1716 matches found
SUSE CVE-2012-2104
cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters, which might allow user-assisted remote attackers to inject terminal emulator escape sequences and execute arbitrary commands or delete arbitrary files via a crafted HTTP request...
CVE-2022-48164: Undefined Security Weakness
An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN533A8 M33A8.V5030.190716 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials...
PT-2023-15597
Name of the Vulnerable Software and Affected Versions Wavlink WL-WN533A8 version M33A8.V5030.190716 Description An access control issue in the component /cgi-bin/ExportLogs.sh allows unauthenticated attackers to download configuration data and log files and obtain admin credentials. Recommendatio...
Design/Logic Flaw
TOTOLINK T8 V4.1.5cu was discovered to contain a hard code password for the telnet service which is stored in the component /webcste/cgi-bin/product.ini...
CVE-2023-24155: Use of Hard-coded Credentials
TOTOLINK T8 V4.1.5cu was discovered to contain a hard code password for the telnet service which is stored in the component /webcste/cgi-bin/product.ini...
CVE-2022-48165: Undefined Security Weakness
An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN530H4 M30H4.V5030.210121 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials...
CVE-2022-43976
An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p03.2.2.17p04.7p0. Direct access to the API is possible on TCP port 8888 via programs located in the cgi-bin folder without any authentication...
GE Grid Solutions MS3000 安全漏洞
GE Grid Solutions MS3000 is a transformer monitoring system from GE Grid Solutions, France. A security vulnerability exists in the GE Grid Solutions MS3000 versions prior to 3.7.6.25p03.2.2.17p04.7p0, which stems from the ability to directly access the API on TCP port 8888 without any...
CVE-2022-45028: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in Arris NVG443B 9.3.0h3d36 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request sent to /cgi-bin/logs.ha...
www/awstats -- Partial absolute pathname
MITRE reports: It seems 90 is not completely fixed in 7.8. that is, even after CVE-2017-1000501 and CVE-2020-29600 are fixed. In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname omitting the initial /etc, even though it was intended to only read a file in the...
CVE-2022-4257: Improper Neutralization
A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be...
CVE-2022-4257
A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be...
Command injection
TOTOLINK NR1800X V9.1.0u.6279B20210910 was discovered to contain a command injection vulnerability via the UploadFirmwareFile function at /cgi-bin/cstecgi.cgi...
CVE-2022-41518: Improper Neutralization of Special Elements used in an OS Command
TOTOLINK NR1800X V9.1.0u.6279B20210910 was discovered to contain a command injection vulnerability via the UploadFirmwareFile function at /cgi-bin/cstecgi.cgi...
CVE-2022-41525: Improper Neutralization of Special Elements used in an OS Command
TOTOLINK NR1800X V9.1.0u.6279B20210910 was discovered to contain a command injection vulnerability via the OpModeCfg function at /cgi-bin/cstecgi.cgi...
CVE-2022-41518
TOTOLINK NR1800X firmware 9.1.0u.6279_B20210910 is affected by CVE-2022-41518 due to a command injection in the UploadFirmwareFile function at /cgi-bin/cstecgi.cgi. The issue originates from inadequate input filtering of the FileName parameter, enabling arbitrary command execution. CVSS 3.1 base ...
CVE-2022-40475
TOTOLINK A860R V4.1.2cu.5182B20201027 was discovered to contain a command injection via the component /cgi-bin/downloadFile.cgi...
CVE-2022-40475: Improper Neutralization of Special Elements used in an OS Command
TOTOLINK A860R V4.1.2cu.5182B20201027 was discovered to contain a command injection via the component /cgi-bin/downloadFile.cgi...
CVE-2022-40712: Improper Neutralization of Input During Web Page Generation
An issue was discovered in NOKIA 1350OMS R14.2. Reflected XSS exists under different /cgi-bin/R14.2 endpoints...
