cgi script center vulnerabilities and exploits

(subscribe to this query)

10

CVSSv2

An unspecified CGI script in Cisco FX-OS prior to 1.1.2 on Firepower 9000 devices and Cisco Unified Computing System (UCS) Manager prior to 2.2(4b), 2.2(5) prior to 2.2(5a), and 3.0 prior to 3.0(2e) allows remote malicious users to execute arbitrary shell commands via a crafted H...

Cisco Firepower Extensible Operating System 1.1.1 Cisco Firepower Extensible Operating System 1.1\\(1.160\\)Cisco Firepower Extensible Operating System 1.1\\(1.86\\)Cisco Unified Computing System 3.0\\(1e\\)Cisco Unified Computing System 3.0\\(1d\\)Cisco Unified Computing System 2.2\\(3e\\)Cisco Unified Computing System 2.2\\(3d\\)Cisco Unified Computing System 2.2\\(1f\\)Cisco Unified Computing System 2.2\\(1e\\)Cisco Unified Computing System 2.1\\(1f\\)Cisco Unified Computing System 2.1\\(1e\\)Cisco Unified Computing System 1.3\\(1q\\)Cisco Unified Computing System 1.3\\(1p\\)Cisco Unified Computing System 1.4\\(4i\\)Cisco Unified Computing System 1.4\\(4g\\)Cisco Unified Computing System 1.4\\(4f\\)Cisco Unified Computing System 2.0\\(4d\\)Cisco Unified Computing System 2.0\\(4b\\)Cisco Unified Computing System 2.0\\(2m\\)Cisco Unified Computing System 2.0\\(1x\\)Cisco Unified Computing System 1.2 Base Cisco Unified Computing System 1.1 Base

10

CVSSv2

Auction Weaver CGI script 1.03 and previous versions allows remote malicious users to read arbitrary files via a .. (dot dot) attack in the catdir parameter.

Cgi Script Center Auction Weaver

10

CVSSv2

Auction Weaver CGI script 1.02 and previous versions allows remote malicious users to execute arbitrary commands via shell metacharacters in the fromfile parameter.

Cgi Script Center Auction Weaver 1.02 Cgi Script Center Auction Weaver 1.0

1 EDB exploit

7.5

CVSSv2

Auction Weaver 1.0 up to and including 1.04 does not properly validate the names of form fields, which allows remote malicious users to delete arbitrary files and directories via a .. (dot dot) attack.

Cgi Script Center Auction Weaver 1.03 Cgi Script Center Auction Weaver 1.04 Cgi Script Center Auction Weaver 1.0 Cgi Script Center Auction Weaver 1.01 Cgi Script Center Auction Weaver 1.02

7.5

CVSSv2

CGI Script Center News Update 1.1 does not properly validate the original news administration password during a password change operation, which allows remote malicious users to modify the password without knowing the original password.

Cgi Script Center News Update 1.1

1 EDB exploit

7.5

CVSSv2

Subscribe Me LITE does not properly authenticate attempts to change the administrator password, which allows remote malicious users to gain privileges for the Account Manager by directly calling the subscribe.pl script with the setpwd parameter.

Cgi Script Center Subscribe Me Lite 2.0

2 EDB exploits

7.5

CVSSv2

Account Manager LITE does not properly authenticate attempts to change the administrator password, which allows remote malicious users to gain privileges for the Account Manager by directly calling the amadmin.pl script with the setpasswd parameter.

Cgi Script Center Account Manager Lite 1.0 Cgi Script Center Account Manager Pro 1.0

2 EDB exploits

5.1

CVSSv2

PHP up to and including 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote malicious users to redirec...

Oracle Enterprise Manager Ops Center 12.2.2 Oracle Enterprise Manager Ops Center 12.3.2 Oracle Communications User Data Repository 10.0.1 Oracle Linux 6 Oracle Linux 7 Oracle Communications User Data Repository 12.0.0 Oracle Communications User Data Repository 10.0.0 Fedoraproject Fedora 24 Fedoraproject Fedora 23 Hp Storeever Msl6480 Tape Library Firmware Hp System Management Homepage Php Php Redhat Enterprise Linux Desktop 6.0 Redhat Enterprise Linux Server 6.0 Redhat Enterprise Linux Workstation 6.0 Debian Debian Linux 8.0 Opensuse Leap 42.1 Drupal Drupal

1 Github repository1 Article

5

CVSSv2

CGI Script Center Subscribe Me LITE 2.0 and previous versions allows remote malicious users to delete arbitrary mailing list users without authentication by directly calling subscribe.pl with the target address as a parameter.

Cgi Script Center Subscribe Me Lite 1.0 Cgi Script Center Subscribe Me Lite 2.0

5

CVSSv2

Auction Weaver 1.0 up to and including 1.04 allows remote malicious users to read arbitrary files via a .. (dot dot) attack on the username or bidfile form fields.

Cgi Script Center Auction Weaver 1.03 Cgi Script Center Auction Weaver 1.04 Cgi Script Center Auction Weaver 1.0 Cgi Script Center Auction Weaver 1.01 Cgi Script Center Auction Weaver 1.02

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook