The automatic version check functionality in the tools in Percona Toolkit 2.1 allows man-in-the-middle attackers to obtain sensitive information or execute arbitrary code by leveraging use of HTTP to download configuration information from v.percona.com.


The update process in Xmind 3.4.1 and earlier allow remote attackers to execute arbitrary code via a man-in-the-middle attack.

arbitrary code execution
man in the middle


ASUS RT-AC68U RT-AC66R RT-AC66U RT-AC56R RT-AC56U RT-N66R RT-N66U RT-N56R RT-N56U and possibly other RT-series routers before firmware 3.0.0.4.376.x do not verify the integrity of firmware (1) update information or (2) downloaded updates which allows man-in-the-middle (MITM) attackers to execute arbitrary code via a crafted image.


The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle attackers to execute arbitrary code by spoofing the update server and uploading an executable.


The SMB client in Microsoft Windows 2000 SP4 Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista Gold SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 does not properly allocate memory for SMB responses which allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code via a crafted (1) SMBv1 or (2) SMBv2 response aka \SMB Client Memory Allocation Vulnerability.\


The SMB client implementation in Microsoft Windows 2000 SP4 XP SP2 and SP3 and Server 2003 SP2 does not properly validate response fields which allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code via a crafted response aka \SMB Client Pool Corruption Vulnerability.\


The base-files package before 5.0.0ubuntu7.1 on Ubuntu 9.10 and before 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS as shipped on Dell Latitude 2110 netbooks does not require authentication for package installation which allows remote archive servers and man-in-the-middle attackers to execute arbitrary code via a crafted package.


The SMB client in Microsoft Windows Server 2008 R2 and Windows 7 does not properly handle (1) SMBv1 and (2) SMBv2 response packets which allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code via a crafted packet that causes the client to read the entirety of the response and then improperly interact with the Winsock Kernel (WSK) aka \SMB Client Message Size Vulnerability.\


Open Directory in Apple Mac OS X 10.6 before 10.6.4 creates an unencrypted connection upon certain SSL failures which allows man-in-the-middle attackers to spoof arbitrary network account servers and possibly execute arbitrary code via unspecified vectors.


The site-locking implementation in the SdcWebSecureBase interface in tgctlcm.dll in Consona Live Assistance Dynamic Agent and Subscriber Assistance relies on a list of server domain names to restrict execution of ActiveX controls which makes it easier for man-in-the-middle attackers to execute arbitrary code via a DNS hijacking attack.


Help Viewer in Apple Mac OS X before 10.6.2 does not use an HTTPS connection to retrieve Apple Help content from a web site which allows man-in-the-middle attackers to send a crafted help:runscript link and thereby execute arbitrary code via a spoofed response.


A potential Man-in-the-Middle (MitM) attack vulnerability in Trend Micro OfficeScan 11.0 and XG may allow attackers to execute arbitrary code on vulnerable installations.


The rule-update feature in Cisco FireSIGHT Management Center (MC) 5.2 through 5.4.0.1 does not verify the X.509 certificate of the support.sourcefire.com SSL server which allows man-in-the-middle attackers to spoof this server and provide an invalid package and consequently execute arbitrary code via a crafted certificate aka Bug ID CSCuw06444.


The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted plugin.


The autoupdate implementation in TimeDoctor Pro 1.4.72.3 on Windows relies on unsigned installer files that are retrieved without use of SSL which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted file.


GALAXY Apps (aka Samsung Apps Samsung Updates or com.sec.android.app.samsungapps) before 14120405.03.012 allows man-in-the-middle attackers to obtain sensitive information and execute arbitrary code.


The hp-plugin utility in HP Linux Imaging and Printing (HPLIP) makes it easier for man-in-the-middle attackers to execute arbitrary code by leveraging use of a short GPG key id from a keyserver to verify print plugin downloads.


The Inetc plugin for Nullsoft Scriptable Install System (NSIS) as used in CERT/CC Failure Observation Engine (FOE) and other products does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and possibly execute arbitrary code by sending a crafted certificate in a download session for Windows executable files.


Samsung Account (AKA com.osp.app.signin) before 1.6.0069 and 2.x before 2.1.0069 allows man-in-the-middle attackers to obtain sensitive information and execute arbitrary code.


The Siemens SPCanywhere application for Android does not use encryption during the loading of code which allows man-in-the-middle attackers to execute arbitrary code by modifying the client-server data stream.


Insecure plugin update mechanism in tucan through 0.3.10 could allow remote attackers to perform man-in-the-middle attacks and execute arbitrary code ith the permissions of the user running tucan.


Channel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments before 1.2.3-199 allows man-in-the-middle attackers to execute arbitrary code via unspecified vectors.


An issue was discovered on VOBOT CLOCK before 0.99.30 devices. Cleartext HTTP is used to download a breakout program and therefore man-in-the-middle attackers can execute arbitrary code by watching for a local user to launch the Breakout Easter Egg feature and then sending a crafted HTTP response.


VOBOT CLOCK before 0.99.30 devices do not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information and consequently execute arbitrary code via a crafted certificate as demonstrated by leveraging a hardcoded --no-check-certificate Wget option.


lix through 15.8.7 allows man-in-the-middle attackers to execute arbitrary code by modifying the HTTP client-server data stream so that the Location header is associated with attacker-controlled executable content in the postDownload field.


The esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.4.168.0 does not properly verify X.509 certificates from the edf.eset.com SSL server which allows man-in-the-middle attackers to spoof this server and provide crafted responses to license activation requests via a self-signed certificate. NOTE: this issue can be combined with CVE-2016-0718 to execute arbitrary code remotely as root.


LINE for Windows before 4.8.3 allows man-in-the-middle attackers to execute arbitrary code.


The automatic update feature in KeePass 2.33 and earlier allows man-in-the-middle attackers to execute arbitrary code by spoofing the version check response and supplying a crafted update.


Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream.


The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information which might allow man-in-the-middle attackers to execute arbitrary code via a crafted application.


Intel Driver Update Utility before 2.4 retrieves driver updates in cleartext which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted file.


Allround Automations PL/SQL Developer 11 before 11.0.6 relies on unverified HTTP data for updates which allows man-in-the-middle attackers to execute arbitrary code by modifying fields in the client-server data stream.


