12763 matches found
CVE-2018-13283
Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226 allows remote attackers to conduct man-in-the-middle attacks via the 1 command, 2 hostname, or 3 port parameter...
CVE-2018-17563: Missing Encryption of Sensitive Data
A Malformed Input String to /cgi-bin/api-getlinestatus on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's configuration in cleartext...
PT-2019-9505
Name of the Vulnerable Software and Affected Versions Grandstream GXP16xx VoIP version 1.0.4.128 Description The issue arises from a malformed input string sent to the "/cgi-bin/delete CA" API endpoint, allowing attackers to delete configuration parameters and gain admin access to the device...
PT-2019-9504
Name of the Vulnerable Software and Affected Versions Grandstream GXP16xx VoIP version 1.0.4.128 Description The issue allows attackers to dump the device's configuration in cleartext by sending a malformed input string to the "cgi-bin/api-get line status" API endpoint. Recommendations For...
PT-2019-9539
Name of the Vulnerable Software and Affected Versions D-Link DSL-3782 version 1.01 Description A stored XSS issue exists in the web interface, allowing authenticated attackers to inject JavaScript or HTML payload inside the ACL page. The injected payload is executed in a user's browser when the...
CVE-2018-17989: Improper Neutralization of Input During Web Page Generation
A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to inject a JavaScript or HTML payload inside the ACL page. The injected payload would be executed in a user's browser when "/cgi-bin/NewGUI/Acl.asp" is request...
CVE-2019-10663
Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to conduct SQL injection attacks via the sord parameter in a listCodeblueGroup API call to the /cgi? URI...
CVE-2019-10662
Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter to the /cgi? URI...
Code injection
Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter to the /cgi? URI...
CVE-2019-10662: Improper Neutralization of Special Elements used in an OS Command
Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter to the /cgi? URI...
[SECURITY] Fedora 30 Update: php-7.3.3-1.fc30
PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...
CVE-2018-19879
An issue was discovered in /cgi-bin/luci on Teltonika RTU9XX e.g., RUT950 R31.04.89 before R00.05.00.5 devices. The authentication functionality is not protected from automated tools used to make login attempts to the application. An anonymous attacker has the ability to make unlimited login...
CVE-2018-19879: Improper Restriction of Excessive Authentication Attempts
An issue was discovered in /cgi-bin/luci on Teltonika RTU9XX e.g., RUT950 R31.04.89 before R00.05.00.5 devices. The authentication functionality is not protected from automated tools used to make login attempts to the application. An anonymous attacker has the ability to make unlimited login...
PT-2019-9941
Name of the Vulnerable Software and Affected Versions Teltonika RTU9XX e.g., RUT950 versions R 31.04.89 through R 00.05.00.4 Description The issue concerns the authentication functionality in the /cgi-bin/luci endpoint, which is not protected against automated login attempts. This allows an...
Cisco RV320 Unauthenticated Configuration Export Vulnerability
The configuration of a Cisco RV320 router can still be exported without authentication via the device's web interface due to an inadequate fix by the vendor. Cisco RV320 Unauthenticated Configuration Export Vulnerability Details ======= Product: Cisco RV320 Dual Gigabit WAN VPN Router, possibly...
CVE-2019-7439
cgi-bin/qcmapwebcgi on JioFi 4G M2S 1.0.2 devices allows a DoS Hang via the mask POST parameter...
CVE-2019-7440
JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings aka a SetWiFiSetting request to cgi-bin/qcmapwebcgi...
CVE-2019-7438
cgi-bin/qcmapwebcgi on JioFi 4G M2S 1.0.2 devices has XSS and HTML injection via the mask POST parameter...