An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances in a highly privileged context.


An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters related to the mailboxes command associated with a manual subscription or unsubscription.


It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is done by setting debug=True in file /usr/bin/rbd-target-api provided by ceph-isci-cli package. This allows unauthenticated attackers to access this debug shell and escalate privileges. Once an attacker has successfully connected to this debug shell they will be able to execute arbitrary commands remotely. These commands will run with the same privileges as of user executing the application which is using python-werkzeug with debug shell mode enabled. In - Red Hat Ceph Storage 2 and 3 ceph-isci-cli package runs python-werkzeug library with root level permissions.


An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters related to the mailboxes command associated with an automatic subscription.


The callforward module in User Control Panel (UCP) in Nicolas Gudino (aka Asternic) Flash Operator Panel (FOP) 2.31.03 allows remote authenticated users to execute arbitrary commands via the command parameter.


An issue was discovered in Ipswitch WhatsUp Gold before 2017 Plus SP1 (17.1.1). Remote clients can take advantage of a misconfiguration in the TFTP server that could allow attackers to execute arbitrary commands on the TFTP server via unspecified vectors.


Open On-Chip Debugger (OpenOCD) 0.10.0 does not block attempts to use HTTP POST for sending data to 127.0.0.1 port 4444 which allows remote attackers to conduct cross-protocol scripting attacks and consequently execute arbitrary commands via a crafted web site.


An exploitable code execution vulnerability exists in the connect functionality of ProtonVPN VPN client 1.5.1. A specially crafted configuration file can cause a privilege escalation resulting in the ability to execute arbitrary commands with the system's privileges.


A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system of an affected device with the privileges of the web server.


A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated local attacker to gain access to the underlying Linux shell of an affected device and execute arbitrary commands with root privileges on the device. The vulnerability is due to the affected software improperly sanitizing command arguments to prevent modifications to the underlying Linux filesystem on a device. An attacker who has privileged EXEC mode (privilege level 15) access to an affected device could exploit this vulnerability on the device by executing CLI commands that contain crafted arguments. A successful exploit could allow the attacker to gain access to the underlying Linux shell of the affected device and execute arbitrary commands with root privileges on the device.


A Java deserialization vulnerability in Cisco Unity Express (CUE) could allow an unauthenticated remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to the listening Java Remote Method Invocation (RMI) service. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges.


A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient validation of user-supplied parameters. An attacker could exploit this vulnerability by invoking the update service command with a crafted argument. An exploit could allow the attacker to run arbitrary commands with SYSTEM user privileges. While the CVSS Attack Vector metric denotes the requirement for an attacker to have local access administrators should be aware that in Active Directory deployments the vulnerability could be exploited remotely by leveraging the operating system remote management tools.


A vulnerability in Cisco Video Surveillance Manager (VSM) Software running on certain Cisco Connected Safety and Security Unified Computing System (UCS) platforms could allow an unauthenticated remote attacker to log in to an affected system by using the root account which has default static user credentials. The vulnerability is due to the presence of undocumented default static user credentials for the root account of the affected software on certain systems. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user.


Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request.


Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request.


FruityWifi

(aka

PatatasFritas/PatataWifi)

allows

remote

attackers

to

execute

arbitrary

commands

via

shell

metacharacters

in

the

iface

or

domain

parameter

to

or

the

newSSID

or

parameter

to


nmap4j 1.1.0 allows attackers to execute arbitrary commands via shell metacharacters in an includeHosts call.


Teltonika RUT9XX routers with firmware before 00.04.233 provide a root terminal on a serial interface without proper access control. This allows attackers with physical access to execute arbitrary commands with root privileges.


Arbitrary logs location in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to change location of log files and be manipulated to execute arbitrary commands and attain command execution on a vulnerable system.


Configuration/Environment manipulation vulnerability in the administrative interface in McAfee Web Gateway (MWG) MWG 7.8.1.x allows authenticated administrator users to execute arbitrary commands via unspecified vectors.


react-dev-utils on Windows allows developers to run a local webserver for accepting various commands including a command to launch an editor. The input to that command was not properly sanitized allowing an attacker who can make a network request to the server (either via CSRF or by direct request) to execute arbitrary commands on the targeted system. This issue affects multiple branches: 1.x.x prior to 1.0.4 2.x.x prior to 2.0.2 3.x.x prior to 3.1.2 4.x.x prior to 4.2.2 and 5.x.x prior to 5.0.2.


The

setSystemTime

function

in

Foscam

Cameras

Lite

and

with

firmware

and

earlier

and

and

earlier

and

and

earlier

Lite

and

Lite

and

earlier

and

and

earlier

and

and

earlier

and

and

earlier

and

and

earlier

and

and

earlier

and

earlier

and

and

earlier

and

and

earlier

and

and

earlier

and

and

earlier

and

earlier

and

and

earlier

and

and

earlier

and

and

earlier

allows

remote

authenticated

users

to

execute

arbitrary

commands

via

a

in

the

ntpServer

argument.

NOTE:

this

issue

exists

because

of

an

incomplete

fix

for


It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection allowing a remote attacker to place a privilege escalation exploit on the target system and subsequently execute arbitrary commands.


util/virlog.c in libvirt does not properly determine the hostname on LXC container startup which allows local guest OS users to bypass an intended container protection mechanism and execute arbitrary commands via a crafted NSS module.


An issue was discovered in MetInfo 6.0.0. In install/install.php in the installation process the config/config_db.php configuration file filtering is not rigorous: one can insert malicious code in the installation process to execute arbitrary commands or obtain a web shell.


An unauthenticated remote command execution exists in Aruba ClearPass Policy Manager on linked devices. The ClearPass OnConnect feature permits administrators to link other network devices into ClearPass for the purpose of collecting enhanced information about connected endpoints. A defect in the API could allow a remote attacker to execute arbitrary commands on one of the linked devices. This vulnerability is only applicable if credentials for devices have been supplied to ClearPass under Configuration -> Network -> Devices -> CLI Settings. Resolution: Fixed in 6.7.5 and 6.6.10-hotfix.


RICOH

Interactive

Whiteboard

to

to

to

and

the

display

versions

with

RICOH

Interactive

Whiteboard

Controller

to

attached

allows

remote

attackers

to

execute

arbitrary

commands

via

unspecified

vectors.


Belkin LINKSYS RE6500 devices before 1.0.11.001 allow remote authenticated users to execute arbitrary commands via goform/systemCommand?command= in conjunction with the goform/pingstart program.


Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840.


Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote authenticated users to execute arbitrary commands via shell metacharacters in a filename to the upload_settings.cgi page.


Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page.


HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command inject attacks remotely and execute arbitrary commands of the system.


Privilege escalation vulnerability on Citrix ADC and Citrix Gateway versions before 13.0-58.30 12.1-57.18 12.0-63.21 11.1-64.14 and 10.5-70.18 allows a low privileged user with management access to execute arbitrary commands.


Jeesite 1.2.7 uses the apache shiro version 1.2.3 affected by CVE-2016-4437. Because of this version of the java deserialization vulnerability an attacker could exploit the vulnerability to execute arbitrary commands via the rememberMe parameter.


An issue in craigms/main.php of CraigMS 1.0 allows attackers to execute arbitrary commands via a crafted input entered into the DB Name field.


The MFT Browser file transfer client and MFT Browser admin client components of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contain a vulnerability that theoretically allows an attacker to craft an URL that will execute arbitrary commands on the affected system. If the attacker convinces an authenticated user with a currently active session to enter or click on the URL the commands will be executed on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions 8.2.1 and below and TIBCO Managed File Transfer Internet Server: versions 8.2.1 and below.


The administration console of the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units features a 'statusbroadcast' command that can spawn a given process repeatedly at a certain time interval as 'root'. One of the limitations of this feature is that it only takes a path to a binary without arguments; however this can be circumvented using special shell variables such as '${IFS}'. As a result an attacker can execute arbitrary commands as 'root' on the units.


The client (aka GalaxyClientService.exe) in GOG GALAXY through 2.0.41 (as of 12:58 AM Eastern 9/26/21) allows local privilege escalation from any authenticated user to SYSTEM by instructing the Windows service to execute arbitrary commands. This occurs because the attacker can inject a DLL into GalaxyClient.exe defeating the TCP-based \trusted client\ protection mechanism.


ShopXO v1.8.1 has a command execution vulnerability. Attackers can use this vulnerability to execute arbitrary commands and gain control of the server.


Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager. It is possible to modify site configuration to upload the PHP file and execute arbitrary commands.


Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in outputform or toclevels parameter to cgi-bin/printbook.


An issue was discovered on D-Link DSR-250 3.17 devices. Certain functionality in the Unified Services Router web interface could allow an authenticated attacker to execute arbitrary commands due to a lack of validation of inputs provided in multipart HTTP POST requests.


A relative path traversal attack in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier and the Data module compactplus Versions A10 and A11 allows attackers with service user privileges to upload arbitrary files. By uploading a specially crafted tar file an attacker can execute arbitrary commands.