UpdateAgent in Lenovo Accelerator Application allows man-in-the-middle attackers to execute arbitrary code by spoofing an update response from susapi.lenovomm.com.


Tor Browser Launcher (aka torbrowser-launcher) before 0.2.4 during the initial run allows man-in-the-middle attackers to bypass the PGP signature verification and execute arbitrary code via a Trojan horse tar file and a signature file with the valid tarball and signature.


The \Java Update\ feature for Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not verify the signature of the JRE that is downloaded which allows remote attackers to execute arbitrary code via DNS man-in-the-middle attacks.


The GUP generic update process in Notepad++ before 4.8.1 does not properly verify the authenticity of updates which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update as demonstrated by evilgrade and DNS cache poisoning.


Sun Java 1.6.0_03 and earlier versions and possibly later versions does not properly verify the authenticity of updates which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update as demonstrated by evilgrade and DNS cache poisoning.


Nullsoft Winamp before 5.24 does not properly verify the authenticity of updates which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update as demonstrated by evilgrade and DNS cache poisoning.


The PartyGaming PartyPoker client program 121/120 does not properly verify the authenticity of updates which allows remote man-in-the-middle attackers to execute arbitrary code via a Trojan horse update.


OpenOffice.org (OOo) before 2.1.0 does not properly verify the authenticity of updates which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update as demonstrated by evilgrade and DNS cache poisoning.


SpeedBit Download Accelerator Plus (DAP) before 8.6.3.9 does not properly verify the authenticity of updates which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update as demonstrated by evilgrade and DNS cache poisoning.


SpeedBit Video Acceleration before 2.2.1.8 does not properly verify the authenticity of updates which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update as demonstrated by evilgrade and DNS cache poisoning.


LinkedIn Browser Toolbar 3.0.3.1100 and earlier does not properly verify the authenticity of updates which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update as demonstrated by evilgrade and DNS cache poisoning.


Apple iTunes before 10.5.1 does not properly verify the authenticity of updates which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update as demonstrated by evilgrade and DNS cache poisoning.


setup.exe before 2.573.2.3 in Cygwin does not properly verify the authenticity of packages which allows remote Cygwin mirror servers or man-in-the-middle attackers to execute arbitrary code via a package list containing the MD5 checksum of a Trojan horse package.


WinZip before 11.0 does not properly verify the authenticity of updates which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update as demonstrated by evilgrade and DNS cache poisoning.


The NSEPA.NsepaCtrl.1 ActiveX control in nsepa.ocx in Citrix Access Gateway Enterprise Edition 8.1 before 8.1-67.7 9.0 before 9.0-70.5 and 9.1 before 9.1-96.4 attempts to validate signed DLLs by checking the certificate subject not the signature which allows man-in-the-middle attackers to execute arbitrary code via HTTP header data referencing a DLL that was signed with a crafted certificate.


Software Center in Ubuntu 11.10 11.04 10.10 does not properly validate server certificates which allows remote attackers to execute arbitrary code or obtain sensitive information via a man-in-the-middle (MITM) attack.


The User Documentation component in Apple Mac OS X through 10.6.8 uses http sessions for updates to App Store help information which allows man-in-the-middle attackers to execute arbitrary code by spoofing the http server.


ICQ 7 does not verify the authenticity of updates which allows man-in-the-middle attackers to execute arbitrary code via a crafted file that is fetched through an automatic-update mechanism.


The cupshelpers scripts in system-config-printer in Ubuntu 11.04 and 11.10 as used by the automatic printer driver download service uses an \insecure connection\ for queries to the OpenPrinting database which allows remote attackers to execute arbitrary code via a man-in-the-middle (MITM) attack that modifies packages or repositories.


Apple Mac OS X does not properly verify the authenticity of updates which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update as demonstrated by evilgrade and DNS cache poisoning.


Out-of-bounds write vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary code via syno_finder_site HTTP header.


Luxion KeyShot versions prior to 10.1 Luxion KeyShot Viewer versions prior to 10.1 Luxion KeyShot Network Rendering versions prior to 10.1 and Luxion KeyVR versions prior to 10.1 are vulnerable to an out-of-bounds read while processing project files which may allow an attacker to execute arbitrary code.

arbitrary code execution
out of bound read


CNCSoft-B Versions 1.0.0.3 and prior is vulnerable to an out-of-bounds read which may allow an attacker to execute arbitrary code.


Delta Industrial Automation CNCSoft ScreenEditor Versions 1.01.28 (with ScreenEditor Version 1.01.2) and prior are vulnerable to an out-of-bounds read while processing project files which may allow an attacker to execute arbitrary code.


FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds read which may allow an attacker to execute arbitrary code.


An Out-of-bounds Read vulnerability exists in Open Design Alliance ODA Viewer before 2022.8. Crafted data in a DWF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process


An out-of-bounds read vulnerability exists in the U3D file reading procedure in Open Design Alliance PRC SDK before 2022.10. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.


Datakit Software libraries CatiaV5_3dRead CatiaV6_3dRead Step3dRead Ug3dReadPsr Jt3dReadPsr modules in KeyShot Versions v10.1 and prior are vulnerable to an out-of-bounds read which may allow an attacker to execute arbitrary code.


Delta Electronics DOPSoft Versions 4.0.10.17 and prior are vulnerable to an out-of-bounds read which may allow an attacker to execute arbitrary code.


lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files which triggers an out-of-bounds read or write.


The lazy_bdecode function in BitTorrent bootstrap-dht (aka Bootstrap) allows remote attackers to execute arbitrary code via a crafted packet which triggers an out-of-bounds read related to \Improper Indexing.\


An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux Windows and Mac and 57.0.2987.132 for Android allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page related to Array.prototype.indexOf.


Foxit Reader before 8.2.1 and PhantomPDF before 8.2.1 have an out-of-bounds read that allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted font in a PDF document.


The asm.js implementation in Mozilla Firefox before 38.0 does not properly determine heap lengths during identification of cases in which bounds checking may be safely skipped which allows remote attackers to trigger out-of-bounds write operations and possibly execute arbitrary code or trigger out-of-bounds read operations and possibly obtain sensitive information from process memory via crafted JavaScript.


