation of Code

cgi-bin/pingping.cgi on QNAP VioStor NVR devices with firmware 4.0.3, and in the Surveillance Station Pro component in QNAP NAS, allows remote authenticated users to execute arbitrary commands by leveraging guest access and placing shell metacharacters in the query string...

CVE-2013-0144: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in cgi-bin/createuser.cgi on QNAP VioStor NVR devices with firmware 4.0.3 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a NEW USER action...

PT-2013-2130

Name of the Vulnerable Software and Affected Versions QNAP VioStor NVR devices with firmware 4.0.3 Description A cross-site request forgery CSRF issue affects the cgi-bin/create user.cgi endpoint, allowing remote attackers to hijack administrator authentication for creating administrative account...

Command injection

cgi-bin/performance/perfchart.cgi in the Performance component in GroundWork Monitor Enterprise 6.7.0 does not properly restrict XML content, which allows remote attackers to execute arbitrary commands by creating a .shtml file and leveraging Server Side Includes SSI functionality...

PT-2013-4441

Name of the Vulnerable Software and Affected Versions GroundWork Monitor Enterprise version 6.7.0 Description The issue is related to the improper restriction of XML content in the Performance component of GroundWork Monitor Enterprise. This allows remote attackers to execute arbitrary commands b...

CVE-2013-0124: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the administration interface in ASKIA askiaweb allow remote attackers to inject arbitrary web script or HTML via the 1 Number or 2 UpdatePage parameter to WebProd/cgi-bin/AskiaExt.dll...

PT-2013-2111

Name of the Vulnerable Software and Affected Versions ASKIA askiaweb affected versions not specified Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the administration interface. These vulnerabilities allow remote attackers to inject arbitrary web script or HTM...

VulnCheck KEV: CVE-2017-16959

The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence of arbitrary files by making an operation=write;locale=%0d request, and then making an operation=read request with a crafted Accept-Language HTTP heade...

CVE-2012-4443: Undefined Security Weakness

Monkey HTTP Daemon 0.9.3 uses a real UID of root and a real GID of root during execution of CGI scripts, which might allow local users to gain privileges by leveraging cgi-bin write access...

PT-2012-5404

Name of the Vulnerable Software and Affected Versions Monkey HTTP Daemon version 0.9.3 Description The issue allows local users to potentially gain privileges by exploiting cgi-bin write access during the execution of CGI scripts, as the software uses a real UID of root and a real GID of root...

CVE-2012-2104

cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters, which might allow user-assisted remote attackers to inject terminal emulator escape sequences and execute arbitrary commands or delete arbitrary files via a crafted HTTP request...

CVE-2012-2104

cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters, which might allow user-assisted remote attackers to inject terminal emulator escape sequences and execute arbitrary commands or delete arbitrary files via a crafted HTTP request...

CVE-2012-2104

cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters, which might allow user-assisted remote attackers to inject terminal emulator escape sequences and execute arbitrary commands or delete arbitrary files via a crafted HTTP request...