An issue was discovered on Enphase Envoy R3.x and D4.x (and other current) devices. The upgrade_start function in /installer/upgrade_start allows remote authenticated users to execute arbitrary commands via the force parameter.


An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8 where an attacker can gain access to the server.


HNAP1/control/SetMasterWLanSettings.php in D-Link D-Link Router DIR-846 DIR-846 A1_100.26 allows remote attackers to execute arbitrary commands via shell metacharacters in the ssid0 or ssid1 parameter.


Multiple vulnerabilities in the Java deserialization function that is used by Cisco Security Manager could allow an unauthenticated remote attacker to execute arbitrary commands on an affected device. These vulnerabilities are due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit these vulnerabilities by sending a malicious serialized Java object to a specific listener on an affected system. A successful exploit could allow the attacker to execute arbitrary commands on the device with the privileges of NT AUTHORITY\\SYSTEM on the Windows target host. Cisco has not released software updates that address these vulnerabilities.


D-Link DAP-1360U before 3.0.1 devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the IP JSON value for ping (aka res_config_action=3&res_config_id=18).


Use of Hard-coded Credentials in the database of Bosch FSM-2500 server and Bosch FSM-5000 server up to and including version 5.2 allows an unauthenticated remote attacker to log into the database with admin-privileges. This may result in complete compromise of the confidentiality and integrity of the stored data as well as a high availability impact on the database itself. In addition an attacker may execute arbitrary commands on the underlying operating system.


Multiple Mitsubishi Electric products are vulnerable to impersonations of a legitimate device by a malicious actor which may allow an attacker to remotely execute arbitrary commands.


Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the \gcov-args\ argument.


A vulnerability in File Transfer Solution of Raonwiz could allow arbitrary command execution as the result of viewing a specially-crafted web page. This vulnerability is due to insufficient validation of the parameter of the specific method. An attacker could exploit this vulnerability by setting the parameter to the command they want to execute. A successful exploit could allow the attacker to execute arbitrary commands on a target system as the user. However the victim must run the Internet Explorer browser with administrator privileges because of the cross-domain policy.


codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596.


A vulnerability in agent program of HelpU remote control solution could allow an authenticated remote attacker to execute arbitrary commands This vulnerability is due to insufficient input santization when communicating customer process.


Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine.


smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6 as used in OpenBSD 6.6 and other products allows remote attackers to execute arbitrary commands as root via a crafted SMTP session as demonstrated by shell metacharacters in a MAIL FROM field. This affects the \uncommented\ default configuration. The issue exists because of an incorrect return value upon failure of input validation.


aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a modified /system?action=ServiceAdmin request (start stop or restart) to the setting menu of Sotfware Store.


OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account which may allow an attacker to login and execute arbitrary commands.


aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via the Script Content box on the Add Cron Job screen.


openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the system with the privileges of the user running openHAB. Starting with version 2.5.2 all commands need to be whitelisted in a local file which cannot be changed via REST calls.


On BIG-IP 15.0.0-15.0.1.2 14.1.0-14.1.2.2 13.1.0-13.1.3.2 12.1.0-12.1.5 and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0 6.0.0-6.1.0 and 5.2.0-5.4.0 users with non-administrator roles (for example Guest or Resource Administrator) with tmsh shell access can execute arbitrary commands with elevated privilege via a crafted tmsh command.


On BIG-IP 15.0.0-15.0.1 14.1.0-14.1.2.3 13.1.0-13.1.3.1 12.1.0-12.1.5 and 11.6.1-11.6.5 and BIG-IQ 5.2.0-7.1.0 a user associated with the Resource Administrator role who has access to the secure copy (scp) utility but does not have access to Advanced Shell (bash) can execute arbitrary commands using a maliciously crafted scp request.


IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted request an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 175418.


IBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could execute arbitrary commands on the system caused by improper validation of csv file contents. IBM X-ForceID: 186696.


IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system caused by insecure deserialization of user-supplied content by the Java deserialization function. By sending a malicious serialized Java object an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 176140.


IBM Spectrum LSF 10.1 and IBM Spectrum LSF Suite 10.2 could allow a user on the local network who has privileges to submit LSF jobs to execute arbitrary commands. IBM X-Force ID: 192586.


IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted request an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 175419.


IBM FileNet Content Manager 5.5.4 and 5.5.5 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system caused by improper validation of csv file contents. IBM X-Force ID: 188736.


IBM Security Guardium 11.1 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 174735.


IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system caused by insecure deserialization of user-supplied content by the Java deserialization function. By sending a malicious serialized Java object an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 190912.


An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function passes untrusted data to the operating system without proper sanitization. A crafted request can be sent to execute arbitrary commands as root.


In Nagios XI before 5.7.3 ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys.


Network Analysis functionality in Askey AP5100W_Dual_SIG_1.01.097 and all prior versions allows remote attackers to execute arbitrary commands via a shell metacharacter in the ping traceroute or route options.


Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters relevant in non-default configurations that enable Delivery Status Notification (DSN). Certain uses of ORCPT= can place a newline into a spool header file and indirectly allow unauthenticated remote attackers to execute arbitrary commands as root.


An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the wps_sta_enrollee_pin parameter in a set_sta_enrollee_pin.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected.


An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the date parameter in a system_time.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected.


A vulnerability has been identified in License Management Utility (LMU) (All versions < V2.4). The lmgrd service of the affected application is executed with local SYSTEM privileges on the server while its configuration can be modified by local users. The vulnerability could allow a local authenticated attacker to execute arbitrary commands on the server with local SYSTEM privileges.


An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the dns_query_name parameter in a dns_query.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected.


Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016 RV042 and RV082 Routers could allow an authenticated remote attacker with administrative privileges to execute arbitrary commands on an affected device. The vulnerabilities exist because the web-based management interface does not properly validate user-supplied input to scripts. An attacker with administrative privileges that are sufficient to log in to the web-based management interface could exploit each vulnerability by sending malicious requests to an affected device. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system.


A vulnerability in the web-based management interface of Cisco DNA Spaces Connector could allow an unauthenticated remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insufficient validation of user-supplied input in the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on the underling operating system with privileges of the web-based management application which is running as a restricted user. This could result in changes being made to pages served by the web-based management application impacting the integrity or availability of the web-based management application.


A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device. The vulnerability is due to improper input sanitization. An attacker could exploit this vulnerability by uploading a crafted file to the web UI of an affected device. A successful exploit could allow the attacker to inject and execute arbitrary commands with root privileges on the device.


Multiple vulnerabilities in the web-based management interface of Cisco RV110W RV130 RV130W and RV215W Series Routers could allow an authenticated remote attacker with administrative privileges to execute arbitrary commands. For more information about these vulnerabilities see the Details section of this advisory.


A vulnerability in Cisco Connected Mobile Experiences (CMX) could allow an authenticated local attacker with administrative credentials to execute arbitrary commands with root privileges. The vulnerability is due to improper user permissions that are configured by default on an affected system. An attacker could exploit this vulnerability by sending crafted commands to the CLI. A successful exploit could allow the attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. To exploit this vulnerability an attacker would need to have valid administrative credentials.


A vulnerability in the ROMMON of Cisco IOS XE Software could allow an authenticated local attacker to elevate privileges to those of the root user of the underlying operating system. The vulnerability is due to the ROMMON allowing for special parameters to be passed to the device at initial boot up. An attacker could exploit this vulnerability by sending parameters to the device at initial boot up. An exploit could allow the attacker to elevate from a Priv15 user to the root user and execute arbitrary commands with the privileges of the root user.


Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 Series Routers could allow an authenticated remote attacker with administrative credentials to execute arbitrary commands on the underlying operating system (OS) as a restricted user. For more information about these vulnerabilities see the Details section of this advisory.


A vulnerability in the CLI of Cisco Data Center Network Manager (DCNM) could allow an authenticated local attacker to elevate privileges to root and execute arbitrary commands on the underlying operating system. The vulnerability is due to insufficient restrictions during the execution of an affected CLI command. An attacker could exploit this vulnerability by authenticating as the fmserver user and submitting malicious input to a specific command. A successful exploit could allow the attacker to elevate privileges to root and execute arbitrary commands on the underlying operating system.


A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device. The vulnerability is due to improper input sanitization. An attacker who has valid administrative access to an affected device could exploit this vulnerability by supplying a crafted input parameter on a form in the web UI and then submitting that form. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the device which could lead to complete system compromise.


A vulnerability in the implementation of the inter-VM channel of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) could allow an unauthenticated adjacent attacker to execute arbitrary shell commands on the Virtual Device Server (VDS) of an affected device. The vulnerability is due to insufficient validation of signaling packets that are destined to VDS. An attacker could exploit this vulnerability by sending malicious packets to an affected device. A successful exploit could allow the attacker to execute arbitrary commands in the context of the Linux shell of VDS with the privileges of the root user. Because the device is designed on a hypervisor architecture exploitation of a vulnerability that affects the inter-VM channel may lead to a complete system compromise. For more information about this vulnerability see the Details section of this advisory.