An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the \WebKit\ component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages a getWasmBufferFromValue out-of-bounds read during WebAssembly compilation.


The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the QEMU host via a mh_load_end_addr value greater than mh_bss_end_addr which triggers an out-of-bounds read or write memory access.


Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior is vulnerable to an out-of-bounds read while processing project files which may allow an attacker to execute arbitrary code.


Delta Electronics TPEditor Versions 1.97 and prior. An out-of-bounds read may be exploited by processing specially crafted project files. Successful exploitation of this vulnerability may allow an attacker to read/modify information execute arbitrary code and/or crash the application.


FPWIN Pro is vulnerable to an out-of-bounds read vulnerability when a user opens a maliciously crafted project file which may allow an attacker to remotely execute arbitrary code.


An

out-of-bounds

read/write

vulnerability

when

executing

lazily

compiled

inner

generator

functions

in

Facebook

Hermes

prior

to

commit

allows

attackers

to

potentially

execute

arbitrary

code

via

crafted

JavaScript.

Note

that

this

is

only

exploitable

if

the

application

using

Hermes

permits

evaluation

of

untrusted

JavaScript.

Hence

most

React

Native

applications

are

not

affected.


Out-of-Bounds read vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows when the gflags app is enabled allows remote attackers to execute arbitrary code via a crafted BMP image embedded in the XFA stream in a PDF document aka \Data from Faulting Address may be used as a return value starting at FOXITREADER.\


Out-of-Bounds read vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows when the gflags app is enabled allows remote attackers to execute arbitrary code via a crafted TIFF image embedded in the XFA stream in a PDF document aka \Read Access Violation starting at FoxitReader.\


Integer signedness error in Glibc before 2.13 and eglibc before 2.13 when using Supplemental Streaming SIMD Extensions 3 (SSSE3) optimization allows context-dependent attackers to execute arbitrary code via a negative length parameter to (1) memcpy-ssse3-rep.S (2) memcpy-ssse3.S or (3) memset-sse2.S in sysdeps/i386/i686/multiarch/ which triggers an out-of-bounds read as demonstrated using the memcpy function.


Out-of-bounds Read vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests.


phpMyAdmin 2.6.0-pl2 and other versions before 2.6.1 with external transformations enabled allows remote attackers to execute arbitrary commands via shell metacharacters.


vim 6.0 and 6.1 and possibly other versions allows attackers to execute arbitrary commands using the libcall feature in modelines which are not sandboxed but may be executed when vim is used to edit a malicious file as demonstrated using mutt.


Bajie HTTP JServer 0.78 and other versions before 0.80 allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTP request for a CGI program that does not exist.


kicq IRC client 1.0.0 and possibly later versions allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.


HPE Asset Manager 9.40 9.41 and 9.50 and Asset Manager CloudSystem Chargeback 9.40 allow remote attackers to execute arbitrary commands via a crafted serialized Java object related to the Apache Commons Collections (ACC) library.


xloadimage before 4.1-r2 and xli before 1.17 allows attackers to execute arbitrary commands via shell metacharacters in filenames for compressed images which are not properly quoted when calling the gunzip command.


Kiwi before 3.74.2 as used in SUSE Studio 1.1 before 1.1.4 allows attackers to execute arbitrary commands via shell metacharacters in an unspecified FileUtils function call.


kiwi before 4.98.08 as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1 allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file related to chown.


kiwi before 4.85.1 as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1 allows attackers to execute arbitrary commands as demonstrated by \double quotes in kiwi_oemtitle of .profile.\


kiwi before 4.98.05 as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1 allows attackers to execute arbitrary commands via shell metacharacters in an image name.


SpamAssassin before 3.1.3 when running with vpopmail and the paranoid (-P) switch allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username.


Super Micro SuperDoctor 5 when restrictions are not implemented in agent.cfg allows remote attackers to execute arbitrary commands via NRPE.


TimThumb 2.8.13 and WordThumb 1.07 when Webshot (aka Webshots) is enabled allows remote attackers to execute arbitrary commands via shell metacharacters in the src parameter.


The administrative web interface on Cisco DPC3939 (XB3) devices with firmware 121109aCMCST allows remote authenticated users to execute arbitrary commands via unspecified fields aka Bug ID CSCuw86170.


The administrative web interface in Cisco Hosted Collaboration Solution (HCS) 10.6(1) and earlier allows remote authenticated users to execute arbitrary commands via crafted input to unspecified fields aka Bug ID CSCut02786.


The administrative web interface on Cisco TelePresence Immersive Endpoint Devices before 1.7.4 allows remote authenticated users to execute arbitrary commands via a malformed request on TCP port 443 aka Bug ID CSCtn99724.


The administrative web interface on Cisco TelePresence Recording Server before 1.8.0 allows remote authenticated users to execute arbitrary commands via unspecified vectors aka Bug ID CSCth85804.


The administrative web interface in Cisco TelePresence Video Communication Server Expressway X8.5.2 allows remote authenticated users to execute arbitrary commands via crafted fields aka Bug ID CSCuv12531.


The administrative web interface in Cisco Prime Infrastructure (PI) before 3.1.1 allows remote authenticated users to execute arbitrary commands via crafted field values aka Bug ID CSCuy96280.


comix 3.6.4 allows attackers to execute arbitrary commands via a filename containing shell metacharacters that are not properly sanitized when executing the rar unrar or jpegtran programs.


Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/.


tpp 1.3.1 allows remote attackers to execute arbitrary commands via a --exec command in a TPP template file.


EPrints 3.4.2 allows remote attackers to execute arbitrary commands via crafted input to the verb parameter in a cgi/toolbox/toolbox URI.


IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands aka the \Web Server File Request Parsing\ vulnerability.


Snoopy allows remote attackers to execute arbitrary commands. NOTE: this vulnerability exists due to an incomplete fix for CVE-2014-5008.


Snoopy allows remote attackers to execute arbitrary commands.


phpFileManager 0.9.8 allows remote attackers to execute arbitrary commands via a crafted URL.


Terminology 0.7.0 allows remote attackers to execute arbitrary commands via escape sequences that modify the window title and then are written to the terminal a similar issue to CVE-2003-0063.


