PT-2026-93212

Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in filter arp put file.cgi caused by improper use of a string handling API. Attackers can trigger an unterminated buffer over-read by exploiting this flaw in the affected component, potentially exposing adjacent memor...

Vivotek IB8367A 命令注入漏洞

Vivotek IB8367A is a network camera from China VIVOTEK Communications Vivotek. The Vivotek IB8367A VVTK-0100b suffers from a command injection vulnerability that stems from the parameter QUERYSTRING in the file uploadfile.cgi that can lead to command injection...

PT-2024-38352 · Vivotek · Vivotek Sd9364

Name of the Vulnerable Software and Affected Versions: Vivotek SD9364 VVTK-0103f affected versions not specified Description: A critical issue affects the function getenv of the file upload file.cgi. The manipulation of the argument QUERY STRING leads to command injection. The attack may be...

PT-2024-38350 · Vivotek · Vivotek Cc8160

Name of the Vulnerable Software and Affected Versions: Vivotek CC8160 VVTK-0100d affected versions not specified Description: A critical vulnerability affects the function getenv of the file upload file.cgi. The manipulation of the argument QUERY STRING leads to command injection. It is possible ...

PT-2024-38353 · Vivotek · Vivotek Ib8367A

Name of the Vulnerable Software and Affected Versions: Vivotek IB8367A VVTK-0100b affected versions not specified Description: A critical vulnerability has been found in the function getenv of the file upload file.cgi. The manipulation of the argument QUERY STRING leads to command injection. It i...

PT-2024-21419 · Vivotek · Vivotek Network Cameras

Name of the Vulnerable Software and Affected Versions: vivotek Network Camera version v.FD8166A-VVTK-0204j Description: An issue in the vivotek Network Camera allows a remote attacker to execute arbitrary code via a crafted payload to the "upload file.cgi" component. Recommendations: For version...

VulnCheck KEV: CVE-2021-43711

The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646B20201211 has a command injection vulnerability when receiving GET parameters. The parameter name can be constructed for unauthenticated command execution...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 allow remote attackers to inject arbitrary web script or HTML via the nextfile parameter to 1 main.cgi, 2 img/main.cgi, or 3 adm/file.cgi; or 4 the thisfile...

CVE-2009-1558: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in adm/file.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 allows remote attackers to read arbitrary files via a %2e. encoded dot dot or an absolute pathname in the nextfile parameter...

CVE-2009-1559: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in adm/file.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R24 and possibly 1.00R22 allows remote attackers to read arbitrary files via an absolute pathname in the thisfile parameter. NOTE: traversal via a .. dot dot is probably als...

SecurityReporter < 4.6.3p1 Multiple Vulnerabilities

The 'file.cgi' script included with the version of SecurityReporter installed on the remote host fails to sanitize input to the 'name' parameter before returning the contents of the specified file and supports bypassing authentication using specially crafted arguments. An unauthenticated, remote...

Authentication flaw

file.cgi in Secure Computing SecurityReporter aka Network Security Analyzer before 4.6.3 allows remote attackers to bypass authentication via a name parameter ending with a "%00.gif" sequence. NOTE: a separate traversal vulnerability could be leveraged to download arbitrary files...

CVE-2007-4043

file.cgi in Secure Computing SecurityReporter aka Network Security Analyzer before 4.6.3 allows remote attackers to bypass authentication via a name parameter ending with a "%00.gif" sequence. NOTE: a separate traversal vulnerability could be leveraged to download arbitrary files...

CVE-2007-4043

The file.cgi component in Secure Computing SecurityReporter (also known as Network Security Analyzer) versions prior to 4.6.3 contains an authentication bypass vulnerability. Remote attackers can exploit this by providing a name parameter ending with a %00.gif sequence. Additionally, a separate d...

CVE-2007-4043: Improper Authentication

file.cgi in Secure Computing SecurityReporter aka Network Security Analyzer before 4.6.3 allows remote attackers to bypass authentication via a name parameter ending with a "%00.gif" sequence. NOTE: a separate traversal vulnerability could be leveraged to download arbitrary files...

Authentication flaw

file.cgi in Secure Computing SecurityReporter aka Network Security Analyzer 4.6.3 allows remote attackers to bypass authentication via a name parameter that specifies the eventcache directory and a non-GIF file, which causes the $dontvalidate variable to be set to true. NOTE: a separate traversal...

CVE-2007-3986

file.cgi in Secure Computing SecurityReporter aka Network Security Analyzer 4.6.3 allows remote attackers to bypass authentication via a name parameter that specifies the eventcache directory and a non-GIF file, which causes the $dontvalidate variable to be set to true. NOTE: a separate traversal...

CVE-2007-3986

CVE-2007-3986 affects Secure Computing SecurityReporter (aka Network Security Analyzer) 4.6.3. The issue is in the file.cgi component where the name parameter can specify an eventcache directory and a non-GIF file, bypassing authentication by setting the $dontvalidate variable. A separate travers...

CVE-2007-3986

file.cgi in Secure Computing SecurityReporter aka Network Security Analyzer 4.6.3 allows remote attackers to bypass authentication via a name parameter that specifies the eventcache directory and a non-GIF file, which causes the $dontvalidate variable to be set to true. NOTE: a separate traversal...

CVE-2007-3985: Undefined Security Weakness

Directory traversal vulnerability in file.cgi in Secure Computing SecurityReporter aka Network Security Analyzer 4.6.3 allows remote attackers to download arbitrary files via a .. dot dot in the name parameter...