DnaLIMS Directory Traversal

This module exploits a directory traversal vulnerability found in dnaLIMS. Due to the way the viewAppletFsa.cgi script handles the 'secID' parameter, it is possible to read a file outside the www directory. Module Options msf use auxiliary/scanner/http/dnalims/fileretrieve msf undefinedfileretrie...

Rockstar Games: Source Code Disclosure (CGI)

Hello guys. I would like to share with you my discovery. The fact is that at: https://www.rockstargames.com/gta/game/highscores.cgi Anyone can see the source code of the script F166966 check please Regards @d1v3r...

CVE-2017-5633

Multiple cross-site request forgery CSRF vulnerabilities on the D-Link DI-524 Wireless Router with firmware 9.01 allow remote attackers to 1 change the admin password, 2 reboot the device, or 3 possibly have unspecified other impact via crafted requests to CGI programs...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities on the D-Link DI-524 Wireless Router with firmware 9.01 allow remote attackers to 1 change the admin password, 2 reboot the device, or 3 possibly have unspecified other impact via crafted requests to CGI programs...

CVE-2017-5633

Multiple cross-site request forgery CSRF vulnerabilities on the D-Link DI-524 Wireless Router with firmware 9.01 allow remote attackers to 1 change the admin password, 2 reboot the device, or 3 possibly have unspecified other impact via crafted requests to CGI programs...

CVE-2017-5633

Multiple cross-site request forgery CSRF vulnerabilities on the D-Link DI-524 Wireless Router with firmware 9.01 allow remote attackers to 1 change the admin password, 2 reboot the device, or 3 possibly have unspecified other impact via crafted requests to CGI programs...

CVE-2017-5633

CVE-2017-5633 describes multiple CSRF vulnerabilities affecting the D-Link DI-524 Wireless Router running firmware 9.01. The issue enables remote attackers to perform actions via crafted requests to CGI programs, including changing the admin password and rebooting the device (and possibly other i...

CVE-2017-5633: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities on the D-Link DI-524 Wireless Router with firmware 9.01 allow remote attackers to 1 change the admin password, 2 reboot the device, or 3 possibly have unspecified other impact via crafted requests to CGI programs...

FreeBSD : ikiwiki -- multiple vulnerabilities (5ed094a0-0150-11e7-ae1b-002590263bf5)

Mitre reports : ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page...

Ubuntu 14.04 LTS : Munin regression (USN-3215-2)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3215-2 advisory. USN-3215-1 fixed a vulnerability in Munin. The upstream patch caused a regression leading to errors being appended to the log file. This update fixes the problem...

[SECURITY] [DSA 3794-3] munin regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3794-3 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 03, 2017 https://www.debian.org/security/faq -...

USN-3215-2 munin regression

USN-3215-1 fixed a vulnerability in Munin. The upstream patch caused a regression leading to errors being appended to the log file. This update fixes the problem. Original advisory details: It was discovered that Munin incorrectly handled CGI graphs. A remote attacker could use this issue to...

CVE-2017-5616

Cross-site scripting XSS vulnerability in cgiemail and cgiecho allows remote attackers to inject arbitrary web script or HTML via the addendum parameter...

Ubuntu: Security Advisory (USN-3215-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS : Munin vulnerability (USN-3215-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3215-1 advisory. It was discovered that Munin incorrectly handled CGI graphs. A remote attacker could use this issue to overwrite arbitrary files as the www-data user. Tenable has...

Cambium ePMP 1000 'ping' Password Hash Extractor (up to v2.5)

This module exploits an OS Command Injection vulnerability in Cambium ePMP 1000 Authors Karn Ganeshen This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Cambium ePMP 1000 'ping' Password Hash...

USN-3215-1 munin vulnerability

It was discovered that Munin incorrectly handled CGI graphs. A remote attacker could use this issue to overwrite arbitrary files as the www-data user...

USN-3215-1: Munin vulnerability

It was discovered that Munin incorrectly handled CGI graphs. A remote attacker could use this issue to overwrite arbitrary files as the www-data user...

[SECURITY] [DSA 3794-2] munin regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3794-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 02, 2017 https://www.debian.org/security/faq -...

Debian DSA-3794-1 : munin - security update

Stevie Trujillo discovered a local file write vulnerability in munin, a network-wide graphing framework, when CGI graphs are enabled. GET parameters are not properly handled, allowing to inject options into munin-cgi-graph and overwriting any file accessible by the user running the cgi-process...