Hypermail allows remote attackers to execute arbitrary commands on a server supporting SSI via an attachment with a .shtml extension which is archived on the server and can then be executed by requesting the URL for the attachment.


Bugzilla 2.10 allows remote attackers to execute arbitrary commands via shell metacharacters in a username that is then processed by (1) the Bugzilla_login cookie in post_bug.cgi or (2) the who parameter in process_bug.cgi.


jiacrontab

allows

remote

attackers

to

execute

arbitrary

commands

via

the

crontab/task/edit?addr=localhost%3a20001

command

and

args

parameters

as

demonstrated

by

command=cat&args=/etc/passwd

in

the

POST

data.


GateOne allows remote attackers to execute arbitrary commands via shell metacharacters in the port field when attempting an SSH connection.


Perlbot 1.9.2 allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the $text variable in SpelCheck.pm or (2) the $filename variable in HTMLPlog.pm.


Pligg 2.0.3 allows remote authenticated users to execute arbitrary commands because the template editor can edit any file as demonstrated by an admin/admin_editor.php the_file=..%2Findex.php&open=Open request.


lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.


wzdftpd 0.5.4 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the SITE command.


Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.5 allows remote attackers to execute arbitrary commands via unspecified vectors aka Ref ID 31091.


Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.4 allows remote attackers to execute arbitrary commands via unspecified vectors aka Ref ID 30088.


wmtv 0.6.5 and earlier does not properly drop privileges which allows local users to execute arbitrary commands via the -e (external command) option.


bsmtpd 2.3 and earlier does not properly sanitize e-mail addresses which allows remote attackers to execute arbitrary commands.


PeaZIP 2.6.1 2.5.1 and earlier on Windows allows user-assisted remote attackers to execute arbitrary commands via a .zip archive with a .txt file whose name contains | (pipe) characters and a command.


Exim 3.22 and earlier in some configurations does not properly verify the local part of an address when redirecting the address to a pipe which could allow remote attackers to execute arbitrary commands via shell metacharacters.


speechd 0.54 and earlier with the Festival or rsynth speech synthesis package allows attackers to execute arbitrary commands via shell metacharacters.


AWStats 6.1 and other versions before 6.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtats.pl.


Lynx 2.8.5 and other versions before 2.8.6dev.15 allows remote attackers to execute arbitrary commands via (1) lynxcgi: (2) lynxexec and (3) lynxprog links which are not properly restricted in the default configuration in some environments.


gv 3.5.8 and possibly earlier versions allows remote attackers to execute arbitrary commands via shell metacharacters in the filename for (1) a PDF file or (2) a gzip file.


SecureCRT 4.0 4.1 and possibly other versions allows remote attackers to execute arbitrary commands via a telnet:// URL that uses the /F option to specify a configuration file on a samba share.


A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated local attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need administrator credentials to exploit this vulnerability.


A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated remote attacker to execute arbitrary commands with root privileges. The vulnerability is due to incorrect input validation of user-supplied data by the NX-API subsystem. An attacker could exploit this vulnerability by sending malicious HTTP or HTTPS packets to the management interface of an affected system that has the NX-API feature enabled. A successful exploit could allow the attacker to perform a command-injection attack and execute arbitrary commands with root privileges. Note: NX-API is disabled by default. MDS 9000 Series Multilayer Switches are affected running software versions prior to 8.1(1b) and 8.2(3). Nexus 3000 Series Switches are affected running software versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 3500 Platform Switches are affected running software versions prior to 7.0(3)I7(4). Nexus 2000 5500 5600 and 6000 Series Switches are affected running software versions prior to 7.3(4)N1(1). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected running software versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 7000 and 7700 Series Switches are affected running software versions prior to 7.3(3)D1(1) and 8.2(3).


A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated local attacker with administrator credentials to execute arbitrary commands on the underlying Linux operating system with the privilege level of root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability.


A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated local attacker to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. MDS 9000 Series Multilayer Switches are affected in versions prior to 6.2(27) 8.1(1b) and 8.3(1). Nexus 7000 and 7700 Series Switches are affected in versions prior to 6.2(22) 7.3(3)D1(1) and 8.2(3).


A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated local attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability.


A vulnerability in the update service of Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools for Windows could allow an authenticated local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient validation of user-supplied parameters. An attacker could exploit this vulnerability by invoking the update service command with a crafted argument. An exploit could allow the attacker to run arbitrary commands with SYSTEM user privileges. While the CVSS Attack Vector metric denotes the requirement for an attacker to have local access administrators should be aware that in Active Directory deployments the vulnerability could be exploited remotely by leveraging the operating system remote management tools. This vulnerability is fixed in Cisco Webex Meetings Desktop App Release 33.6.6 and 33.9.1 releases. This vulnerability is fixed in Cisco Webex Productivity Tools Release 33.0.7.


A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated local attacker to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. MDS 9000 Series Multilayer Switches are affected running software versions prior to 6.2(27) and 8.2(3). Nexus 3000 Series Switches are affected running software versions prior to 7.0(3)I4(9) and 7.0(3)I7(6). Nexus 3500 Platform Switches are affected running software versions prior to 6.0(2)A8(11) and 7.0(3)I7(6). Nexus 3600 Platform Switches are affected running software versions prior to 7.0(3)F3(5). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected running software versions prior to 7.0(3)I4(9) 7.0(3)I7(6). Nexus 9500 R-Series Line Cards and Fabric Modules are affected running software versions prior to 7.0(3)F3(5). Nexus 7000 and 7700 Series Switches are affected running software versions prior to 6.2(22) and 8.2(3).


A vulnerability in the Cisco Webex Teams client formerly Cisco Spark could allow an attacker to execute arbitrary commands on a targeted system. This vulnerability is due to unsafe search paths used by the application URI that is defined in Windows operating systems. An attacker could exploit this vulnerability by convincing a targeted user to follow a malicious link. Successful exploitation could cause the application to load libraries from the directory targeted by the URI link. The attacker could use this behavior to execute arbitrary commands on the system with the privileges of the targeted user if the attacker can place a crafted library in a directory that is accessible to the vulnerable system.


Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the ssid parameter.


In OpenEMR 5.0.1 and earlier an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new form.