A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated local attacker to execute arbitrary commands on the underlying Linux operating system with a privilege level of root on an affected device. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with root privileges. An attacker would need valid administrator credentials to exploit this vulnerability.


A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated remote attacker to inject and execute arbitrary commands with administrative privileges on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of user-supplied input to the web UI. An attacker could exploit this vulnerability by submitting crafted input to the web UI. A successful exploit could allow an attacker to execute arbitrary commands with administrative privileges on an affected device.


A vulnerability in the application protocol handling features of Cisco Jabber for Windows could allow an unauthenticated remote attacker to execute arbitrary commands. The vulnerability is due to improper handling of input to the application protocol handlers. An attacker could exploit this vulnerability by convincing a user to click a link within a message sent by email or other messaging platform. A successful exploit could allow the attacker to execute arbitrary commands on a targeted system with the privileges of the user account that is running the Cisco Jabber client software.


A vulnerability in the CLI parsers of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) could allow an authenticated local attacker to execute arbitrary shell commands on the Virtual Device Server (VDS) of an affected device. The attacker must have valid user credentials at privilege level 15. The vulnerability is due to insufficient validation of arguments that are passed to specific VDS-related CLI commands. An attacker could exploit this vulnerability by authenticating to the targeted device and including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands in the context of the Linux shell of VDS with the privileges of the root user.


A security misconfiguration vulnerability exists in the SDK of some Realtek ADSL/PON Modem SoC firmware which allows attackers using a default password to execute arbitrary commands remotely via the build-in network monitoring tool.


** DISPUTED ** An issue was discovered in DD-WRT through 16214. The Diagnostic page allows remote attackers to execute arbitrary commands via shell metacharacters in the host field of the ping command. Exploitation through CSRF might be possible. NOTE: software maintainers consider the report invalid because it refers to an old software version requires administrative privileges and does not provide access beyond that already available to administrative users.


A CSV injection (aka Excel Macro Injection or Formula Injection) issue in i-doit 1.14.2 allows an attacker to execute arbitrary commands via a Title parameter that is mishandled in a CSV export.


IBM QRadar Incident Forensics 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM Reference #: 1999542.


IBM QRadar 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM Reference #: 1999542.


Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.


Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables.


Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via \special characters \ a different vulnerability than CVE-2016-7110.


Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via \special characters \ a different vulnerability than CVE-2016-7109.


WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifconfig command aka ESCALATEPLOWMAN.


sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.


Microsoft Excel 2007 SP3 Excel 2010 SP2 Excel 2013 SP1 Excel 2013 RT SP1 Excel 2016 Office Compatibility Pack SP3 Excel Viewer and Excel 2016 for Mac mishandle a registry check which allows user-assisted remote attackers to execute arbitrary commands via crafted embedded content in a document aka \Microsoft Office Security Feature Bypass Vulnerability.\


Microsoft Excel 2007 SP3 Excel 2010 SP2 Excel 2013 SP1 Excel 2013 RT SP1 Excel 2016 Office Compatibility Pack SP3 and Excel Viewer allow user-assisted remote attackers to execute arbitrary commands via a crafted cell that is mishandled upon a click aka \Microsoft Office Security Feature Bypass Vulnerability.\


scripts/license.pl in Veritas NetBackup Appliance 2.6.0.x through 2.6.0.4 2.6.1.x through 2.6.1.2 2.7.x through 2.7.3 and 3.0.x allow remote attackers to execute arbitrary commands via shell metacharacters in the hostName parameter to appliancews/getLicense.


SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.


The (1) SCTC_REFRESH_EXPORT_TAB_COMP (2) SCTC_REFRESH_CHECK_ENV and (3) SCTC_TMS_MAINTAIN_ALOG functions in the SCTC subpackage in SAP Netweaver 7.40 SP 12 allow remote authenticated users with certain permissions to execute arbitrary commands via vectors involving a CALL 'SYSTEM' statement aka SAP Security Note 2260344.


The Eir D1000 modem does not properly restrict the TR-064 protocol which allows remote attackers to execute arbitrary commands via TCP port 7547 as demonstrated by opening WAN access to TCP port 80 retrieving the login password (which defaults to the Wi-Fi password) and using the NewNTPServer feature.


The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the speak save bytes or bytes_wav method in lib/espeak/speech.rb.


/usr/bin/shutter in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image name that is mishandled during a \Run a plugin\ action.


Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3) Air:Link 5000AC (AL5000AC) version 1.13 and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) devices allow remote attackers to execute arbitrary commands via shell metacharacters to certain /goform/* pages.


TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shell_escape_commands in the texmf.cnf config file.


Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php.


The festivaltts4r gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the (1) to_speech or (2) to_mp3 method in lib/festivaltts4r/festival4r.rb.


The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrary commands via crafted web-application parameters aka Bug ID CSCva30872.


The

function

in

in

Trend

Micro

Virtual

Mobile

Infrastructure

before

allows

remote

authenticated

users

to

execute

arbitrary

commands

via

shell

metacharacters

in

the

password

to


ccca_ajaxhandler.php in Trend Micro Smart Protection Server 2.5 before build 2200 2.6 before build 2106 and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) host or (2) apikey parameter in a register action (3) enable parameter in a save_stting action or (4) host or (5) apikey parameter in a test_connection action.


NETGEAR

before

before

before

before

before

before

before

before

and

possibly

other

routers

allow

remote

attackers

to

execute

arbitrary

commands

via

shell

metacharacters

in

the

path

info

to

cgi-bin/.


Android devices with code from Ragentek contain a privileged binary that performs over-the-air (OTA) update checks. Additionally there are multiple techniques used to hide the execution of this binary. This behavior could be described as a rootkit. This binary which resides as /system/bin/debugs runs with root privileges and does not communicate over an encrypted channel. The binary has been shown to communicate with three hosts via HTTP: oyag.lhzbdvm.com oyag.prugskh.net oyag.prugskh.com Server responses to requests sent by the debugs binary include functionalities to execute arbitrary commands as root install applications or update configurations. Examples of a request sent by the client binary: POST /pagt/agent?data={\name\:\c_regist\ \details\:{...}} HTTP/1. 1 Host: 114.80.68.223 Connection: Close An example response from the server could be: HTTP/1.1 200 OK {\code\: \01\ \name\: \push_commands\ \details\: {\server_id\: \1\ \title\: \Test Command\ \comments\: \Test\ \commands\: \touch /tmp/test\}} This binary is reported to be present in the following devices: BLU Studio G BLU Studio G Plus BLU Studio 6.0 HD BLU Studio X BLU Studio X Plus BLU Studio C HD Infinix Hot X507 Infinix Hot 2 X510 Infinix Zero X506 Infinix Zero 2 X509 DOOGEE Voyager 2 DG310 LEAGOO Lead 5 LEAGOO Lead 6 LEAGOO Lead 3i LEAGOO Lead 2S LEAGOO Alfa 6 IKU Colorful K45i Beeline Pro 2 XOLO Cube 5.0


Lexmark Markvision Enterprise (MVE) before 2.4.1 allows remote attackers to execute arbitrary commands by uploading files. (


SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200 2.6 before build 2106 and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) spare_Community (2) spare_AllowGroupIP or (3) spare_AllowGroupNetmask parameter to admin_notification.php.


The RMI service in HP Network Automation Software 9.1x 9.2x 10.0x before 10.00.02.01 and 10.1x before 10.11.00.01 allows remote attackers to execute arbitrary commands via a crafted serialized Java object related to the Apache Commons Collections (ACC) and Commons BeanUtils libraries.


The allow_execstack plugin for setroubleshoot allows local users to execute arbitrary commands by triggering an execstack SELinux denial with a crafted filename related to the commands.getoutput function.


HPE Project and Portfolio Management Center (PPM) 9.2x and 9.3x before 9.32.0002 allows remote authenticated users to execute arbitrary commands or obtain sensitive information via unspecified vectors.


HPE Universal CMDB 10.0 through 10.21 Universal CMDB Configuration Manager 10.0 through 10.21 and Universal Discovery 10.0 through 10.21 allow remote attackers to execute arbitrary commands via a crafted serialized Java object related to the Apache Commons Collections (ACC) library.


Corega CG-WLBARGL devices allow remote authenticated users to execute arbitrary commands via unspecified vectors.


HPE Discovery and Dependency Mapping Inventory (DDMi) 9.30 9.31 9.32 9.32 update 1 9.32 update 2 and 9.32 update 3 allows remote authenticated users to execute arbitrary commands via a crafted serialized Java object related to the Apache Commons Collections library.


The AdminUI in HPE Operations Manager (OM) before 9.21.130 on Linux Unix and Solaris allows remote attackers to execute arbitrary commands via a crafted serialized Java object related to the Apache Commons Collections (ACC) library.


