IPFire proxy.cgi RCE

IPFire, a free linux based open source firewall distribution, version use exploit/linux/http/ipfire/oinkcodeexec msf undefinedoinkcodeexec show actions ...actions... msf undefinedoinkcodeexec set ACTION msf undefinedoinkcodeexec show options ...show and set options... msf undefinedoinkcodeexec ru...

PT-2017-3348

Name of the Vulnerable Software and Affected Versions Embedthis GoAhead versions prior to 3.6.5 Description The issue is related to the initialization of the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function. This can be abused for remote code...

Catalog Traversal Vulnerability in Multiple Peplink Balance Products

Peplink Balance 305 and others are multi-exit load balancing routers for medium-sized businesses. A directory traversal vulnerability exists in several Peplink Balance products using firmware versions prior to fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. An attacker can exploit this...

CVE-2017-8920

CVE-2017-8920 affects CGI:IRC’s irc.cgi prior to version 0.5.12, where input from the R parameter is not properly output encoded, enabling a cross-site scripting (XSS) vector. Public sources (NVD/CNVD/OSV) describe this XSS vulnerability and reference CGI:IRC before 0.5.12. Affected component: ir...

Home Web Server 1.9.1 build 164 - Remote Code Execution Vulnerability

Exploit for windows platform in category remote exploits Exploit Title: Home Web Server 1.9.1 build 164 - CGI Remote Code Execution Date: 26/05/2017 Exploit Author: Guillaume Kaddouch Twitter: @gkweb76 Blog: https://networkfilter.blogspot.com GitHub: https://github.com/gkweb76/exploits Vendor...

CVE-2017-8838

XSS via syncid exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. The affected script is cgi-bin/HASync/hasync.cgi...

CVE-2017-8839

XSS via origurl exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. The affected script is guest/preview.cgi...

CVE-2017-8836

CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. The CGI scripts in the administrative interface are affected. This allows an attacker to execute commands, if a logged in user visits a malicious...

CVE-2017-8838

CVE-2017-8838 affects Peplink Balance routers (models 305, 380, 580, 710, 1350, 2500) with firmware prior to fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The issue is a cross-site scripting (XSS) vulnerability in the web interface, triggered via the syncid parameter in the CGI sc...

CVE-2017-8836

CVE-2017-8836 is a CSRF flaw in Peplink Balance routers (models 305, 380, 580, 710, 1350, 2500) on firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The vulnerability arises because the administrative CGI scripts are not CSRF-protected, enabling an attacker to execute ...

CVE-2017-8838

XSS via syncid exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. The affected script is cgi-bin/HASync/hasync.cgi...

CVE-2017-8836

CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. The CGI scripts in the administrative interface are affected. This allows an attacker to execute commands, if a logged in user visits a malicious...

Home Web Server 1.9.1 Build 164 Remote Code Execution

Exploit Title: Home Web Server 1.9.1 build 164 - CGI Remote Code Execution Date: 26/05/2017 Exploit Author: Guillaume Kaddouch Twitter: @gkweb76 Blog: https://networkfilter.blogspot.com GitHub: https://github.com/gkweb76/exploits Vendor Homepage: http://downstairs.dnsalias.net/ does not exist...

Updated perl-CGI-Emulate-PSGI packages fix security vulnerability

This update removes the setting of the HTTPPROXY environment value. This works around the httproxy vulnerability aka CVE-2016-5387...

MGASA-2017-0146 Updated perl-CGI-Emulate-PSGI packages fix security vulnerability

This update removes the setting of the HTTPPROXY environment value. This works around the httproxy vulnerability aka CVE-2016-5387...

CVE-2017-9032

Multiple cross-site scripting XSS vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inject arbitrary web script or HTML via the 1 T1 or 2 tmLastConfigFileModifiedDate parameter to logmanagement.cgi...

Home Web Server 1.9.1 (build 164) - Remote Code Execution

Home Web Server 1.9.1 build 164 - Remote Code Execution Exploit Title: Home Web Server 1.9.1 build 164 - CGI Remote Code Execution Date: 26/05/2017 Exploit Author: Guillaume Kaddouch Twitter: @gkweb76 Blog: https://networkfilter.blogspot.com GitHub: https://github.com/gkweb76/exploits Vendor...

Trend Micro ServerProtect for Linux Cross-Site Scripting Vulnerability

Trend Micro ServerProtect for Linux is a Trend Micro Trend Micro company for Linux in the virus before reaching the end-user to be blocked to prevent the expansion of the entire network of antivirus software. A cross-site scripting vulnerability exists in Trend Micro ServerProtect for Linux versi...

Dup Scout Enterprise 9.5.14 Buffer Overflow

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Dup Scout Enterprise GET Buffer Overflow', 'Description' = %q This module exploits a stack-based buffer overflow vulnerability ...

BSA-2017-313

Security Advisory ID : BSA-2017-313 Component : modcgid module in the Apache HTTP Server before 2.4.10 Revision : 2.0: Interim A flaw was found inmodcgid. If a server usingmodcgidhosted CGI scripts which did not consume standard input, a remote attacker could cause child processes to hang...