All versions up to BD_R218V2.4 of ZTE MF920 product are impacted by command execution vulnerability. Due to some interfaces do not adequately verify parameters an attacker can execute arbitrary commands through specific interfaces.


Dell EMC RecoverPoint versions prior to 5.1.3 and RecoverPoint for VMs versions prior to 5.2.0.2 contain an OS command injection vulnerability in the installation feature of Boxmgmt CLI. A malicious boxmgmt user may potentially be able to execute arbitrary commands as root.


Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the key parameter.


Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the encryption parameter.


OKER G232V1 v1.03.02.20161129 devices provide a root terminal on a UART serial interface without proper access control. This allows attackers with physical access to interrupt the boot sequence in order to execute arbitrary commands with root privileges and conduct further attacks.


An XSS issue was discovered in handler_server_info.c in Cherokee through 1.2.104. The requested URL is improperly displayed on the About page in the default configuration of the web server and its administrator panel. The XSS in the administrator panel can be used to reconfigure the server and execute arbitrary commands.


Zen Load Balancer 3.10.1 allows remote authenticated admin users to execute arbitrary commands as root via shell metacharacters in the index.cgi?action=View_Cert certname parameter.


Artica Proxy 3.06.200056 allows remote attackers to execute arbitrary commands as root by reading the ressources/settings.inc ldap_admin and ldap_password fields using these credentials at logon.php and then entering the commands in the admin.index.php command-line field.


Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username when dynamically generating a command to schedule scans for SCCM. This allows an attacker to execute arbitrary commands on the AssetExplorer Server with NT AUTHORITY/SYSTEM privileges.


CA Automic Sysload 5.6.0 through 6.1.2 contains a vulnerability related to a lack of authentication on the File Server port that potentially allows remote attackers to execute arbitrary commands.


X-Plane before 11.41 has multiple improper path validations that could allow reading and writing files from/to arbitrary paths (or a leak of OS credentials to a remote system) via crafted network packets. This could be used to execute arbitrary commands on the system.


An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. An attacker can write arbitrary content to arbitrary files as demonstrated by CVE-2019-19458 files under the web root or .bat files that will be used with auto start. This allows an attacker to execute arbitrary commands on the server.


The Scripting and AutoUpdate functionality in Cordaware bestinformed Microsoft Windows client versions before 6.2.1.0 are affected by insecure implementations which allow remote attackers to execute arbitrary commands and escalate privileges.


IBM Spectrum Scale 4.2 and 5.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 172093.


IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) could allow a remote attacker to execute arbitrary commands on the system caused by improper validation of csv file contents. IBM X-Force ID: 157063.


Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system caused by improper validation of csv file contents. IBM X-Force ID: 165179.


IBM DB2 High Performance Unload load for LUW 6.1 6.1.0.1 6.1.0.1 IF1 6.1.0.2 6.1.0.2 IF1 and 6.1.0.1 IF2 db2hpum_debug is a setuid root binary which trusts the PATH environment variable. A low privileged user can execute arbitrary commands as root by altering the PATH variable to point to a user controlled location. When a crash is induced the trojan gdb command is executed. IBM X-Force ID: 163488.


IBM Security Guardium Data Encryption (GDE) 3.0.0.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 172084.


In MobaXterm 11.1 the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commands when the user visits a specially crafted URL. Based on the available command-line arguments of the software one can simply inject -exec to execute arbitrary commands. The additional arguments -hideterm and -exitwhendone in the payload make the attack less visible.


Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /common/user_profile.php. The affected parameter is sort_column.


CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security.


In LogMeIn join.me before 3.16.0.5505 an attacker could execute arbitrary commands on a targeted system. This vulnerability is due to unsafe search paths used by the application URI that is defined in Windows. An attacker could exploit this vulnerability by convincing a targeted user to follow a malicious link. Successful exploitation could cause the application to load libraries from the directory targeted by the URI link. The attacker could use this behavior to execute arbitrary commands on the system with the privileges of the targeted user if the attacker can place a crafted library in a directory that is accessible to the vulnerable system.


Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /adminui/history_log.php. The affected parameter is TYPE_NAME.


Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script as demonstrated by sed injection in cgi-bin/camctrl_save_profile.cgi (save parameter) and cgi-bin/ddns.cgi.


CA Performance Management 3.5.x 3.6.x before 3.6.9 and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security.


D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metacharacters in the online_firmware_check.cgi check_fw_url parameter.


Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticket_list.php and affected parameters are order0column and order0dir.


A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated local attacker to run arbitrary code with elevated privileges. The openvpn_launcher binary is setuid root. This program is called during the connection process and executes several operating system utilities to configure the system. The networksetup utility is called using relative paths. A local unprivileged user can execute arbitrary commands as root by creating a networksetup trojan which will be executed during the connection process. This is possible because the PATH environment variable is not reset prior to executing the OS utility.


A vulnerability in a CLI command related to the virtualization manager (VMAN) in Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an authenticated local attacker to execute arbitrary commands on the underlying Linux operating system with root privileges. The vulnerability is due to insufficient validation of arguments passed to a specific VMAN CLI command on an affected device. An attacker who has valid administrator access to an affected device could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to run arbitrary commands on the underlying operating system with root privileges which may lead to complete system compromise.


A vulnerability in the web UI of the Cisco Firepower Management Center (FMC) could allow an authenticated remote attacker to inject arbitrary commands that are executed with the privileges of the root user of the underlying operating system. The vulnerability is due to insufficient validation of user-supplied input to the web UI. An attacker could exploit this vulnerability by submitting crafted input in the web UI. A successful exploit could allow an attacker to execute arbitrary commands on the device with full root privileges.


An issue was discovered on D-Link DAP-1650 devices before 1.04B02_J65H Hot Fix. Attackers can execute arbitrary commands.


A vulnerability in a Virtualization Manager (VMAN) related CLI command of Cisco IOS XE Software could allow an authenticated local attacker to execute arbitrary commands on the underlying Linux operating system with a privilege level of root. The vulnerability is due to insufficient validation of arguments passed to a specific VMAN CLI command on the affected device. An attacker who has administrator access to an affected device could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges which may lead to complete system compromise.


