CVE-2021-45418: Improper Limitation of a Pathname to a Restricted Directory

Certain Starcharge products are vulnerable to Directory Traversal via main.cgi. The affected products include: Nova 360 Cabinet =1.3.0.0.6 - Fixed: 1.3.0.0.9 and Titan 180 Premium =1.3.0.0.7b102 - Fixed: Beta1.3.0.1.0...

CVE-2014-9184

CVE-2014-9184 affects ZTE ZXDSL 831CII. The vulnerability allows remote attackers to bypass authentication by directly requesting CGI files (main.cgi, adminpasswd.cgi, userpasswd.cgi, upload.cgi, conprocess.cgi, connect.cgi). Evidence across sources confirms this authentication bypass issue with ...

CVE-2014-9184: Improper Authentication

ZTE ZXDSL 831CII allows remote attackers to bypass authentication via a direct request to 1 main.cgi, 2 adminpasswd.cgi, 3 userpasswd.cgi, 4 upload.cgi, 5 conprocess.cgi, or 6 connect.cgi...

Technote 2000/2001 'filename' Parameter Command Execution And File Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2156/info Technote Inc. offers a multi-communication Package that includes a web board type of service. A script that ships with Technote, 'main.cgi', accepts a parameter called 'filename'. This remotely supplied variable...

Linksys Web Camera Software 2.10 Next_file Parameter Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10533/info It is reported that Linksys Web Camera software is prone to a cross-site scripting vulnerability that may allow a remote attacker to steal cookie-based authentication credentials or carry out other attacks. The...

Cisco Linksys WVC200 Wireless-G PTZ Internet Video Camera PlayerPT ActiveX Control PlayerPT.ocx sprintf Buffer Overflow Vulnerability

!-- Cisco Linksys WVC200 Wireless-G PTZ Internet Video Camera PlayerPT ActiveX Control PlayerPT.ocx sprintf Buffer Overflow Vulnerability when viewing the device web interface it asks to install an ActiveX control with the following settings: ProductName: PlayerPT ActiveX Control Module File...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 allow remote attackers to inject arbitrary web script or HTML via the nextfile parameter to 1 main.cgi, 2 img/main.cgi, or 3 adm/file.cgi; or 4 the thisfile...

CVE-2009-1556

img/main.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 allows remote authenticated users to read arbitrary files in img/ via a filename in the nextfile parameter, as demonstrated by reading .htpasswd to obtain the admin password, a different vulnerabili...

CVE-2009-1556: Exposure of Sensitive Information to an Unauthorized Actor

img/main.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 allows remote authenticated users to read arbitrary files in img/ via a filename in the nextfile parameter, as demonstrated by reading .htpasswd to obtain the admin password, a different vulnerabili...

CVE-2009-1557: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 allow remote attackers to inject arbitrary web script or HTML via the nextfile parameter to 1 main.cgi, 2 img/main.cgi, or 3 adm/file.cgi; or 4 the thisfile...

CVE-2006-3377

Cross-site scripting XSS vulnerability in JMB Software AutoRank PHP 3.02 and earlier, and AutoRank Pro 5.01 and earlier, allows remote attackers to inject arbitrary web script or HTML via the 1 Keyword parameter in search.php and the 2 Username parameter in main.cgi...

CVE-2006-3377: Undefined Security Weakness

Cross-site scripting XSS vulnerability in JMB Software AutoRank PHP 3.02 and earlier, and AutoRank Pro 5.01 and earlier, allows remote attackers to inject arbitrary web script or HTML via the 1 Keyword parameter in search.php and the 2 Username parameter in main.cgi...

CVE-2004-2507: Undefined Security Weakness

Absolute path traversal vulnerability in main.cgi in Linksys WVC11B Wireless-B Internet Video Camera allows remote attackers to read arbitrary files via an absolute pathname in the nextfile parameter...

CVE-2004-2508: Undefined Security Weakness

Cross-site scripting XSS vulnerability in main.cgi in Linksys WVC11B Wireless-B Internet Video Camera allows remote attackers to inject arbitrary web script or HTML via the nextfile parameter...

Linksys Web Camera File Inclusion Vuln

Linksys Web Camera version 2.10 only tested with 2.10 is vulnerable to a file inclusion vulnerability in main.cgi Example: http://www.host.com/main.cgi?nextfile=/etc/passwd...

CVE-2001-0075

CVE-2001-0075 involves the Technote package where the CGI script main.cgi is vulnerable to a directory traversal via the filename parameter (using “..”). This allows remote attackers to read arbitrary files on the host, with the privileges of the web server. The vulnerability is concrete in the T...

CVE-2001-0075: Undefined Security Weakness

Directory traversal vulnerability in main.cgi in Technote allows remote attackers to read arbitrary files via a .. dot dot attack in the filename parameter...