The fix_lookup_id function in sealert in setroubleshoot before 3.2.23 allows local users to execute arbitrary commands as root by triggering an SELinux denial with a crafted file name related to executing external commands with the commands.getstatusoutput function.


Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute arbitrary commands via a service definition related to executing unzip with \illegal options.\


setroubleshoot allows local users to bypass an intended container protection mechanism and execute arbitrary commands by (1) triggering an SELinux denial with a crafted file name which is handled by the _set_tpath function in audit_data.py or via a crafted (2) local_id or (3) analysis_id field in a crafted XML document to the run_fix function in SetroubleshootFixit.py related to the subprocess.check_output and commands.getstatusoutput functions a different vulnerability than CVE-2016-4445.


Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users with access to the nslookup functionality to execute arbitrary commands with root privileges via the graph parameter to diagnosis_control.php.


HPE iMC PLAT before 7.2 E0403P04 iMC EAD before 7.2 E0405P05 iMC APM before 7.2 E0401P04 iMC NTA before 7.2 E0401P01 iMC BIMS before 7.2 E0402P02 and iMC UAM_TAM before 7.2 E0405P05 allow remote attackers to execute arbitrary commands via a crafted serialized Java object related to the Apache Commons Collections (ACC) library.


The allow_execmod plugin for setroubleshoot before 3.2.23 allows local users to execute arbitrary commands by triggering an execmod SELinux denial with a crafted binary filename related to the commands.getstatusoutput function.


Chrome OS before 53.0.2785.144 allows remote attackers to execute arbitrary commands at boot.


The gnuplot delegate functionality in ImageMagick before 6.9.4-0 and GraphicsMagick allows remote attackers to execute arbitrary commands via unspecified vectors.


cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the sn parameter to the transfer_license command.


HPE Operations Manager 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a crafted serialized Java object related to the Apache Commons Collections library.


The server in HP Release Control 9.13 9.20 and 9.21 allows remote attackers to execute arbitrary commands via a crafted serialized Java object related to the Apache Commons Collections library.


HPE Service Manager (SM) 9.3x before 9.35 P4 and 9.4x before 9.41.P2 allows remote attackers to execute arbitrary commands via a crafted serialized Java object related to the Apache Commons Collections library.


Adobe ColdFusion 10 before Update 19 11 before Update 8 and 2016 before Update 1 allows remote attackers to execute arbitrary commands via a crafted serialized Java object related to the Apache Commons Collections library.


HP Continuous Delivery Automation (CDA) 1.30 allows remote attackers to execute arbitrary commands via a crafted serialized Java object related to the Apache Commons Collections library.


The most package in Debian wheezy before 5.0.0a-2.2 in Debian jessie before 5.0.0a-2.3+deb8u1 and in Debian unstable before 5.0.0a-3 allows remote attackers to execute arbitrary commands via shell metacharacters in the name of an LZMA-compressed file.


Cisco RV180 and RV180W devices allow remote authenticated users to execute arbitrary commands as root via a crafted HTTP request aka Bug ID CSCuz48592.


HPE Operations Orchestration 10.x before 10.51 and Operations Orchestration content before 1.7.0 allow remote attackers to execute arbitrary commands via a crafted serialized Java object related to the Apache Commons Collections library.


The web-based GUI in Cisco Firepower Management Center 4.x and 5.x before 5.3.1.2 and 5.4.x before 5.4.0.1 and Cisco Adaptive Security Appliance (ASA) Software on 5500-X devices with FirePOWER Services 4.x and 5.x before 5.3.1.2 and 5.4.x before 5.4.0.1 allows remote authenticated users to execute arbitrary commands as root via crafted HTTP requests aka Bug ID CSCur25513.


boardDataJP.php

boardDataNA.php

and

boardDataWW.php

in

Netgear

before

and

and

before

allow

remote

attackers

to

execute

arbitrary

commands.


The Grapevine update process in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.0 allows remote authenticated users to execute arbitrary commands as root via a crafted upgrade parameter aka Bug ID CSCux15507.


vaconfig/time in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the ntpServer parameter.


Cisco Prime Infrastructure 1.2 through 3.1 and Evolved Programmable Network Manager (EPNM) 1.2 and 2.0 allow remote authenticated users to execute arbitrary commands or upload files via a crafted HTTP request aka Bug ID CSCuz01488.


General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to execute arbitrary commands via unspecified vectors.


IBM BigFix Platform 9.0 9.1 before 9.1.8 and 9.2 before 9.2.8 allow remote authenticated users to execute arbitrary commands by leveraging report server access. IBM X-Force ID: 111302.


The client in EMC Replication Manager (RM) before 5.5.3.0_01-PatchHotfix EMC Network Module for Microsoft 3.x and EMC Networker Module for Microsoft 8.2.x before 8.2.3.6 allows remote RM servers to execute arbitrary commands by placing a crafted script in an SMB share.


EMC NetWorker 8.2.1.x and 8.2.2.x before 8.2.2.6 and 9.x before 9.0.0.6 mishandles authentication which allows remote attackers to execute arbitrary commands by leveraging access to a different NetWorker instance.


HPE P9000 Command View Advanced Edition Software (CVAE) 7.x and 8.x before 8.4.0-00 and XP7 CVAE 7.x and 8.x before 8.4.0-00 allow remote attackers to execute arbitrary commands via a crafted serialized Java object related to the Apache Commons Collections (ACC) library.


The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote authenticated users to execute arbitrary commands by leveraging the YUM_CLIENT restricted-user role.


The GMS ViewPoint (GMSVP) web application in Dell SonicWALL GMS Analyzer and UMA EM5000 7.2 8.0 and 8.1 before Hotfix 168056 allows remote authenticated users to execute arbitrary commands via vectors related to configuration input.


The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.


The validateAdminConfig handler in the Analytics Management Console in HPE Vertica 7.0.x before 7.0.2.12 7.1.x before 7.1.2-12 and 7.2.x before 7.2.2-1 allows remote attackers to execute arbitrary commands via the mcPort parameter aka ZDI-CAN-3417.


Meteocontrol WEB'log Basic 100 Light Pro and Pro Unlimited allows remote attackers to execute arbitrary commands via an \access command shell-like feature.\


Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object related to the Apache Commons Collections library.


xymond in Xymon 4.1.x 4.2.x and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_name argument in (1) web/useradm.c or (2) web/chpasswd.c.


flu.cgi in the web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 allows remote authenticated users to execute arbitrary commands via the 5066 (aka dnsmasq) parameter.


HPE Network Node Manager i (NNMi) 9.20 9.23 9.24 9.25 10.00 and 10.01 allows remote authenticated users to execute arbitrary commands via a crafted serialized Java object related to the Apache Commons Collections (ACC) library.


The RMI service in SolarWinds Virtualization Manager 6.3.1 and earlier allows remote attackers to execute arbitrary commands via a crafted serialized Java object related to the Apache Commons Collections (ACC) library.


includer.cgi in The Includer allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the URL or (2) the template parameter.


Certain Perl scripts in Konversation 0.15 allow remote attackers to execute arbitrary commands via shell metacharacters in (1) channel names or (2) song names that are not properly quoted when the user runs IRC scripts.


awstats.pl in AWStats 4.0 and 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the config parameter.


ppxp does not drop root privileges before opening log files which allows local users to execute arbitrary commands.


awstats.pl in AWStats 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) \pluginmode\ (2) \loadplugin\ or (3) \noloadplugin\ parameters.


ftpfile in the Vacation plugin 0.15 and earlier for Squirrelmail allows local users to execute arbitrary commands via shell metacharacters in a command line argument.


zgrep in gzip before 1.3.5 does not properly sanitize arguments which allows local users to execute arbitrary commands via filenames that are injected into a sed script.


Arkeia Network Backup Client 5.x contains hard-coded credentials that effectively serve as a back door which allows remote attackers to access the file system and possibly execute arbitrary commands.


The production release of the UniversalAgent for UNIX in BrightStor ARCserve Backup 11.1 contains hard-coded credentials which allows remote attackers to access the file system and possibly execute arbitrary commands.


The ImageGalleryPlugin (ImageGalleryPlugin.pm) in Twiki allows remote attackers to execute arbitrary commands via certain commands that generate thumbnails.


Unknown vulnerability in hztty 2.0 and earlier allows local users to execute arbitrary commands.


AS/400 Telnet 5250 terminal emulation clients as implemented by (1) IBM client access (2) Bosanova (3) PowerTerm (4) Mochasoft and possibly other emulations allows malicious AS/400 servers to execute arbitrary commands via a STRPCO (Start PC Organizer) command followed by STRPCCMD (Start PC command) as demonstrated by creating a backdoor account using REXEC.


Firefox 1.0 does not prevent the user from dragging an executable file to the desktop when it has an image/gif content type but has a dangerous extension such as .bat or .exe which allows remote attackers to bypass the intended restriction and execute arbitrary commands via malformed GIF files that can still be parsed by the Windows batch file parser aka \firedragging.\


diatheke.pl in Sword 1.5.7a allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.