A vulnerability in a CLI command related to the virtualization manager (VMAN) in Cisco NX-OS Software could allow an authenticated local attacker to execute arbitrary commands on the underlying Linux operating system with root privileges. The vulnerability is due to insufficient validation of arguments passed to a specific VMAN CLI command on an affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with root privileges which may lead to complete system compromise. An attacker would need valid administrator credentials to exploit this vulnerability.


In Webmin through 1.910 any user authorized to the \Package Updates\ module can execute arbitrary commands with root privileges via the data parameter to update.cgi.


A vulnerability in Viber before 10.7.0 for Desktop (Windows) could allow an attacker to execute arbitrary commands on a targeted system. This vulnerability is due to unsafe search paths used by the application URI. An attacker could exploit this vulnerability by convincing a targeted user to follow a malicious link. Successful exploitation could cause the application to load libraries from the directory targeted by the URI link. The attacker could use this behavior to execute arbitrary commands on the system with the privileges of the targeted user if the attacker can place a crafted library in a directory that is accessible to the vulnerable system.


A vulnerability in the Java deserialization function used by Cisco Security Manager could allow an unauthenticated remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to a specific listener on an affected system. A successful exploit could allow the attacker to execute arbitrary commands on the device with the privileges of casuser.


In Rancher 2 through 2.2.3 Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container.


im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the \exec\ argument. The cmd argument used within index.js can be controlled by user without any sanitization.


network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the \execSync()\ argument.


im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the \exec\ argument. It is possible to inject arbitrary commands as part of the metadata options which is given to the \exec\ function.


A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions) SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19) SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11) SIMATIC PCS 7 V9.0 (All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11) SIMATIC WinCC (TIA Portal) V13 (All versions) SIMATIC WinCC (TIA Portal) V14 (All versions < V14 SP1 Upd 9) SIMATIC WinCC (TIA Portal) V15 (All versions < V15.1 Upd 3) SIMATIC WinCC Runtime Professional V13 (All versions) SIMATIC WinCC Runtime Professional V14 (All versions < V14.1 Upd 8) SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Upd 3) SIMATIC WinCC V7.2 and earlier (All versions) SIMATIC WinCC V7.3 (All versions < V7.3 Upd 19) SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 11) SIMATIC WinCC V7.5 (All versions < V7.5 Upd 3). An authenticatd attacker with network access to the DCOM interface could execute arbitrary commands with SYSTEM privileges. The vulnerability could be exploited by an attacker with network access to the affected system. Successful exploitation requires authentication with a low-privileged user account and no user interaction. An attacker could use the vulnerability to compromise confidentiality and integrity and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.


The

Linux

Foundation

ONOS

SDN

Controller

and

earlier

versions

is

affected

by:

Improper

Input

Validation.

The

impact

is:

A

remote

attacker

can

execute

arbitrary

commands

on

the

controller.

The

component

is:

The

attack

vector

is:

network

connectivity.

The

fixed

version

is:


The EnGenius EWS660AP router with firmware 2.0.284 allows an attacker to execute arbitrary commands using the built-in ping and traceroute utilities by using different payloads and injecting multiple parameters. This vulnerability is fixed in a later firmware version.


The

MediaTek

Embedded

Multimedia

Card

(eMMC)

subsystem

for

Android

on

and

SoC

devices

allows

attackers

to

execute

arbitrary

commands

as

root

via

shell

metacharacters

in

a

filename

under

/data

because

in

invokes

'system(\/system/bin/rm

-r

/data/'

followed

by

this

filename

upon

an

eMMC

clearance

from

a

Meta

Mode

boot.

NOTE:

compromise

of

Fire

OS

on

the

Amazon

Echo

Dot

would

require

a

second

hypothetical

vulnerability

that

allows

creation

of

the

required

file

under

/data.


A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to the presence of development testing and verification scripts that remained on the device. An attacker could exploit this vulnerability by accessing the physical interface of a device and inserting a USB storage device. A successful exploit could allow the attacker to execute scripts on the device in an elevated security context.


A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges.


An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Due to lack of input validation in the cmd_sys_traceroute_exec() cmd_sys_arp_clear() and cmd_sys_ping_exec() functions in the libclicmd.so library contained in the firmware an attacker could leverage these functions to call system() and execute arbitrary commands on the switches. (Note that these functions are currently not called in this version of the firmware however an attacker could use other vulnerabilities to finally use these vulnerabilities to gain code execution.)


A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated remote attacker with administrative privileges to inject arbitrary commands into the underlying operating system. When processed the commands will be executed with root privileges. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by providing malicious input to a specific field in the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system as the root user.


A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. The vulnerability is due to insufficient restrictions during the execution of an affected CLI command. An attacker could exploit this vulnerability by leveraging the insufficient restrictions to modify sensitive files. A successful exploit could allow the attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root.


A vulnerability in the CLI of Cisco Unity Express could allow an authenticated local attacker to inject arbitrary commands that are executed with root privileges. To exploit this vulnerability an attacker would need valid administrator credentials. The vulnerability is due to improper input validation for certain CLI commands that are executed on a vulnerable system. An attacker could exploit this vulnerability by logging in to the system and sending crafted CLI commands. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root.


A flaw was found in ghostscript versions prior to 9.50 in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system or execute arbitrary commands.


An issue was discovered in Microvirt MEmu all versions prior to 7.0.2. A guest Android operating system inside the MEmu emulator contains a /system/bin/systemd binary that is run with root privileges on startup (this is unrelated to Red Hat's systemd init program and is a closed-source proprietary tool that seems to be developed by Microvirt). This program opens TCP port 21509 presumably to receive installation-related commands from the host OS. Because everything after the installer:uninstall command is concatenated directly into a system() call it is possible to execute arbitrary commands by supplying shell metacharacters.


A flaw was found in all ghostscript versions 9.x before 9.50 in the .setuserparams2 procedure where it did not properly secure its privileged calls enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system or execute arbitrary commands.


A flaw was found in ghostscript versions 9.x before 9.50 in the setsystemparams procedure where it did not properly secure its privileged calls enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system or execute arbitrary commands.


A flaw was found in ghostscript versions prior to 9.50 in the .pdfexectoken and other procedures where it did not properly secure its privileged calls enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system or execute arbitrary commands.


