CVE-2018-4063

An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticat...

CVE-2018-4063

An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticat...

CVE-2018-4063

CVE-2018-4063 affects Sierra Wireless AirLink ES450 FW 4.9.3. The vulnerability is in the ACEManager/upload.cgi functionality and allows an authenticated user to upload a file that results in executable code being uploaded to the webserver, enabling remote code execution. This is a unrestricted f...

PT-2019-10790

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink ES450 version 4.9.3 Sierra Wireless AirLink ALEOS affected versions not specified Description A remote code execution issue exists in the upload.cgi functionality of Sierra Wireless AirLink devices. A crafted HTTP reque...

CVE-2018-4063: Unrestricted Upload of File with Dangerous Type

An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticat...

Sierra Wireless AirLink ES450 Unauthorized Password Change Vulnerability

The Sierra Wireless AirLink ES450 is a cellular network modem device from Sierra Wireless Canada. An unauthorized password change vulnerability exists in the ACEManager upload.cgi function in the Sierra Wireless AirLink ES450 using firmware version 4.9.3, which can be exploited by an attacker to...

PT-2019-11872

Name of the Vulnerable Software and Affected Versions Glory RBW-100 devices with firmware ISP-K05-02 version 7.0.0 Description An issue was discovered that allows attackers to upload supplied data due to an unrestricted file upload vulnerability in the Front Circle Controller glytoolcgi/settingfi...

CVE-2019-9624

Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted .cgi file via the /updown/upload.cgi URI...

PT-2019-4220

Name of the Vulnerable Software and Affected Versions Webmin version 1.900 Description The issue is related to insufficient access control in the Webmin control panel, allowing remote attackers to execute arbitrary code. This can be achieved by uploading a crafted .cgi file via the...

CVE-2019-9624: Improper Privilege Management

Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted .cgi file via the /updown/upload.cgi URI...

ASUSTOR ADM path traversal vulnerability (CNVD-2018-25039)

ASUSTOR ADM is an operating system from ASUSTOR dedicated to ASUSTOR NAS storage devices. A directory traversal vulnerability exists in the upload.cgi file in ASUSTOR ADM version 3.1.1. An attacker can exploit this vulnerability by modifying the 'path' URL parameter to upload a file to an arbitra...

ASUSTOR ADM OS Command Injection Vulnerability (CNVD-2018-25181)

ASUSTOR ADM is an operating system from ASUSTOR dedicated to ASUSTOR NAS storage devices. An operating system command injection vulnerability exists in the upload.cgi file in ASUSTOR ADM version 3.1.1. An attacker can exploit this vulnerability by modifying the 'filename' POST parameter to execut...

CVE-2018-12309

Directory Traversal in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to upload files to arbitrary locations by modifying the "path" URL parameter. NOTE: the "filename" POST parameter is covered by CVE-2018-11345...

Command injection

OS Command Injection in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands by modifying the filename POST parameter...

Directory traversal

Directory Traversal in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to upload files to arbitrary locations by modifying the "path" URL parameter. NOTE: the "filename" POST parameter is covered by CVE-2018-11345...

CVE-2018-12316

OS Command Injection in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands by modifying the filename POST parameter...

CVE-2018-12309

CVE-2018-12309 describes a directory traversal in ASUSTOR ADM 3.1.1, via upload.cgi, allowing an attacker to upload files to arbitrary locations by modifying the path URL parameter (the filename parameter is covered by CVE-2018-11345). NVD lists CVSS v3.0 base score 7.5 (HIGH) with network attack...

CVE-2018-12316

ASUSTOR ADM is affected by OS Command Injection in upload.cgi in version 3.1.1, where an attacker can modify the filename POST parameter to execute system commands. This is documented across multiple sources (NVD CVE-2018-12316, CNVD-2018-25181, OpenVAS entry) with a CVSS base score high (3.0: 8....

PT-2018-11115

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description The issue allows attackers to execute system commands by modifying the filename parameter in the upload.cgi file. Recommendations For ASUSTOR ADM version 3.1.1, consider restricting access to the upload.cg...

PT-2018-11107

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description The issue allows attackers to upload files to arbitrary locations by modifying the path URL parameter in the upload.cgi. This can potentially lead to unauthorized access and modification of sensitive files...