CVE-2009-2367: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

cgi-bin/makecgi-pro in Iomega StorCenter Pro generates predictable session IDs, which allows remote attackers to hijack active sessions and gain privileges via brute force guessing attacks on the sessionid parameter...

CVE-2009-2322

The CVE-2009-2322 entry concerns the Axesstel MV 410R router. A vulnerability in the CGI script cgi-bin/sysconf.cgi enables cross-site scripting (XSS), allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. The NVD metrics indicate a Medium severity (CVSS v2: AV...

CVE-2009-2323: Cross-Site Request Forgery (CSRF)

The web interface on the Axesstel MV 410R redirects users back to the referring page after execution of some CGI scripts, which makes it easier for remote attackers to avoid detection of cross-site request forgery CSRF attacks, as demonstrated by a redirect from the cgi-bin/wireless.cgi script...

CVE-2009-2321: Undefined Security Weakness

cgi-bin/sysconf.cgi on the Axesstel MV 410R allows remote attackers to cause a denial of service configuration reset via a RESTORE=RESTORE query string...

CVE-2009-2322: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in cgi-bin/sysconf.cgi on the Axesstel MV 410R allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-2256: Improper Input Validation

The administrative web interface on the Netgear DG632 with firmware 3.4.0ap allows remote attackers to cause a denial of service web outage via an HTTP POST request to cgi-bin/firmwarecfg...

CVE-2009-2258: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in cgi-bin/webcm in the administrative web interface on the Netgear DG632 with firmware 3.4.0ap allows remote attackers to list arbitrary directories via a .. dot dot in the nextpage parameter...

Command injection

cgi-bin/webutil.pl in The Puppet Master WebUtil 2.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the whois command...

CVE-2008-6555

cgi-bin/webutil.pl in The Puppet Master WebUtil allows remote attackers to execute arbitrary commands via shell metacharacters in the dig command...

CVE-2008-6554: Improper Neutralization of Special Elements used in an OS Command

cgi-bin/script in Aztech ADSL2/2+ 4-port router 3.7.0 build 070426 allows remote attackers to execute arbitrary commands via shell metacharacters in the query string...

CVE-2008-6555: Improper Input Validation

cgi-bin/webutil.pl in The Puppet Master WebUtil allows remote attackers to execute arbitrary commands via shell metacharacters in the dig command...

CVE-2008-6556: Improper Input Validation

cgi-bin/webutil.pl in The Puppet Master WebUtil 2.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the whois command...

CVE-2008-6557: Improper Input Validation

cgi-bin/webutil.pl in The Puppet Master WebUtil 2.7 allows remote attackers to execute arbitrary commands via shell metacharacters in the details command...

CVE-2009-0680: Improper Limitation of a Pathname to a Restricted Directory

cgi-bin/welcome/VPNonly in the web interface in Netgear SSL312 allows remote attackers to cause a denial of service device crash via a crafted query string, as demonstrated using directory traversal sequences...

i-dreams GB 5.4 Final (admin.dat) File Disclosure Vulnerability

Exploit for cgi platform in category web applications =============================================================== i-dreams GB 5.4 Final admin.dat File Disclosure Vulnerability ===============================================================...

CVE-2009-0545

cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the type parameter in a NoAuthREQ x509List action...

CVE-2009-0545: Improper Input Validation

cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the type parameter in a NoAuthREQ x509List action...

NaviCopa HTTP Server buffer overflow

Stack buffer overflow stack overrun on oversized request to cgi-bin directory. Script content leak with "." added to path...

HSPell 1.1 Command Execution

!/usr/bin/perl use IO::Socket; print q HSpell v1.1 Command Execution Exploit Theres a 1000 ways to improve this exploit, but I really couldn't be fucked with it. Made By ZeN http://dusecurity.com/ http://darkcode.me/ ; $host = 'site.com'; $port = '80'; $path = '/cgi-bin/cilla.cgi'; ShellMe: print...

HTMPL 1.11 - Command Execution

HTMPL 1.11 - Command Execution Software : HTMPL v1.11 Download Link : http://vmeste.org/templex/doc/1.html Vulnrability : Command Execution Severity : High Author : ZeN Website : http://dusecurity.com / http://darkcode.me/ Exploit : site.com/cgi-bin/htmpladmin.cgi?help=|cat /etc/passwd A few othe...