Pico Server (pServ) 3.2 and earlier allows remote attackers to execute arbitrary commands via a URL with multiple leading \/\ (slash) characters and \..\ sequences.


The forum.pl script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.


include.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.


The eTrace_validaddr function in eTrace plugin for e107 portal allows remote attackers to execute arbitrary commands via shell metacharacters after a valid argument to the etrace_host parameter.


Open WebMail (OWM) before 2.51 20050430 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a filename.


The SSH module in Neteyes Nexusway allows remote attackers to execute arbitrary commands via shell metacharacters in arguments to certain commands as demonstrated using ping and traceroute.


The web module in Neteyes Nexusway allows remote attackers to execute arbitrary commands via hex-encoded shell metacharacters in the ip parameter for (1) nslookup.cgi or (2) ping.cgi.


text.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.


apage.cgi in WebAPP 0.9.9.2.1 and possibly earlier versions allows remote attackers to execute arbitrary commands via shell metacharacters in the f parameter.


Apple Terminal 1.4.4 allows attackers to execute arbitrary commands via terminal escape sequences.


The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the fpr parameter to the deleteKey function in gpg_keyring.php as called by (a) import_key_file.php (b) import_key_text.php and (c) keyring_main.php; and (2) the keyserver parameter to the gpg_recv_key function in gpg_key_functions.php as called by gpg_options.php. NOTE: this issue may overlap CVE-2007-3636.


Unknown vulnerability in Radia Management Agent (RMA) in HP OpenView Radia Management Portal (RMP) 1.x and 2.x allows remote attackers to execute arbitrary commands via unknown vectors.


Unknown vulnerability in apt-cacher in Debian 3.1 related to \missing input sanitising \ allows remote attackers to execute arbitrary commands on the caching server.


The XMLRPC server in utils.rb for the ruby library (libruby) 1.8 sets an invalid default value that prevents \security protection\ using handlers which allows remote attackers to execute arbitrary commands.


The ad.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.


easymsgb.pl in Easy Message Board allows remote attackers to execute arbitrary commands via shell metacharacters in the print parameter.


Meilad File upload script (up.php) mod for phpBB 2.0.x does not properly limit the types of files that can be uploaded which allows remote authenticated users to execute arbitrary commands by uploading PHP files then directly requesting them from the uploads directory.


fixproc in Net-snmp 5.x before 5.2.1-r1 creates temporary files insecurely which allows local users to modify the contents of those files to execute arbitrary commands or overwrite arbitrary files via a symlink attack.


gdb before 6.3 searches the current working directory to load the .gdbinit configuration file which allows local users to execute arbitrary commands as the user running gdb.


The inserter.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.


hints.pl in Webhints 1.03 allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.


index.cgi in E-Cart 2004 1.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) art and possibly (2) cat parameters.


OpenText FirstClass 8.0 client does not properly sanitize strings before passing them to the Windows ShellExecute API which allows remote attackers to execute arbitrary commands via a UNC path in a bookmark.


The eping_validaddr function in functions.php for the ePing plugin for e107 portal allows remote attackers to execute arbitrary commands via shell metacharacters after a valid argument to the eping_host parameter.


Unknown vulnerability in Extreme BlackDiamond 10808 and 8800 switches running ExtremeWare XOS 11.1 before 11.1.3.3 11.0 before 11.0.2.4 and 10.x allows remote authenticated users to execute arbitrary commands.


The getemails function in C.J. Steele Tattle allows remote attackers to execute arbitrary commands via shell metacharacters in certain log entries as demonstrated using shell metacharacters in an FTP username.


Multiple SQL injection vulnerabilities in MetaCart 2.0 for PayFlow allow remote attackers to execute arbitrary commands via (1) intCatalogID (2) strSubCatalogID or (3) strSubCatalog_NAME parameter to productsByCategory.asp (4) curCatalogID (5) strSubCatalog_NAME (6) intCatalogID or (7) page parameter to productsByCategory.asp or (8) intProdID parameter to product.asp.


jammail.pl in jamchen JamMail 1.8 allows remote attackers to execute arbitrary commands via shell metacharacters in the mail parameter.


Symantec pcAnywhere 10.5x and 11.x before 11.5 with \Launch with Windows\ enabled allows local users with physical access to execute arbitrary commands via the Caller Properties feature.


The x-man-page: URI handler for Apple Terminal 1.4.4 in Mac OS X 10.3.9 does not cleanse terminal escape sequences which allows remote attackers to execute arbitrary commands.


Avi Alkalay nslookup.cgi program dated 16 June 2002 allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter.


The _httpsrequest function in Snoopy 1.2 as used in products such as (1) MagpieRSS (2) WordPress (3) Ampache and (4) Jinzora allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTPS URL to an SSL protected web page which is not properly handled by the fetch function.


Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to execute arbitrary commands via (1) the notify script in HylaFAX 4.2.0 to 4.2.3 and (2) crafted CallID parameters to the faxrcvd script in HylaFAX 4.2.2 and 4.2.3.


Avi Alkalay notify program dated 19 Aug 2001 allows remote attackers to execute arbitrary commands via shell metacharacters in the from parameter.


login.cgi in Community Link Pro Web Editor allows remote attackers to execute arbitrary commands via the file parameter.


Y.SAK allows remote attackers to execute arbitrary commands via shell metacharacters in the $no variable to (1) w_s3mbfm.cgi (2) w_s3adix.cgi or (3) w_s3sbfm.cgi.


wps_shop.cgi in WPS Web Portal System 0.7.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) art and (2) cat variables.


security.c in hcid for BlueZ 2.16 2.17 and 2.18 allows remote attackers to execute arbitrary commands via shell metacharacters in the Bluetooth device name when invoking the PIN helper.


Firefox 1.0.6 and Mozilla 1.7.10 allows attackers to execute arbitrary commands via shell metacharacters in a URL that is provided to the browser on the command line which is sent unfiltered to bash.


img.pl in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote attackers to execute arbitrary commands via shell metacharacters in the f parameter.


pstopnm in netpbm does not properly use the \-dSAFER\ option when calling Ghostscript to convert a PostScript file into a (1) PBM (2) PGM or (3) PNM file which allows external user-assisted attackers to execute arbitrary commands.


HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node parameter to connectedNodes.ovpl (2) cdpView.ovpl (3) freeIPaddrs.ovpl and (4) ecscmg.ovpl.


nquser.php in Virtual Edge Netquery 3.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the host parameter to a dig query.


Computer Associates (CA) Message Queuing (CAM / CAFT) 1.05 1.07 before Build 220_13 and 1.11 before Build 29_13 allows remote attackers to execute arbitrary commands via spoofed CAFT packets.


Looking Glass 20040427 allows remote attackers to execute arbitrary commands via shell metacharacters in the DNS lookup query field.


probe.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the olddat parameter. NOTE: it is unclear which product or vendor this program is associated with if any.


vim 6.3 before 6.3.082 with modelines enabled allows external user-assisted attackers to execute arbitrary commands via shell metacharacters in the (1) glob or (2) expand commands of a foldexpr expression for calculating fold levels.


flsearch.pl in FtpLocate 2.02 allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTP GET request.


Unknown vulnerability in \various plugins\ for NanoBlogger 3.2.1 and earlier allows remote attackers to execute arbitrary commands.


aspell_setup.php in the SpellChecker plugin in DTLink AreaEdit before 0.4.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the dictionary parameter (aka the lang variable).


pstotext before 1.8g does not properly use the \-dSAFER\ option when calling Ghostscript to extract plain text from PostScript and PDF files which allows remote attackers to execute arbitrary commands via a malicious PostScript file.


Discuz! 4.0 rc4 does not properly restrict types of files that are uploaded to the server which allows remote attackers to execute arbitrary commands via a filename containing \.php.rar\ or other multiple extensions that include .php.


The Python SVG import plugin (diasvg_import.py) for DIA 0.94 and earlier allows user-assisted attackers to execute arbitrary commands via a crafted SVG file.


The ReadLog function in kaiseki.cgi in pngren allows remote attackers to execute arbitrary commands via shell metacharacters in the query string.


eRoom 6.x does not properly restrict files that can be attached which allows remote attackers to execute arbitrary commands via a .lnk file.


The event_pin_code_request function in the btsrv daemon (btsrv.c) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a Bluetooth device name.


im_trbbs.cgi in imTRSET 1.02 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the df parameter.


man2web allows remote attackers to execute arbitrary commands via -P arguments.


Bluetooth FTP client (BTFTP) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename argument of a PUT command.


Cacti 0.8.6e and earlier does not perform proper input validation to protect against common attacks which allows remote attackers to execute arbitrary commands or SQL by sending a legitimate value in a POST request or cookie then specifying the attack string in the URL which causes the get_request_var function to return the wrong value in the $_REQUEST variable which is cleansed while the original malicious $_GET value remains unmodified as demonstrated in (1) graph_image.php and (2) graph.php.


