PT-2014-2952

Name of the Vulnerable Software and Affected Versions Yealink VoIP Phone SIP-T38G version affected versions not specified Description The issue concerns an absolute path traversal vulnerability. It allows remote authenticated users to read arbitrary files by providing a full pathname in the...

PT-2014-2953

Name of the Vulnerable Software and Affected Versions Yealink VoIP Phone SIP-T38G Description The issue allows remote authenticated users to execute arbitrary commands by calling the system method in the body of a request. This can be used to run unauthorized services, change directory permission...

PT-2014-2951

Name of the Vulnerable Software and Affected Versions Yealink VoIP Phone SIP-T38G version affected versions not specified Description A directory traversal issue allows remote authenticated users to read arbitrary files by using a .. dot dot in the page parameter to the "cgi-bin/cgiServer.exx"...

CVE-2013-5757: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in Yealink VoIP Phone SIP-T38G allows remote authenticated users to read arbitrary files via a full pathname in the dumpConfigFile function in the command parameter to cgi-bin/cgiServer.exx...

CVE-2013-5758: Improper Neutralization of Special Elements used in an OS Command

cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by calling the system method in the body of a request, as demonstrated by running unauthorized services, changing directory permissions, and modifying files...

CVE-2013-5756: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Yealink VoIP Phone SIP-T38G allows remote authenticated users to read arbitrary files via a .. dot dot in the page parameter to cgi-bin/cgiServer.exx...

CVE-2014-4977

Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the 1 selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the 2 userid parameter in the changeUnit function, 3 methodDeta...

CVE-2014-4977

Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the 1 selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the 2 userid parameter in the changeUnit function, 3 methodDeta...

PT-2014-6240

Name of the Vulnerable Software and Affected Versions Dell SonicWall Scrutinizer version 11.0.1 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via several parameters in different API endpoints and functions, including the...

PT-2014-6239

Name of the Vulnerable Software and Affected Versions Dell SonicWall Scrutinizer version 11.0.1 Description The issue allows remote authenticated users to change user passwords. This is achieved by modifying the savePrefs parameter in a change password request to the "cgi-bin/admin.cgi" endpoint,...

CVE-2014-4977: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the 1 selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the 2 userid parameter in the changeUnit function, 3 methodDeta...

CVE-2014-4976: Undefined Security Weakness

Dell SonicWall Scrutinizer 11.0.1 allows remote authenticated users to change user passwords via the user ID in the savePrefs parameter in a change password request to cgi-bin/admin.cgi...

PServ 3.2 - Remote Source Code Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13638/info pServ is affected by a remote source code disclosure vulnerability. When handling a specially-crafted URI request, the application discloses the source code of scripts in the 'cgi-bin' directory. Information...

AutomatedShops WebC 2.0/5.0 Symbolic Link Following Configuration File Weakness

No description provided by source. source: http://www.securityfocus.com/bid/7272/info It has been reported that WebC will execute in the directory of a symbolic link from which it is invoked. Because of this, it may be possible for a local user to load a configuration file that enabled dangerous...

Apache 2.0 Encoded Backslash Directory Traversal Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5434/info A directory traversal vulnerability exists in Apache versions 2.0.39 and earlier on non-Unix platforms potentially including Apache compiled with CYGWIN. Platforms that may be affected by this include Windows,...

Philip Chinery's Guestbook 1.1 Script Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4566/info Philip Chinery's Guestbook is freely available guestbook software. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems. Philip Chinery's Guestbook does not filter script...

SGI IRIX 6.2 cgi-bin wrap Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/373/info A vulnerability exists in the cgi-bin program 'wrap', as included with Irix 6.2 from SGI. A failure to validate input results in a vulnerability that allows any remote attacker to view the contents of any world...

SGI IRIX <= 6.4 cgi-bin handler Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/380/info A vulnerability exists in the cgi-bin program 'handler', as included by Silicon Graphics in their Irix operating system. This vulnerability will allow a remote attacker to execute arbitrary commands on the...

Rit Research Labs TinyWeb 1.9.2 Unauthorized Script Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10445/info TinyWeb Server is affected by an unauthorized script disclosure vulnerability. This issue is due to an input validation error that allows malicious users to bypass standard web server rules. This issue will all...

E-Mail Security Virtual Appliance (ESVA) Remote Execution

No description provided by source. Exploit Title: E-Mail Security Virtual Appliance ESVA Remote Execution. Date: 10 Aug 2012 Exploit Author: iJoo Vendor Homepage: http://www.esvacommunity.com/ Software Link: http://sourceforge.net/projects/esva-project/ Version: 2.0.6 ESVA E-Mail Security Virtual...