PT-2019-7598

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 58.0.4 Description The issue allows code execution in the context of other user accounts through the PHP CGI handler. Recommendations For versions prior to 58.0.4, update to version 58.0.4 or later to resolve the issue...

Buffer overflow

An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. In a CGI program running under the HTTPD web server, a buffer overflow in the param parameter leads to remote code execution in the context of the nobody account...

CVE-2019-14698

MicroDigital N-series cameras (firmware up to 6400.0.8.5) expose a vulnerability in a CGI program running under the HTTPD web server. A buffer overflow in the param parameter allows remote code execution in the nobody context. This is a server-side flaw in the CGI component and is stated as enabl...

CVE-2016-10795

cPanel before 59.9999.145 allows stored XSS in the WHM tailupcp2.cgi interface SEC-156...

CVE-2016-10795

cPanel before 59.9999.145 allows stored XSS in the WHM tailupcp2.cgi interface SEC-156...

CVE-2016-10795

cPanel before 59.9999.145 allows stored XSS in the WHM tailupcp2.cgi interface SEC-156...

CVE-2016-10795

The CVE-2016-10795 entry affects cPanel/WHM, where a stored XSS vulnerability exists in the WHM tail_upcp2.cgi interface. Affected versions are prior to 59.9999.145. The issue stems from insufficient validation of client-side data in the web application, enabling an attacker to execute client-sid...

CVE-2016-10795: Improper Neutralization of Input During Web Page Generation

cPanel before 59.9999.145 allows stored XSS in the WHM tailupcp2.cgi interface SEC-156...

PT-2019-7591

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 59.9999.145 Description The issue allows for stored XSS in the WHM tail upcp2.cgi interface. Recommendations For versions prior to 59.9999.145, update to version 59.9999.145 or later to resolve the issue...

CVE-2016-10769

cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi SEC-162...

PT-2019-7565

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 60.0.25 Description The issue allows an open redirect via the /cgi-sys/FormMail-clone.cgi API endpoint. Recommendations For versions prior to 60.0.25, update to version 60.0.25 or later to resolve the issue. As a...

CVE-2018-20913: Exposure of Sensitive Information to an Unauthorized Actor

cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi SEC-364...

PT-2019-10345

Name of the Vulnerable Software and Affected Versions: cPanel versions prior to 70.0.23 Description: The issue allows attackers to read the root accesshash. This can be achieved via the WHM /cgi/trustclustermaster.cgi endpoint. Recommendations: For versions prior to 70.0.23, update to version...

Xymon useradm Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Xymon useradm Command Execution', 'Description' = %q This module exploits a command injection vulnerability in Xymon versions before 4.3.25 which...

Xymon 4.3.25 - useradm Command Execution Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Xymon useradm Command Execution', 'Description' = %q This module exploits a command injection vulnerability in Xymon versions before 4.3.25 which...

Dynacolor FCM-MB40 Cross-Site Request Forgery Vulnerability

Dynacolor FCM-MB40 is an IP camera from Dynacolor, Taiwan, China. A cross-site request forgery vulnerability exists in scripts under cgi-bin/ in the Dynacolor FCM-MB40 v1.2.0.0, which arises from a network system or product that does not adequately verify the origin or authenticity of data, and c...

CVE-2019-13401

Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...

CVE-2019-13401

Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/...

CVE-2019-13398

Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrlsaveprofile.cgi save parameter and cgi-bin/ddns.cgi...

CVE-2019-13398

Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrlsaveprofile.cgi save parameter and cgi-bin/ddns.cgi...