The Downloads page in MAXdev MD-Pro 1.0.73 and possibly earlier versions uses an incomplete blacklist to check for dangerous file extensions which could allow remote attackers to bypass file extension checks and execute arbitrary commands by uploading a file with a different extension as demonstrated using .inc files.


masqmail before 0.2.18 allows remote attackers to execute arbitrary commands via crafted e-mail addresses that are not properly sanitized when creating a failed delivery message.


read.cgi in GlobalNoteScript allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameters.


The delegate code in ImageMagick 6.2.4.5-0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename that is processed by the display command.


tunnelform.yaws in Nortel SSL VPN 4.2.1.6 allows remote attackers to execute arbitrary commands via a link in the a parameter which is executed with extra privileges in a cryptographically signed Java Applet.


The (1) phrafx and (2) phgrafx-startup programs in QNX realtime operating system (RTOS) 4.25 and 6.1.0 do not properly drop privileges before executing the system command which allows local users to execute arbitrary commands by modifying the PATH environment variable to reference a malicious crttrap program.


graph.php in Ganglia PHP RRD Web Client 1.0.2 allows remote attackers to execute arbitrary commands via the command parameter which is provided to the passthru function.


site_searcher.cgi in Super Site Searcher allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter.


The file preview functionality in Sketch 0.6.12 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an encapsulated Postscript (EPS) file.


The RPC module in Webmin 0.21 through 0.99 when installed without root or admin privileges allows remote attackers to read and write to arbitrary files and execute arbitrary commands via remote_foreign_require and remote_foreign_call requests.


search.cgi in AGH HTMLsearch 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the template parameter.


Simple WAIS (SWAIS) 1.11 allows remote attackers to execute arbitrary commands via the shell metacharacters in the search field as demonstrated using the \|\ (pipe) character.


The Printer Administration module for Webmin 0.990 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the printer name.


XChat IRC client allows remote attackers to execute arbitrary commands via a /dns command on a host whose DNS reverse lookup contains shell metacharacters.


config_converters.py in BSCW (Basic Support for Cooperative Work) 3.x and versions before 4.06 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name during filename conversion.


Apache for Win32 before 1.3.24 and 2.0.x before 2.0.34-beta allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe character) provided as arguments to batch (.bat) or .cmd scripts which are sent unfiltered to the shell interpreter typically cmd.exe.


Smsd in SMS Server Tools (SMStools) before 1.4.8 allows remote attackers to execute arbitrary commands via shell metacharacters (backquotes) in message text as described with the term \string format vulnerability\ by some sources.


ghostscript before 6.53 allows attackers to execute arbitrary commands by using .locksafe or .setsafe to reset the current pagedevice.


FileSeek.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) head or (2) foot parameters.


sscd_suncourier.pl CGI script in the Sun Sunsolve CD pack allows remote attackers to execute arbitrary commands via shell metacharacters in the email address parameter.


Multiple CGI scripts in CIDER SHADOW 1.5 and 1.6 allows remote attackers to execute arbitrary commands via certain form fields.


Marcus S. Xenakis directory.php script allows remote attackers to execute arbitrary commands via shell metacharacters in the dir parameter.


ifup-dhcp script in the sysconfig package for SuSE 8.0 allows remote attackers to execute arbitrary commands via spoofed DHCP responses which are stored and executed in a file.


URL-handling code in Pine 4.43 and earlier allows remote attackers to execute arbitrary commands via a URL enclosed in single quotes and containing shell metacharacters (&).


ans.pl in Avenger's News System (ANS) 2.11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the p (plugin) parameter.


dvips converter for Postscript files in the tetex package calls the system() function insecurely which allows remote attackers to execute arbitrary commands via certain print jobs possibly involving fonts.


Add2it Mailman Free 1.73 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the list parameter.


CGIscript.net csMailto.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the form-attachment field.


Phorum 3.3.2a allows remote attackers to execute arbitrary commands via an HTTP request to (1) plugin.php (2) admin.php or (3) del.php that modifies the PHORUMsettings_dir variable to point to a directory that contains a PHP file with the commands.


Vulnerability in RFC822 address parser in mutt before 1.2.5.1 and mutt 1.3.x before 1.3.25 allows remote attackers to execute arbitrary commands via an improperly terminated comment or phrase in the address list.


phpsmssend.php in PhpSmsSend 1.0 allows remote attackers to execute arbitrary commands via an SMS message containing shell metacharacters.


SayText function in Kismet 2.2.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters (backtick or pipe) in the essid argument.


The Host function in Microsoft Office Web Components (OWC) 2000 and 2002 is exposed in components that are marked as safe for scripting which allows remote attackers to execute arbitrary commands via the setTimeout method.


Multiple vulnerabilities in KDE 2 and KDE 3.x through 3.0.5 do not quote certain parameters that are inserted into a shell command which could allow remote attackers to execute arbitrary commands via (1) URLs (2) filenames or (3) e-mail addresses.


Web Shop Manager 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search box.


Perlbot 1.0 beta allows remote attackers to execute arbitrary commands via shell metacharacters in (1) a word that is being spell checked or (2) an e-mail address.


compose.cgi in Mailreader.com 2.3.30 and 2.3.31 when using Sendmail as the Mail Transfer Agent allows remote attackers to execute arbitrary commands via shell metacharacters in the RealEmail configuration variable which is used to call Sendmail in network.cgi.


The spell checker plugin (check_me.mod.php) for SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary commands via a modified sqspell_command parameter.


Unknown vulnerability in smb2www 980804-16 and earlier allows remote attackers to execute arbitrary commands.


Nagios 1.0b1 through 1.0b3 allows remote attackers to execute arbitrary commands via shell metacharacters in plugin output.


calendar.php in vBulletin before 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the command parameter.


The Mail::Mailer Perl module in the perl-MailTools package 1.47 and earlier uses mailx as the default mailer which allows remote attackers to execute arbitrary commands by inserting them into the mail body which is then processed by mailx.


Unknown vulnerability in WesMo phpEventCalendar 1.1 allows remote attackers to execute arbitrary commands via unknown attack vectors.


Cacti before 0.6.8 allows attackers to execute arbitrary commands via the \Data Input\ option in console mode.


astrocam.cgi in AstroCam 0.9-1-1 through 1.4.0 allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTP request. NOTE: earlier disclosures stated that the affected versions were 1.7.1 through 2.1.2 but the vendor explicitly stated that these were incorrect.


webbbs_post.pl in WebBBS 4 and 5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the followup parameter.


Unknown vulnerability in autofs on AIX 4.3.0 when using executable maps allows attackers to execute arbitrary commands as root possibly related to \string handling around how the executable map is called.\


Molly IRC bot 0.5 allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the $host variable for nslookup.pl (2) the $to $from or $message variables in pop.pl (3) the $words or $text variables in sms.pl or (4) the $server or $printer variables in hpled.pl.


Rlaj whois CGI script (whois.cgi) 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain name field.


graphs.php in Cacti before 0.6.8 allows remote authenticated Cacti administrators to execute arbitrary commands via shell metacharacters in the title during edit mode.


importInfo in the Admin Server for iPlanet WebServer 4.x up to SP11 allows the web administrator to execute arbitrary commands via shell metacharacters in the dir parameter and possibly allows remote attackers to exploit this vulnerability via a separate XSS issue (CVE-2002-1315).


Virgil CGI Scanner 0.9 allows remote attackers to execute arbitrary commands via the (1) tar (TARGET) or (2) zielport (ZIELPORT) parameters.


WBPublish (aka WBPublish.exe) in Fujitsu-Siemens WebTransactions 7.0 7.1 and possibly other versions allows remote attackers to execute arbitrary commands via shell metacharacters in input that is sent through HTTP and improperly used during temporary session data cleanup possibly related to (1) directory names (2) template names and (3) session IDs.


The papd daemon in Netatalk before 2.0.4-beta2 when using certain variables in a pipe command for the print file allows remote attackers to execute arbitrary commands via shell metacharacters in a print request as demonstrated using a crafted Title.


gitweb/gitweb.perl in gitweb in Git 1.6.x before 1.6.0.6 1.5.6.x before 1.5.6.6 1.5.5.x before 1.5.5.6 1.5.4.x before 1.5.4.7 and other versions after 1.4.3 allows local repository owners to execute arbitrary commands by modifying the diff.external configuration variable and executing a crafted gitweb query.


The cTrigger::DoIt function in src/ctrigger.cpp in the trigger mechanism in the daemon in Verlihub 0.9.8d-RC2 and earlier when user triggers are enabled allows remote attackers to execute arbitrary commands via shell metacharacters in an argument.


mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the sFileName argument.


