CVE-2014-3718

Multiple cross-site scripting XSS vulnerabilities in cgi-bin/tagm.cgi in Ex Libris ALEPH 500 Integrated library management system 18.1 and 20 allow remote attackers to inject arbitrary web script or HTML via the 1 find, 2 lib, or 3 sid parameter...

CVE-2014-3719

Multiple SQL injection vulnerabilities in cgi-bin/reviewm.cgi in Ex Libris ALEPH 500 Integrated library management system 18.1 and 20 allow remote attackers to execute arbitrary SQL commands via the 1 find, 2 lib, or 3 sid parameter...

CVE-2014-3719: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in cgi-bin/reviewm.cgi in Ex Libris ALEPH 500 Integrated library management system 18.1 and 20 allow remote attackers to execute arbitrary SQL commands via the 1 find, 2 lib, or 3 sid parameter...

CVE-2014-3718: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in cgi-bin/tagm.cgi in Ex Libris ALEPH 500 Integrated library management system 18.1 and 20 allow remote attackers to inject arbitrary web script or HTML via the 1 find, 2 lib, or 3 sid parameter...

PT-2020-7654

Name of the Vulnerable Software and Affected Versions Ex Libris ALEPH 500 versions 18.1 through 20 Description The issue allows remote attackers to inject arbitrary web script or HTML via the find, lib, or sid parameters in the cgi-bin/tag m.cgi endpoint. This enables attackers to perform...

PT-2020-7655

Name of the Vulnerable Software and Affected Versions Ex Libris ALEPH 500 versions 18.1 through 20 Description The issue concerns multiple SQL injection vulnerabilities in the cgi-bin/review m.cgi component of Ex Libris ALEPH 500. These vulnerabilities allow remote attackers to execute arbitrary...

CVE-2019-20215

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi in /htdocs/cgibin, because HTTPST is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker t...

CVE-2013-2568: Improper Neutralization of Special Elements used in an OS Command

A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wirelessmft.cgi, which could let a remote malicious user execute arbitrary code...

PT-2020-7392

Name of the Vulnerable Software and Affected Versions: Zavio IP Cameras versions 1.6.3 and earlier Description: A Command Injection issue exists via the ap parameter to "/cgi-bin/mft/wireless mft.cgi" API endpoint, which could let a remote malicious user execute arbitrary code. Recommendations: F...

CVE-2013-2573: Improper Neutralization of Special Elements used in an OS Command

A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wirelessmft.cgi file in TP-Link IP Cameras TL-SC 3130, TL-SC 3130G, 3171G. and 4171G 1.6.18P12s, which could let a malicious user execute arbitrary code...

PT-2020-7511

Name of the Vulnerable Software and Affected Versions: MiCasaVerde VeraLite version 1.5.408 Description: The issue allows remote authenticated users to read arbitrary files via a .. dot dot in the filename parameter in the cgi-bin/cmh/get file.sh script. Recommendations: For version 1.5.408,...

CVE-2013-4861: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in cgi-bin/cmh/getfile.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote authenticated users to read arbirary files via a .. dot dot in the filename parameter...

PT-2020-7512

Name of the Vulnerable Software and Affected Versions: MiCasaVerde VeraLite version 1.5.408 Description: The issue allows remote authenticated users to update the firmware via the squashfs parameter to upgrade step2.sh or obtain hashed passwords via the "cgi-bin/cmh/backup.sh" page. This is due t...

CVE-2013-4864: Server-Side Request Forgery (SSRF)

MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to send HTTP requests to intranet servers via the url parameter to cgi-bin/cmh/proxy.sh, related to a Server-Side Request Forgery SSRF issue...

PT-2020-7514

Name of the Vulnerable Software and Affected Versions: MiCasaVerde VeraLite version 1.5.408 Description: The issue allows remote attackers to send HTTP requests to intranet servers via the url parameter to "cgi-bin/cmh/proxy.sh", related to a Server-Side Request Forgery SSRF issue. This means an...

CVE-2020-7980

Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed...

CVE-2020-7980: Improper Neutralization of Special Elements used in an OS Command

Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed...

Sql injection

Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and possibly other versions before 9.0.1.19899, allow remote attackers to execute arbitrary SQL commands via the 1 addip parameter to cgi-bin/scrutfaexclusions.cgi, 2...

CVE-2012-1259: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and possibly other versions before 9.0.1.19899, allow remote attackers to execute arbitrary SQL commands via the 1 addip parameter to cgi-bin/scrutfaexclusions.cgi, 2...

CVE-2012-1258: Improper Authentication

cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer before 9.0.1.19899 does not validate user permissions, which allow remote attackers to add user accounts with administrator privileges via the newuser, pwd, and selectedUserGroup parameters...