A vulnerability exists in the way that iTerm2 integrates with tmux's control mode which may allow an attacker to execute arbitrary commands by providing malicious output to the terminal. This affects versions of iTerm2 up to and including 3.3.5. This vulnerability may allow an attacker to execute arbitrary commands on their victim's computer by providing malicious output to the terminal. It could be exploited using command-line utilities that print attacker-controlled content.


Norton Core prior to v278 may be susceptible to an arbitrary code execution issue which is a type of vulnerability that has the potential of allowing an individual to execute arbitrary commands or code on a target machine or in a target process. Note that this exploit is only possible with direct physical access to the device.


SoftNAS Cloud 4.2.0 and 4.2.1 allows remote command execution. The NGINX default configuration file has a check to verify the status of a user cookie. If not set a user is redirected to the login page. An arbitrary value can be provided for this cookie to access the web interface without valid user credentials. If customers have not followed SoftNAS deployment best practices and expose SoftNAS StorageCenter ports directly to the internet this vulnerability allows an attacker to gain access to the Webadmin interface to create new users or execute arbitrary commands with administrative privileges compromising both the platform and the data.


An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the ntp_server parameter in an ntp_sync.cgi POST request.


NUUO Network Video Recorder Firmware 1.7.x through 3.3.x allows unauthenticated attackers to execute arbitrary commands via shell metacharacters to handle_load_config.php.


Tenda PA6 Wi-Fi Powerline extender 1.0.1.21 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted string an attacker could modify the device name of an attached PLC adapter to inject and execute arbitrary commands on the system with root privileges.


The BPM component in Genius Bytes Genius Server (Genius CDDS) 3.2.2 allows remote authenticated users to execute arbitrary commands.


An attacker may be able to bypass the OS application filter meant to restrict applications that can be executed by changing browser preferences to launch a separate process that in turn can execute arbitrary commands.


A shell injection vulnerability on the Sophos Cyberoam firewall appliance with CyberoamOS before 10.6.6 MR-6 allows remote attackers to execute arbitrary commands via the Web Admin and SSL VPN consoles.


python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.


libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.


The automatic screen lock functionality in GNOME Shell (aka gnome-shell) before 3.10 does not prevent access to the \Enter a Command\ dialog which allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation.


scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands.


The message function in lib/webbynode/notify.rb in the Webbynode gem 1.0.5.3 and earlier for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a growlnotify message.


The \runshellscript echo.sh\ script in Splunk before 5.0.5 allows remote authenticated users to execute arbitrary commands via a crafted string. NOTE: this issue was SPLIT from CVE-2013-6771 per ADT2 due to different vulnerability types.


The ping functionality in cgi-bin/diagnostic.cgi on Seowon Intech SWC-9100 routers allows remote attackers to execute arbitrary commands via shell metacharacters in the ping_ipaddr parameter.


McAfee Email Gateway 7.6 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the value attribute in a (1) TestFile XML element or the (2) hostname. NOTE: this issue can be combined with CVE-2013-7092 to allow remote attackers to execute commands.


js/ui/screenShield.js in GNOME Shell (aka gnome-shell) before 3.8 allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation with the keyboard focus on the Activities search.


canto_curses/guibase.py in Canto Curses before 0.9.0 allows remote feed servers to execute arbitrary commands via shell metacharacters in a URL in a feed.


The get_main_source_dir function in scripts/uscan.pl in devscripts before 2.13.8 when using USCAN_EXCLUSION allows remote attackers to execute arbitrary commands via shell metacharacters in a directory name.


The codem-transcode module before 0.5.0 for Node.js when ffprobe is enabled allows remote attackers to execute arbitrary commands via a POST request to /probe.


McAfee Email Gateway 7.6 allows remote authenticated administrators to execute arbitrary commands by specifying them in the value attribute in a (1) Command or (2) Script XML element. NOTE: this issue can be combined with CVE-2013-7092 to allow remote attackers to execute commands.


An unspecified RFC function in SAP CCMS Agent allows remote attackers to execute arbitrary commands via unknown vectors.


The handle_request function in lib/HTTPServer.pm in Monitorix before 3.3.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the URI.


Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to execute arbitrary commands via shell metacharacters in the ip parameter to backupmgt/getAlias.php.


McAfee Email Gateway (MEG) 7.0 before 7.0.4 and 7.5 before 7.5.1 allows remote authenticated users to execute arbitrary commands via unspecified vectors.


jsdm/ajax/port.php in J-Web in Juniper Junos before 10.4R13 11.4 before 11.4R7 12.1 before 12.1R5 12.2 before 12.2R3 and 12.3 before 12.3R1 allows remote authenticated users to execute arbitrary commands via the rsargs parameter in an exec action.


The unpack_zip function in archive_unpacker.rb in the sprout gem 0.7.246 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a (1) filename or (2) path.


CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) sector size or (2) skip count fields for the forensic imaging task.


admin/confnetworking.html in PineApp Mail-SeCure allows remote attackers to execute arbitrary commands via shell metacharacters in the pinghost parameter during a ping operation.


Zabbix before 1.8.19rc1 2.0 before 2.0.10rc1 and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execute arbitrary commands via a newline in a flexible user parameter.


delivery.php in the Passive Capture Application (PCA) web console in IBM Tealeaf CX 7.x 8.x through 8.6 8.7 before FP2 and 8.8 before FP2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the testconn_host parameter.


index.php in Softaculous Webuzo before 2.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in a SOFTCookies sid cookie within a login action.


admin/confnetworking.html in PineApp Mail-SeCure 3.70 and earlier on 5099SK and earlier platforms allows remote attackers to execute arbitrary commands via shell metacharacters in the nsserver parameter during an nslookup operation.


The repository import feature in gitlab-shell before 1.7.4 as used in GitLab allows remote authenticated users to execute arbitrary commands via the import URL.


plain/actionsets.html in the SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.5 allows remote authenticated users to execute arbitrary commands via a task with a command.value field in conjunction with an arguments.value field.


lib/sup/message_chunks.rb in Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the content_type of an email attachment.


The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3 as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the public key.


Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.


The Grit gem for Ruby as used in GitLab 5.2 before 5.4.1 and 6.x before 6.2.3 allows remote authenticated users to execute arbitrary commands as demonstrated by the search box for the GitLab code search feature.