** DISPUTED ** Argument injection vulnerability in Google Chrome 1.0.154.36 on Windows XP SP3 allows remote attackers to execute arbitrary commands via the --renderer-path option in a chromehtml: URI. NOTE: a third party disputes this issue stating that Chrome \will ask for user permission\ and \cannot launch the applet even if you have given out the permission.\


The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in unspecified input.


lynx 2.8.6dev.15 and earlier when advanced mode is enabled and lynx is configured as a URL handler allows remote attackers to execute arbitrary commands via a crafted lynxcgi: URL a related issue to CVE-2005-2929. NOTE: this might only be a vulnerability in limited deployments that have defined a lynxcgi: handler.


The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier as used in (1) ampache (2) libphp-snoopy (3) mahara (4) mediamate (5) opendb (6) pixelpost and possibly other products allows remote attackers to execute arbitrary commands via shell metacharacters in https URLs.


board.cgi in Sepal SPBOARD 4.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter during a down_file action.


general/login.php in phpCollab 2.5 rc3 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified input related to the SSL_CLIENT_CERT environment variable. NOTE: in some environments SSL_CLIENT_CERT always has a base64-encoded string value which may impose constraints on injection for typical shells.


Opera before 9.62 allows remote attackers to execute arbitrary commands via the History Search results page a different vulnerability than CVE-2008-4696.


The get_file_type function in lib/file_content.php in DFLabs PTK 0.1 0.2 and 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters after an arg1= sequence in a filename within a forensic image.


cgi-bin/webutil.pl in The Puppet Master WebUtil 2.7 allows remote attackers to execute arbitrary commands via shell metacharacters in the details command.


Unspecified vulnerability in Frontend Filemanager (air_filemanager) 0.6.1 and earlier extension for TYPO3 allows remote attackers to execute arbitrary commands via unknown vectors.


cgi-bin/webutil.pl in The Puppet Master WebUtil 2.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the whois command.


Unspecified vulnerability in the Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0 as used with Avaya Communication Manager 3.1.x allows remote authenticated users to execute arbitrary commands via unknown vectors related to configuration of \local data viewing or restoring parameters.\


Unspecified vulnerability in the Web administration interface in Avaya Communication Manager 3.1.x before CM 3.1.4 SP2 and 4.0.x before 4.0.3 SP1 allows remote authenticated users to execute arbitrary commands via unknown vectors related to \viewing system logs.\


cgi-bin/script in Aztech ADSL2/2+ 4-port router 3.7.0 build 070426 allows remote attackers to execute arbitrary commands via shell metacharacters in the query string.


The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) \D\ (delete) command or (2) b:netrw_curdir variable as demonstrated using the netrw.v4 and netrw.v5 test cases.


dhtml.pl in MHF Media Pro allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter as demonstrated using the (1) advert_top.htm or (2) advert_login.htm pages.


The ListView control in the Client GUI (AClient.exe) in Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 allows local users to gain SYSTEM privileges and execute arbitrary commands via a \Shatter\ style attack on the \command prompt\ hidden GUI button to (1) overwrite the CommandLine parameter to cmd.exe to use SYSTEM privileges and (2) modify the DLL that is loaded using the LoadLibrary API function.


cgi-bin/webutil.pl in The Puppet Master WebUtil allows remote attackers to execute arbitrary commands via shell metacharacters in the dig command.


UI-Dialog 1.09 and earlier allows remote attackers to execute arbitrary commands.


Argument injection vulnerability in the URI handler in KVIrc 3.4.2 Shiny allows remote attackers to execute arbitrary commands via a \ (quote) followed by command line switches in a (1) irc:/// (2) irc6:/// (3) ircs:/// or (4) and ircs6:/// URI. NOTE: this might be due to an incomplete fix for CVE-2007-2951.


Numara FootPrints 7.5a through 7.5a1 and 8.0 through 8.0a allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) transcriptFile parameter to MRcgi/MRchat.pl or (2) LOADFILE parameter to MRcgi/MRABLoad2.pl. NOTE: some of these details are obtained from third party information.


The _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands. NOTE: this issue exists dues to an incomplete fix for CVE-2008-4796.


The open-in-browser command in newsbeuter before 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a feed URL.


Multiple unspecified \input validation\ vulnerabilities in the Web management interface (aka Messaging Administration interface) in Avaya Message Storage Server (MSS) 3.x and 4.0 and possibly Communication Manager 3.1.x allow remote authenticated administrators to execute arbitrary commands as user vexvm via vectors related to (1) SFTP Remote Store configuration; (2) remote FTP storage settings; (3) name server lookup; (4) pinging another host; (5) TCP/IP Networking parameter configuration; (6) the external hosts configuration main page; (7) adding and changing external hosts; (8) Windows domain parameter configuration; (9) date time and NTP server configuration; (10) alarm settings; (11) the command line history form; (12) the maintenance form; and (13) the server events form.


Unspecified vulnerability in OpenVPN 2.1-beta14 through 2.1-rc8 when running on non-Windows systems allows remote servers to execute arbitrary commands via crafted (1) lladdr and (2) iproute configuration directives probably related to shell metacharacters.


src/main-win.c in GPicView 0.1.9 in Lightweight X11 Desktop Environment (LXDE) allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.


Vim 7.1.314 6.4 and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions as demonstrated using (1) filetype.vim (3) xpm.vim (4) gzip_vim and (5) netrw. NOTE: the originally reported version was 7.1.314 but the researcher actually found this set of issues in 7.1.298. NOTE: the zipplugin issue (originally vector 2 in this identifier) has been subsumed by CVE-2008-3075.


cbrPager before 0.9.17 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a (1) ZIP (aka .cbz) or (2) RAR (aka .cbr) archive filename.


Sun Java Active Server Pages (ASP) Server before 4.0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in HTTP requests to unspecified ASP applications.


robotd in the Library Manager in EMC AlphaStor 3.1 SP1 for Windows allows remote attackers to execute arbitrary commands via an unspecified string field in a packet to TCP port 3500.


CRLF injection vulnerability in xterm allows user-assisted attackers to execute arbitrary commands via LF (aka \\n) characters surrounding a command name within a Device Control Request Status String (DECRQSS) escape sequence in a text file a related issue to CVE-2003-0063 and CVE-2003-0071.


eBay Enhanced Picture Uploader ActiveX control (EPUWALcontrol.dll) before 1.0.27 allows remote attackers to execute arbitrary commands via the PictureUrls property.


Unspecified vulnerability in Mail in Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary commands via a crafted file:// URL.


sdbstarter in SAP MaxDB 7.6.0.37 and possibly other versions allows local users to execute arbitrary commands by using unspecified environment variables to modify configuration settings.


include/imageObjectIM.class.php in Coppermine Photo Gallery (CPG) before 1.4.15 when the ImageMagick picture processing method is configured allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) quality (2) angle or (3) clipval parameter to picEditor.php.


Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to (1) xdg-open or (2) xdg-email.


SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via \&&\ and other shell metacharacters in exec_sdbinfo and other unspecified commands which are executed when MaxDB invokes cons.exe.


An ActiveX control for Microsoft Visual FoxPro (vfp6r.dll 6.0.8862.0) allows remote attackers to execute arbitrary commands by invoking the DoCmd method.


Symantec Ghost Solution Suite 1.1 before 1.1 patch 2 2.0.0 and 2.0.1 does not authenticate connections between the console and the Ghost Management Agent which allows remote attackers to execute arbitrary commands via unspecified RPC requests in conjunction with ARP spoofing.


diatheke.pl in The SWORD Project Diatheke 1.5.9 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the range parameter.


The Microsoft Rich Textbox ActiveX Control (RICHTX32.OCX) 6.1.97.82 allows remote attackers to execute arbitrary commands by invoking the insecure SaveFile method.


The replication monitor CGI script (repl-monitor-cgi.pl) in Red Hat Administration Server as used by Red Hat Directory Server 8.0 EL4 and EL5 allows remote attackers to execute arbitrary commands.


The Utils::runScripts function in src/utils.cpp in vdccm 0.92 through 0.10.0 in SynCE (SynCE-dccm) allows remote attackers to execute arbitrary commands via shell metacharacters in a certain string to TCP port 5679.


** DISPUTED ** CenterIM 4.22.3 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URI related to \received URLs in the message window.\ NOTE: this issue has been disputed due to the user-assisted nature since the URL must be selected and launched by the victim.


ZoneMinder before 1.23.3 allows remote authenticated users and possibly unauthenticated attackers in some installations to execute arbitrary commands via shell metacharacters in a crafted URL.


cgi-data/FastJSData.cgi in OmniPCX Office with Internet Access services OXO210 before 210/091.001 OXO600 before 610/014.001 and other versions allows remote attackers to execute arbitrary commands and \obtain OXO resources\ via shell metacharacters in the id2 parameter.


Cisco CiscoWorks Internetwork Performance Monitor (IPM) 2.6 creates a process that executes a command shell and listens on a randomly chosen TCP port which allows remote attackers to execute arbitrary commands.


