1197 matches found
Cross site request forgery (csrf)
ZyXEL ZyWALL USG 2.12 AQQ.2 and 3.30 AQQ.7 devices are affected by a CSRF vulnerability via a cgi-bin/zysh-cgi cmd action to add a user account. This account's access could, for example, subsequently be used for stored XSS...
CVE-2017-17550
The vulnerability is in ZyXEL ZyWALL USG devices (2.12 AQQ.2 and 3.30 AQQ.7) where a CSRF flaw in the cgi-bin/zysh-cgi cmd action allows an attacker to add a user account. This newly created account could subsequently be used to perform stored XSS, as described in multiple sources. Affected softw...
CVE-2017-17550
ZyXEL ZyWALL USG 2.12 AQQ.2 and 3.30 AQQ.7 devices are affected by a CSRF vulnerability via a cgi-bin/zysh-cgi cmd action to add a user account. This account's access could, for example, subsequently be used for stored XSS...
CVE-2018-18636
The CVE-2018-18636 entry concerns the D-Link DSL-2640T router. A cross-site scripting (XSS) vulnerability exists in the cgi-bin/webcm page reachable on the device, exploitable via the var:RelaodHref or var:conid parameters. Affected product: D-Link DSL-2640T routers (CGI web management interface)...
Design/Logic Flaw
The Port Forwarding functionality on DASAN H660GW devices allows remote attackers to execute arbitrary code via shell metacharacters in the cgi-bin/advnatvirsvr.asp Addr parameter aka the Local IP Address field...
D-Link DIR-823G has an override access vulnerability
The D-Link DIR-823G is a wireless router. The D-Link DIR-823G suffers from an override access vulnerability. The vulnerability does not have permission control over paths in the cgi-bin directory, which can be exploited by an attacker to obtain information about the device, tamper with...
CVE-2018-17208
Linksys Velop 1.1.2.187020 devices allow unauthenticated command injection, providing an attacker with full root access, via cgi-bin/zbtest.cgi or cgi-bin/zbtest2.cgi scripts that can be discovered with binwalk on the firmware, but are not visible in the web interface. This occurs because shell...
CVE-2018-17208
Linksys Velop firmware 1.1.2.187020 is affected by an unauthenticated command injection in cgi-bin/zbtest.cgi and cgi-bin/zbtest2.cgi. The root cause is mishandling of shell metacharacters in the query string by ShellExecute, enabling full root access and CSRF exploitation. No patch/version or mi...
9tox.de XSS vulnerability
Open Bug Bounty ID: OBB-674695 Description| Value ---|--- Affected Website:| 9tox.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
CVE-2018-14429
man-cgi before 1.16 allows Local File Inclusion via absolute path traversal, as demonstrated by a cgi-bin/man-cgi?/etc/passwd URI...
Command injection
OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data...
ECESSA ShieldLink SL175EHQ Cross-Site Request Forgery Vulnerability
ECESSA ShieldLink SL175EHQ is a WAN link controller from ECESSA, which includes ISP/WAN link aggregation, load balancing and traffic monitoring. A cross-site request forgery vulnerability exists in ECESSA ShieldLink SL175EHQ version 10.7.4. A remote attacker can exploit this vulnerability to add ...
CVE-2018-13032
ECESSA ShieldLink SL175EHQ devices running in 10.7.4 are affected by a CSRF vulnerability in the cgi-bin/pl_web.cgi/util_configlogin_act endpoint, enabling an attacker to add a superuser account. The issue is documented across multiple sources (NVD/NVDC CNVD) with explicit version 10.7.4 and the ...
CVE-2018-11689
Web Viewer for Hanwha DVR 2.17 and Smart Viewer in Samsung Web Viewer for Samsung DVR are vulnerable to XSS via the /cgi-bin/webviewerloginpage data3 parameter. The same Web Viewer codebase was transitioned from Samsung to Hanwha...
Intelbras NCLOUD 300 Router Authentication Bypass Vulnerability
The authentication in Intelbras NCLOUD 300 Routers can be bypassed. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
univ-littoral.fr XSS vulnerability
Open Bug Bounty ID: OBB-609821 Description| Value ---|--- Affected Website:| univ-littoral.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Routers2 2.24 - Cross-Site Scripting
Exploit Title: Routers2 2.24 - Reflected Cross-Site Scripting Date: 18-01-18 Vendor Homepage: http://www.steveshipway.org/software/ Software Link: https://github.com/sshipway/routers2 Version: 2.24 CVE: CVE-2018-6193 Platform: Perl Category: webapps Exploit Author: Lorenzo Di Fuccia Contact:...
pirkanmaanpool.fi XSS vulnerability
Open Bug Bounty ID: OBB-564983 Description| Value ---|--- Affected Website:| pirkanmaanpool.fi Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
