2025 matches found
CVE-2019-15498: Improper Neutralization of Argument Delimiters in a Command
cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh...
Dynacolor FCM-MB40 Cross-Site Request Forgery Vulnerability
Dynacolor FCM-MB40 is an IP camera from Dynacolor, Taiwan, China. A cross-site request forgery vulnerability exists in scripts under cgi-bin/ in the Dynacolor FCM-MB40 v1.2.0.0, which arises from a network system or product that does not adequately verify the origin or authenticity of data, and c...
CVE-2019-13401
Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...
CVE-2019-13401
Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...
Cross site request forgery (csrf)
Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...
CVE-2019-13401
Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...
CVE-2019-13400
CVE-2019-13400 affects Dynacolor FCM-MB40 v1.2.0.0. The issue arises from storing administrative web-interface credentials in cleartext at /etc/appWeb/appweb.pass, which can be retrieved by accessing cgi-bin/getuserinfo.cgi?mode=info. The vulnerability is evidenced in multiple sources (NVD entry ...
PT-2019-13310
Name of the Vulnerable Software and Affected Versions Dynacolor FCM-MB40 version 1.2.0.0 Description The issue allows remote attackers to execute arbitrary commands by providing a crafted parameter to a CGI script. This can be achieved through sed injection in the cgi-bin/camctrl save profile.cgi...
PT-2019-13313
Name of the Vulnerable Software and Affected Versions Dynacolor FCM-MB40 version 1.2.0.0 Description The issue concerns a CSRF problem present in all scripts under the cgi-bin/ directory. Recommendations For Dynacolor FCM-MB40 version 1.2.0.0, consider implementing proper CSRF protection...
CVE-2019-13401: Cross-Site Request Forgery (CSRF)
Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...
CVE-2019-13398: Improper Neutralization of Special Elements used in an OS Command
Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrlsaveprofile.cgi save parameter and cgi-bin/ddns.cgi...
PT-2019-13314
Name of the Vulnerable Software and Affected Versions Dynacolor FCM-MB40 version 1.2.0.0 Description The issue concerns an incomplete factory-reset process implemented by /usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on the affected device. This incompleteness c...
PT-2019-13312
Name of the Vulnerable Software and Affected Versions Dynacolor FCM-MB40 version 1.2.0.0 Description The issue concerns the storage of administrative web-interface credentials in cleartext. Specifically, the credentials are stored in the /etc/appWeb/appweb.pass file. An attacker can retrieve thes...
CVE-2019-13400: Insufficiently Protected Credentials
Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. These credentials can be retrieved via cgi-bin/getuserinfo.cgi?mode=info...
D-Link DI-524 Router XSS
The vulnerability of D-Link DI-524 router’s microprogram code exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject JavaScript code into the device’s web interface pages. The web configuration files,...
VulnCheck KEV: CVE-2009-5156
An issue was discovered on ASMAX AR-804gu 66.34.1 devices. There is Command Injection via the cgi-bin/script query string...
VulnCheck KEV: CVE-2009-2765
httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI...
CVE-2009-5156
An issue was discovered on ASMAX AR-804gu 66.34.1 devices. There is Command Injection via the cgi-bin/script query string...
CVE-2009-5156
A Command Injection vulnerability exists in ASMAX AR-804gu routers, specifically affecting version 66.34.1 . The flaw is triggered via the cgi-bin/script query string. A remote attacker can exploit this by sending a specially crafted request to the victim device, potentially allowing the executio...