Untrusted search path and argument injection vulnerability in the VersantD service in Versant Object Database 7.0.1.3 and earlier as used in Borland CaliberRM and probably other products allows remote attackers to execute arbitrary commands via a request to TCP port 5019 with a modified VERSANT_ROOT field.


pysmb.py in system-config-printer 0.6.x and 0.7.x as used in foomatic-gui and possibly other products allows remote SMB servers to execute arbitrary commands via shell metacharacters in the (1) NetBIOS or (2) workgroup name which are not properly handled when searching for network printers.


The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the (1) HOST_NAME (2) DOMAIN_NAME (3) NIS_DOMAIN and (4) TFTP_SERVER_NAME host name options.


The DHCPv6 client (dhcp6c) as used in the dhcpv6 project through 2011-07-25 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message.


Spring Framework 3.0.0 through 3.0.5 Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6 and possibly other versions deserialize objects from untrusted sources which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler or (2) accessing internal AOP interfaces as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.


A flaw was found in WebSVN 2.3.2. Without prior authentication if the 'allowDownload' option is enabled in config.php an attacker can invoke the dl.php script and pass a well formed 'path' argument to execute arbitrary commands against the underlying operating system.


The modify_resolvconf_suse script in the vpnc package before 0.5.1-55.10.1 in SUSE Linux Enterprise Desktop 11 SP1 might allow remote attackers to execute arbitrary commands via a crafted DNS domain name.


The web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote authenticated users to execute arbitrary commands via crafted parameters to web forms aka Bug ID CSCtq65681.


The Home Page component in Cisco CiscoWorks Common Services before 4.1 on Windows as used in CiscoWorks LAN Management Solution Cisco Security Manager Cisco Unified Service Monitor Cisco Unified Operations Manager CiscoWorks QoS Policy Manager and CiscoWorks Voice Manager allows remote authenticated users to execute arbitrary commands via a crafted URL aka Bug IDs CSCtq48990 CSCtq63992 CSCtq64011 CSCtq64019 CSCtr23090 and CSCtt25535.


Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.


Unspecified vulnerability in Zope 2.12.x and 2.13.x as used in Plone 4.0.x through 4.0.9 4.1 and 4.2 through 4.2a2 allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.


BaseServiceImpl.class in CA ARCserve D2D r15 does not properly handle sessions which allows remote attackers to obtain credentials and consequently execute arbitrary commands via unspecified vectors.


The server in Bcfg2 1.1.2 and earlier and 1.2 prerelease allows remote attackers to execute arbitrary commands via shell metacharacters in data received from a client.


shared/inc/sql/lists.php in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in mailing list tunable options.


service.exe in Measuresoft ScadaPro 4.0.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) BF (2) OF or (3) EF command.


Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c in the ifcfg-rh plug-in for GNOME NetworkManager 0.9.1 0.9.0 0.8.1 and possibly other versions when PolicyKit is configured to allow users to create new connections allows local users to execute arbitrary commands via a newline character in the name for a new network connection which is not properly handled when writing to the ifcfg file.


sys/sys_unix.c in the ioQuake3 engine on Unix and Linux as used in World of Padman 1.5.x before 1.5.1.1 and OpenArena 0.8.x-15 and 0.8.x-16 allows remote game servers to execute arbitrary commands via shell metacharacters in a long fs_game variable.


The web management interface on the Cisco RVS4000 Gigabit Security Router with software 1.x before 1.3.3.4 and 2.x before 2.0.2.7 and the WRVS4400N Gigabit Security Router with software before 2.0.2.1 allows remote authenticated users to execute arbitrary commands via the (1) ping test parameter or (2) traceroute test parameter aka Bug ID CSCtn23871.


logwatch.pl in Logwatch 7.3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in a log file name as demonstrated via a crafted username to a Samba server.


manager.c in the Manager Interface in Asterisk Open Source 1.4.x before 1.4.40.1 1.6.1.x before 1.6.1.25 1.6.2.x before 1.6.2.17.3 and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 does not properly check for the system privilege which allows remote authenticated users to execute arbitrary commands via an Originate action that has an Async header in conjunction with an Application header.


The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.


The

deliver

function

in

the

sendmail

delivery

agent

(lib/mail/network/delivery_methods/sendmail.rb)

in

Ruby

Mail

gem

and

earlier

allows

remote

attackers

to

execute

arbitrary

commands

via

shell

metacharacters

in

an

e-mail

address.


xrdb.c in xrdb before 1.0.9 in X.Org X11R7.6 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a (1) DHCP or (2) XDMCP message.


Intel Alert Management System (aka AMS or AMS2) as used in Symantec Antivirus Corporate Edition (SAVCE) 10.x before 10.1 MR10 Symantec System Center (SSC) 10.x and Symantec Quarantine Server 3.5 and 3.6 allows remote attackers to execute arbitrary commands via crafted messages over TCP as discovered by Junaid Bohio a different vulnerability than CVE-2010-0110 and CVE-2010-0111. NOTE: some of these details are obtained from third party information.


dhcpcd before 5.2.12 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message.


The email function in manage_sql.c in OpenVAS Manager 1.0.x through 1.0.3 and 2.0.x through 2.0rc2 allows remote authenticated users to execute arbitrary commands via the (1) To or (2) From e-mail address in an OMP request to the Greenbone Security Assistant (GSA).


The irccd.exe service in EMC Replication Manager Client before 5.3 and NetWorker Module for Microsoft Applications 2.1.x and 2.2.x allows remote attackers to execute arbitrary commands via the RunProgram function to TCP port 6542.


dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1 3.1-ESV before 3.1-ESV-R1 and 4.1-ESV before 4.1-ESV-R2 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message as demonstrated by a hostname that is provided to dhclient-script.


Hastymail2 2.1.1 before RC2 allows remote attackers to execute arbitrary commands via the (1) rs or (2) rsargs parameter in a mailbox Drafts action to the default URI.


The

sandbox

environment

in

the

Google

App

Engine

Python

SDK

before

does

not

properly

prevent

os.popen

calls

which

allows

local

users

to

bypass

intended

access

restrictions

and

execute

arbitrary

commands

via

a

dev_appserver.RestrictedPathFunction._original_os

reference

within

the

code

parameter

to

a

different

vulnerability

than


The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent use of the os module which allows local users to bypass intended access restrictions and execute arbitrary commands via a file_blob_storage.os reference within the code parameter to _ah/admin/interactive/execute a different vulnerability than CVE-2011-1364.


The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25 Edimax 6114Wg Canyon-Tech CN-WF512 with firmware 1.83 Canyon-Tech CN-WF514 with firmware 2.08 Sitecom WL-153 with firmware before 1.39 and Sweex LB000021 with firmware 3.15 allows remote attackers to execute arbitrary commands via shell metacharacters.


The (1) Traceroute and (2) Ping implementations in tools.php in SpamTitan WebTitan before 3.60 allow remote authenticated users to execute arbitrary commands via shell metacharacters in an argument as demonstrated by an && (ampersand ampersand) sequence.


remote_support.cgi in the Tadasoft Restorepoint 3.2 evaluation image allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) pid1 or (2) pid2 parameter in a stop_remote_support action.


The Dell KACE K2000 System Deployment Appliance allows remote attackers to execute arbitrary commands by leveraging database write access.


dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1 when register_globals is enabled allows remote attackers to execute arbitrary commands via shell metacharacters in the argv1 parameter.


The drawAdminTools_PackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control (DTC) before 0.32.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the dtcpkg_directory parameter in a do_install action to dtc/.


apps/a3/cfg_ethping.cgi in the Ctek SkyRouter 4200 and 4300 allows remote attackers to execute arbitrary commands via shell metacharacters in the PINGADDRESS parameter for a \u\ action.


Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the access control and execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document.


The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) get_license (2) get_log_line or (3) update_system/upgrade_pro_web request a different vulnerability than CVE-2014-3804.


The (1) av-centerd SOAP service and (2) backup command in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to execute arbitrary commands via unspecified vectors.


The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) remote_task or (2) get_license request a different vulnerability than CVE-2014-3804 and CVE-2014-3805.


The Baseboard Management Controller (BMC) in Cisco Unified Computing System (UCS) allows local users to gain privileges and execute arbitrary commands via crafted command parameters within the command-line interface aka Bug ID CSCtr43330.


Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.2.0 and in foomatic-filters in Foomatic 4.0.x allows remote attackers to execute arbitrary commands via ` (backtick) characters in a print job.


Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.


Incomplete blacklist vulnerability in the checkBlacklist function in CPAINT allows remote attackers to execute arbitrary commands via the (1) ExecuteGlobal function or (2) GetRef statement which is not included in the blacklist.


Incomplete blacklist vulnerability in NULL FTP Server Free and Pro 1.1.0.7 allows remote authenticated users to execute arbitrary commands via a custom SITE command containing shell metacharacters such as \&\ (ampersand) in the middle of an argument.


A certain ActiveX control in Comodo AntiVirus 2.0 allows remote attackers to execute arbitrary commands via the ExecuteStr method.