CVE-2017-17933: Improper Neutralization of Input During Web Page Generation

cgi/surgeftpmgr.cgi aka the Web Manager interface on TCP port 7021 or 9021 in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter...

PT-2017-15109

Name of the Vulnerable Software and Affected Versions SurgeFTP version 23f2 Description The issue concerns the Web Manager interface, specifically the cgi/surgeftpmgr.cgi, which is accessible on TCP port 7021 or 9021. It is susceptible to XSS attacks through the classid, domainid, or username...

CVE-2017-17888

cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 -- AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary ...

CVE-2017-17888: Improper Neutralization of Special Elements used in an OS Command

cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 -- AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary ...

CVE-2017-17888

cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 -- AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary ...

PT-2017-15075

Name of the Vulnerable Software and Affected Versions Anti-Web through version 3.8.7 Description The issue allows remote authenticated users to execute arbitrary OS commands via crafted multipart/form-data content. This affects devices from various manufacturers, including NetBiter / HMS, Ouman...

GoAhead Server CGI Remote Code Execution

Binary data goaheadcgirce.nbin...

Open redirect

TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/wportal command to cgi-bin/luci, related to the getdevicebyif function in /usr/lib/lua/luci/controller/admin/wportal.lua in uhttpd...

CVE-2017-17757

TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/wportal command to cgi-bin/luci, related to the getdevicebyif function in /usr/lib/lua/luci/controller/admin/wportal.lua in uhttpd...

CVE-2017-17757

CVE-2017-17757 affects TP-Link TL-WVR and TL-WAR devices. The vulnerability exists in the uhttpd web interface (admin/wportal) via shell metacharacters in the interface field passed to cgi-bin/luci, related to get_device_byif in /usr/lib/lua/luci/controller/admin/wportal.lua, allowing remote auth...

CVE-2017-17758

CVE-2017-17758 affects TP-Link TL-WVR and TL-WAR devices. A remote authenticated user can execute arbitrary commands via shell metacharacters in the interface field of an admin/dhcps command to cgi-bin/luci, tied to zone_get_iface_bydev in /usr/lib/lua/luci/controller/admin/dhcps.lua in uhttpd. C...

CVE-2017-17106

Credentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated remote attacker using a standard web /cgi-bin/hi3510/param.cgi?cmd=getuser HTTP request. This vulnerability exists because of a lack of authentication checks in requests to CGI pages...

CVE-2017-17105

Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 and possibly in-between versions web cameras are vulnerable to unauthenticated, blind remote command injection via CGI scripts used as part of the web interface, as demonstrated by a...

Design/Logic Flaw

Credentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated remote attacker using a standard web /cgi-bin/hi3510/param.cgi?cmd=getuser HTTP request. This vulnerability exists because of a lack of authentication checks in requests to CGI pages...

Command injection

Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 and possibly in-between versions web cameras are vulnerable to unauthenticated, blind remote command injection via CGI scripts used as part of the web interface, as demonstrated by a...

CVE-2017-17758: Improper Neutralization of Special Elements used in an OS Command

TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/dhcps command to cgi-bin/luci, related to the zonegetifacebydev function in /usr/lib/lua/luci/controller/admin/dhcps.lua in uhttpd...

CVE-2017-17105: Improper Neutralization of Special Elements used in an OS Command

Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 and possibly in-between versions web cameras are vulnerable to unauthenticated, blind remote command injection via CGI scripts used as part of the web interface, as demonstrated by a...

PT-2017-14988

Name of the Vulnerable Software and Affected Versions TP-Link TL-WVR and TL-WAR devices affected versions not specified Description The issue allows remote authenticated users to execute arbitrary commands by injecting shell metacharacters in the interface field of an admin/wportal command to the...

PT-2017-14559

Name of the Vulnerable Software and Affected Versions Meinberg LANTIME devices with firmware prior to 6.24.004 Description The issue allows remote authenticated users with certain privileges to read arbitrary files. This can be achieved via the ntpclientcounterlogfile parameter to "cgi-bin/mainv2...

PT-2017-14989

Name of the Vulnerable Software and Affected Versions TP-Link TL-WVR and TL-WAR devices affected versions not specified Description The issue allows remote authenticated users to execute arbitrary commands by injecting shell metacharacters in the interface field of an admin/dhcps command to the...