CVE-2008-2835: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in cgi-bin/igsuite in IGSuite 3.2.4 allows remote attackers to execute arbitrary SQL commands via the formid parameter...

IGSuite 3.2.4 - Reverse Shell / Blind SQL Injection

!/usr/bin/perl 05/18/2008 - IGSuite 3.2.4 Blind SQL Injection - ksOSe 05/21/2008 - Vendor notified 05/23/2008 - A patch was pushed via the igsuited daemonnot enabled by default Fix: run igsuited --update-igsuite or upgrade to 3.2.5-beta. Tested on IGSuite 3.2.4 on linux with MySQL, needs ncin pat...

Barracuda Spam Firewall cgi-bin/ldap_test.cgi email Parameter XSS

According to its firmware version, the remote Barracuda Spam Firewall device fails to filter input to the 'email' parameter of the '/cgi-bin/ldaptest.cgi' script before using it to generate dynamic content. An unauthenticated, remote attacker may be able to leverage this issue to inject arbitrary...

CVE-2008-1960

CVE-2008-1960 describes a Cross-site Scripting (XSS) vulnerability in ContRay 3.x, affecting the CGI script cgi-bin/contray/search.cgi via the search parameter. Remote attackers can inject arbitrary web script or HTML. Per NVD data, the attack is network-delivery with medium complexity and no aut...

CVE-2008-1960: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in cgi-bin/contray/search.cgi in ContRay 3.x allows remote attackers to inject arbitrary web script or HTML via the search parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-1541: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in cgi-bin/his-webshop.pl in HIS Webshop 2.50 allows remote attackers to read arbitrary files via a .. dot dot in the t parameter...

Authentication flaw

cgi-bin/setupdns.exe on the Belkin F5D7230-4 router with firmware 9.01.10 does not require authentication, which allows remote attackers to perform administrative actions, as demonstrated by changing a DNS server via the dns11, dns12, dns13, and dns14 parameters. NOTE: it was later reported that...

Design/Logic Flaw

cgi-bin/setupvirtualserver.exe on the Belkin F5D7230-4 router with firmware 9.01.10 allows remote attackers to cause a denial of service control center outage via an HTTP request with invalid POST data and a "Connection: Keep-Alive" header...

CVE-2008-1245: Improper Input Validation

cgi-bin/setupvirtualserver.exe on the Belkin F5D7230-4 router with firmware 9.01.10 allows remote attackers to cause a denial of service control center outage via an HTTP request with invalid POST data and a "Connection: Keep-Alive" header...

CVE-2008-1253: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in cgi-bin/webcm on the D-Link DSL-G604T router allows remote attackers to inject arbitrary web script or HTML via the var:category parameter, as demonstrated by a request for advanced/portforw.htm on the fwan page...

CVE-2008-1244: Improper Authentication

cgi-bin/setupdns.exe on the Belkin F5D7230-4 router with firmware 9.01.10 does not require authentication, which allows remote attackers to perform administrative actions, as demonstrated by changing a DNS server via the dns11, dns12, dns13, and dns14 parameters. NOTE: it was later reported that...

CVE-2007-6700

Cross-site scripting XSS vulnerability in cgi-bin/bgplg in the web interface for the BGPD daemon in OpenBSD 4.1 allows remote attackers to inject arbitrary web script or HTML via the cmd parameter...

CVE-2007-6700: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in cgi-bin/bgplg in the web interface for the BGPD daemon in OpenBSD 4.1 allows remote attackers to inject arbitrary web script or HTML via the cmd parameter...

CVE-2007-5735

CVE-2007-5735 affects eFileMan 7.1.0.87-88. The vulnerability arises from storing sensitive information under the web root with insufficient access control, allowing remote attackers to obtain unspecified user information via a direct request to cgi-bin/efileman/efileman_config.pm. Impact is part...

CVE-2007-5735: Undefined Security Weakness

eFileMan 7.1.0.87-88 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain unspecified user information via a direct request for cgi-bin/efileman/efilemanconfig.pm...

CVE-2003-1510

TinyWeb 1.9 allows remote attackers to cause a denial of service CPU consumption via a ".%00." in an HTTP GET request to the cgi-bin directory...

CVE-2003-1510: Undefined Security Weakness

TinyWeb 1.9 allows remote attackers to cause a denial of service CPU consumption via a ".%00." in an HTTP GET request to the cgi-bin directory...

Cross site scripting

Cross-site scripting XSS vulnerability in cgi-bin/webif.exe in ifnet WebIf allows remote attackers to inject arbitrary web script or HTML via the cmd parameter...

CVE-2007-5673

Cross-site scripting XSS vulnerability in cgi-bin/webif.exe in ifnet WebIf allows remote attackers to inject arbitrary web script or HTML via the cmd parameter...

CVE-2007-5673: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in cgi-bin/webif.exe in ifnet WebIf allows remote attackers to inject arbitrary web script or HTML via the cmd parameter...