D-Link DSL-2640B B2 Authorization Issue Missing

The D-Link DSL-2640B B2 is a wireless router from AUO D-Link of Taiwan, China. A security vulnerability exists in the D-Link DSL-2640B B2 EU4.01B version. An attacker can exploit this vulnerability by accessing the cgi module to bypass authentication and perform administrative operations e.g.,...

P5 FNIP-8x16A/FNIP-4xSH CSRF Stored Cross-Site Scripting

Summary The FNIP-8x16A is an eight channel relay module used for switching any type of load that doesn’t exceed the specifications. Via its built-in web site and TCP/IP communication, the outputs and inputs can be controlled and monitored from standard network capable devices such as computers,...

IQrouter 3.3.1 Firmware - Remote Code Execution

Exploit Title: IQrouter 3.3.1 Firmware - Remote Code Execution Date: 2020-04-21 Exploit Author: drakylar Vendor Homepage: https://evenroute.com/ Software Link: https://evenroute.com/iqrouter Version: IQrouter firmware up to 3.3.1 Tested on: IQrouter firmware 3.3.1 CVE : N/A !/usr/bin/env python3...

CVE-2020-9277

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administrative tasks e.g., modify the admin password with no authentication...

CVE-2020-9276

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. The function docgi, which processes cgi requests supplied to the device's web servers, is vulnerable to a remotely exploitable stack-based buffer overflow. Unauthenticated exploitation is possible by combining this vulnerability with...

CVE-2020-9277

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administrative tasks e.g., modify the admin password with no authentication...

CVE-2020-9276

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. The function docgi, which processes cgi requests supplied to the device's web servers, is vulnerable to a remotely exploitable stack-based buffer overflow. Unauthenticated exploitation is possible by combining this vulnerability with...

Authentication flaw

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administrative tasks e.g., modify the admin password with no authentication...

CVE-2020-9277

The CVE-2020-9277 entry concerns D-Link DSL-2640B B2 EU_4.01B devices, where authentication can be bypassed when accessing CGI modules, enabling an attacker to perform administrative tasks (e.g., changing the admin password) with no authentication. The vulnerability stems from the CGI handling on...

CVE-2020-9277

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administrative tasks e.g., modify the admin password with no authentication...

Security Bulletin: A Security vulnerability in Apache Tomcat used by Rational Build Forge (CVE-2017-15706)

Summary There is a potential security vulnerability in the Apache Tomcat used by Rational Build Forge. Vulnerability Details CVEID: CVE-2017-15706 DESCRIPTION: Apache Tomcat could provide weaker than expected security, caused by the incorrect documentation of the CGI search algorithm used by the...

CVE-2020-9277: Improper Authentication

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administrative tasks e.g., modify the admin password with no authentication...

PT-2020-18660

Name of the Vulnerable Software and Affected Versions Grandstream GXP1600 series firmware versions 1.0.4.152 and below Description The issue allows for authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/upload vpntar interface...

CVE-2020-5738: Improper Link Resolution Before File Access

Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/uploadvpntar interface...

CVE-2020-11734

cgi-bin/go in CyberSolutions CyberMail 5 or later allows XSS via the ACTION parameter...

CVE-2020-11734

cgi-bin/go in CyberSolutions CyberMail 5 or later allows XSS via the ACTION parameter...

CVE-2020-11734

cgi-bin/go in CyberSolutions CyberMail 5 or later allows XSS via the ACTION parameter...

PT-2020-12814

Name of the Vulnerable Software and Affected Versions CyberSolutions CyberMail versions 5.0 and later Description The issue allows for cross-site scripting XSS via the ACTION parameter in the /cgi-bin/go endpoint. This could potentially lead to malicious script execution on the client-side...

CVE-2020-11734: Improper Neutralization of Input During Web Page Generation

cgi-bin/go in CyberSolutions CyberMail 5 or later allows XSS via the ACTION parameter...

Carriage Return Line Feed (CRLF)

perl is vulnerable to Carriage Return Line Feed CRLF. Perl CGI module processed a sequence of non-whitespace preceded by newline characters in the header. A remote attacker could use this flaw to conduct an HTTP response splitting attack via a specially-crafted sequence of characters provided to...