339 matches found
TOTOLINK T6: Operating System Command Injection Vulnerability
TOTOLINK T6 is a wireless dual-band router from China's TOTOLINK Electronics TOTOLINK that supports MQTT protocol and Telnet service. The TOTOLINK T6 suffers from a command injection vulnerability that stems from the sub421AA0 function in cstecgi.cgi failing to properly filter construct command...
CVE-2022-38400
Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL...
PT-2022-24408 · Unknown · Mailform Pro Cgi
Name of the Vulnerable Software and Affected Versions: Mailform Pro CGI versions 4.3.1 and earlier Description: The issue allows a remote unauthenticated attacker to obtain user input data by accessing a specially crafted URL. Recommendations: For Mailform Pro CGI versions 4.3.1 and earlier, at t...
Zyxel USG/ZyWALL cross-site scripting vulnerabilities
Zyxel USG/ZyWALL is a firewall from China's Heqin Technology Zyxel. A cross-site scripting vulnerability exists in the CGI program in Zyxel USG/ZyWALL versions 4.35-4.70, USG FLEX 4.50-5.20, ATP 4.35-5.20, and VPN 4.35-5.20, which stems from the presence of an input validation error, and can be...
GHSA-V646-RX6W-R3QQ Improper Access Control in Apache Tomcat
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an...
CVE-2022-30525
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100W firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1,...
PT-2022-2515
Name of the Vulnerable Software and Affected Versions Zyxel USG FLEX 100W versions 5.00 through 5.21 Patch 1 Zyxel USG FLEX 200 versions 5.00 through 5.21 Patch 1 Zyxel USG FLEX 500 versions 5.00 through 5.21 Patch 1 Zyxel USG FLEX 700 versions 5.00 through 5.21 Patch 1 Zyxel USG FLEX 50W version...
Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2022-1437)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2021-4029
A command injection vulnerability in the CGI program of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary OS commands via a LAN interface...
Cross site request forgery (csrf)
A denial of service vulnerability exists in the cgiserver.cgi session creation functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to prevent users from logging in. An attacker can send an HTTP request to trigger this vulnerability...
Reolink RLC-410W cgiserver.cgi cgi_check_ability improper access control vulnerabilities
Summary Multiple incorrect default permissions vulnerabilities exist in the cgiserver.cgi cgicheckability functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability. Teste...
D-Link DAP-2020 Web Cmd File List Code Execution
The vulnerability of the WEBCmdFileList function implementation in D-Link DAP-2020 wireless access points relates to the lack of measures taken to neutralize special elements used in operating system commands when processing CGI scripts. Exploiting this vulnerability can allow an attacker to...
Exploit for Path Traversal in Apache Http_Server
CVE-2021-41773 Playground === This is a small Docker recipe for...
SureLine aircraft monitoring cgi/networkDiag.cgi Arbitrary Command Execution
The vulnerability of the cgi/networkDiag.cgi implementation of the SureLine monitoring application exists because measures are not taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands...
CVE-2021-35030
A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize packet contents and could allow an authenticated, local user to perform a cross-site scripting XSS attack via a crafted LLDP packet...
Synology Media Server code-related vulnerabilities
Synology Media Server provides multimedia services for browsing and playing multimedia contents in Synology NAS via DLNA/UPnP home devices. A server-side request forgery vulnerability exists in the cgi component of Synology Media Server versions prior to 1.8.3-2881. A remote attacker can exploit...
ZeroShell kerbynet remote command execution
Added: 05/24/2021 Background Zeroshell is a Linux distribution designed for router and firewall appliances which can be administered from a web interface. Zeroshell is no longer supported. Problem A command injection vulnerability allows unauthenticated attackers to execute arbitrary commands by...
CVE-2021-27253
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handli...
