CGI: ReDoS in CGI::Util#escapeElement

A flaw was found in Ruby's CGI gem. The CGI::UtilescapeElement method is vulnerable to Regular expression Denial of Service ReDoS, allowing a specially crafted input to cause a high CPU consumption...

Webmin Privilege Escalation

The vulnerability in the Webmin server’s web control panel relates to the failure to handle CRLF sequences properly. Exploiting this vulnerability allows a malicious actor to enhance their privileges by sending specially crafted CGI requests remotely...

D-Link DSL-3788 security vulnerability

The D-Link DSL-3788 is a modem from China-based AUO D-Link. The D-Link DSL-3788 suffers from a buffer overflow vulnerability that stems from the webproc cgi's COMMMAKECustomMsg function failing to correctly validate the length of the input data, which can be exploited by an attacker to cause a...

CVE-2024-41339

An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigo...

PT-2025-2663 · Iocharger · Iocharger

Name of the Vulnerable Software and Affected Versions: Iocharger firmware for AC models versions prior to 24120701 Description: The issue allows attackers to upload arbitrary files to /tmp/upload/ or /tmp/ as any user, although the file upload interface is only visible to the iocadmin user. The...

PT-2025-49183

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.65 Description An issue exists in Apache HTTP Server where improper neutralization of escape, meta, or control sequences can occur through environment variables set via the Apache configuration. Th...

php: cgi.force_redirect configuration is bypassable due to the environment variable collision

A flaw was found in PHP. The configuration directive cgi.forceredirect prevents anyone from calling PHP directly with a URL such as http://host.example/cgi-bin/php/secretdir/script.php. However, in certain uncommon configurations, an attacker may be able to bypass this restriction and access...

php: cgi.force_redirect configuration is bypassable due to the environment variable collision

A flaw was found in PHP. The configuration directive cgi.forceredirect prevents anyone from calling PHP directly with a URL such as http://host.example/cgi-bin/php/secretdir/script.php. However, in certain uncommon configurations, an attacker may be able to bypass this restriction and access...

KASDA KW5515 security vulnerability

KASDA KW5515 is a wireless router from KASDA. A security vulnerability exists in KASDA KW5515 v1.7 and earlier versions. A remote attacker can exploit this vulnerability to execute arbitrary operating system commands via cgi parameters...

CVE-2024-8882

A buffer overflow vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80AAHN.1C0 and earlier could allow an authenticated, LAN-based attacker with administrator privileges to cause denial of service DoS conditions via a crafted URL...

CVE-2024-8881

A post-authentication command injection vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80AAHN.1C0 and earlier could allow an authenticated, LAN-based attacker with administrator privileges to execute some operating system OS commands on an affected device by...

CLSA-2024-1730134476 php: Fix of 2 CVEs

CVE-2024-8927: Fix bypass of cgi.forceredirect configuration - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data boundaries larger than the read buffer...

D-Link CGI Get Cooliris Arbitrary Command Execution

The vulnerability of the cgigetcooliris function /cgi-bin/photocentermgr.cgi in the microprogramming software of D-Link devices such as DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4...

D-Link’s various products have security vulnerabilities

D-Link DI-7003G and others are a wireless router from China AUO D-Link. A security vulnerability exists in various D-Link products, which stems from insufficient parameter filtering in the CGI handler function of upgradefilter.asp. The following products and versions are affected: D-Link DI-7003G...

CAYIN CMS security vulnerability

Cayin CAYIN CMS is a content management system CMS from China Cayin Cayin. A security vulnerability exists in CAYIN CMS, which stems from a lack of proper access control and allows an unauthenticated, remote attacker to download arbitrary CGI files...

ruby/cgi-gem: HTTP response splitting in CGI

A vulnerability was found in Ruby that allows HTTP header injection. A CGI application using the CGI library may insert untrusted input into the HTTP response header. This issue can allow an attacker to insert a newline character to split a header and inject malicious content to deceive clients...

PHP OS Command Injection Vulnerability

PHP is a scripting language that executes on the server side. PHP suffers from an operating system command injection vulnerability that arises when, under certain conditions, the Windows system replaces characters on the command line with the "Best-Fit" behavior, which may cause the PHP CGI modul...

ruby/cgi-gem: HTTP response splitting in CGI

A vulnerability was found in Ruby that allows HTTP header injection. A CGI application using the CGI library may insert untrusted input into the HTTP response header. This issue can allow an attacker to insert a newline character to split a header and inject malicious content to deceive clients...

CVE-2024-5400

Openfind Mail2000 does not properly filter parameters of specific CGI. Remote attackers with regular privileges can exploit this vulnerability to execute arbitrary system commands on the remote server...

PT-2024-36006

Name of the Vulnerable Software and Affected Versions: Openfind Mail2000 affected versions not specified Description: The issue is related to improper filtering of parameters in specific CGI, allowing remote attackers with regular privileges to execute arbitrary system commands on the remote...