The self.run_gpg function in lib/rgpg/gpg_helper.rb in the rgpg gem before 0.2.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.


The send_the_mail function in server/svr_mail.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 4.2.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the email (-M switch) to qsub.


VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a 2.7 2.7RC1 and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in the extension parameter in an OriginateVDRelogin action to manager_send.php.


ajax.cgi in the web interface on the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem allows remote attackers to execute arbitrary commands via shell metacharacters in the pip parameter in an Ajax tag_ipPing request a different vulnerability than CVE-2013-3581.


Ajaxeplorer

before

allows

remote

attackers

to

execute

arbitrary

commands

via

shell

metacharacters

in

the

parameter

to

the

Power

FS

module

(plugins/action.powerfs/class.PowerFSController.php)

a

file

name

to

the

getTrustSizeOnFileSystem

function

in

the

File

System

(Standard)

module

(plugins/access.fs/class.fsAccessWrapper.php)

or

the

revision

parameter

to

the

Subversion

Repository

module

(plugins/meta.svn/class.SvnManager.php).


The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object related to recursive variable interpolation.


core/getLog.php on the Siemens Enterprise OpenScape Branch appliance and OpenScape Session Border Controller (SBC) before 2 R0.32.0 and 7 before 7 R1.7.0 allows remote attackers to execute arbitrary commands via unspecified vectors.


The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to end-user/index.php.


ServerAdmin/TestTelnetConnection.jsp in DS3 Authentication Server allows remote authenticated users to execute arbitrary commands via shell metacharacters in the HOST_NAME field.


git_http_controller.rb in the redmine_git_hosting plugin for Redmine allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the service parameter to info/refs related to the get_info_refs function or (2) the reqfile argument to the file_exists function.


The Agent (aka AgentController) servlet in HP ProCurve Manager (PCM) 3.20 and 4.0 PCM+ 3.20 and 4.0 and Identity Driven Manager (IDM) 4.0 allows remote attackers to execute arbitrary commands via a HEAD request aka ZDI-CAN-1745.


The guestfish command in libguestfs 1.20.12 1.22.7 and earlier when using the --remote or --listen option does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.


cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by calling the system method in the body of a request as demonstrated by running unauthorized services changing directory permissions and modifying files.


The runShellCmd function in systemCheck.htm in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500 DSR-500N DSR-1000 and DSR-1000N with firmware before 1.08B77 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) \Ping or Trace an IP Address\ or (2) \Perform a DNS Lookup\ section.


The Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to execute arbitrary commands via a get_userid action with shell metacharacters in the username parameter.


The diagnostic module in the firmware on Cisco Virtualization Experience Client 6000 devices allows local users to bypass intended access restrictions and execute arbitrary commands via unspecified vectors aka Bug ID CSCug68407.


lib/sounder/sound.rb in the sounder gem 1.0.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.


The license-installation module on the Cisco Nexus 1000V switch 4.2(1)SV1(5.2b) and earlier for VMware vSphere Cisco Nexus 1000V switch 5.2(1)SM1(5.1) for Microsoft Hyper-V and Cisco Virtual Security Gateway 4.2(1)VSG1(1) for Nexus 1000V switches allows local users to gain privileges and execute arbitrary commands via crafted \install all iso\ arguments aka Bug ID CSCui21340.


lib/dragonfly/imagemagickutils.rb in the fog-dragonfly gem 0.8.2 for Ruby allows remote attackers to execute arbitrary commands via unspecified vectors.


The Network Analysis tab (Main_Analysis_Content.asp) in the ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the Target field (destIP parameter).


The web framework in Cisco Identity Services Engine (ISE) 1.0 and 1.1.0 before 1.1.0.665-5 1.1.1 before 1.1.1.268-7 1.1.2 before 1.1.2.145-10 1.1.3 before 1.1.3.124-7 1.1.4 before 1.1.4.218-7 and 1.2 before 1.2.0.899-2 allows remote authenticated users to execute arbitrary commands via a crafted session on TCP port 443 aka Bug ID CSCuh81511.


The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title which activates the commands when the user clicks on the xmobar window title as demonstrated using an action tag.


converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.


mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.


The uploadFile function in upload/index.php in CosCMS before 1.822 allows remote administrators to execute arbitrary commands via shell metacharacters in the name of an uploaded file.


The extract_from_ocr function in lib/docsplit/text_extractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename.


The JAR files on Cisco Device Manager for Cisco MDS 9000 devices before 5.2.8 and Cisco Device Manager for Cisco Nexus 5000 devices allow remote attackers to execute arbitrary commands on Windows client machines via a crafted element-manager.jnlp file aka Bug IDs CSCty17417 and CSCty10802.


(1) snmp.php and (2) rrd.php in Cacti before 0.8.8b allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.


kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) document.rb (2) video.rb or (3) video_image.rb.


Spree

Commerce

through

allows

remote

authenticated

administrators

to

instantiate

arbitrary

Ruby

objects

and

execute

arbitrary

commands

via

the

parameter

to

and

the

parameter

to

parameter

to

and

parameter

to

in

promo/app/controllers/spree/admin/

related

to

unsafe

use

of

the

constantize

function.


lib/thumbshooter.rb in the Thumbshooter 0.1.5 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.


lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in (1) an mp3 URL or (2) file name.


command_wrap.rb in the command_wrap Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL or filename.


IRIS citations management tool through 1.3 allows remote attackers to execute arbitrary commands.


cgi-bin/pingping.cgi on QNAP VioStor NVR devices with firmware 4.0.3 and in the Surveillance Station Pro component in QNAP NAS allows remote authenticated users to execute arbitrary commands by leveraging guest access and placing shell metacharacters in the query string.


includes/functions.php in ZoneMinder Video Server 1.24.0 1.25.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.


ping.php in Global Console Manager 16 (GCM16) and Global Console Manager 32 (GCM32) before 1.20.0.22575 on the IBM Avocent 1754 KVM switch allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) count or (2) size parameter.


The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands.


The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrary commands via a DCP \run command\ operation.


The NDVM in Citrix XenClient XT before 2.1.3 and 3.x before 3.1.4 allows remote attackers to execute arbitrary commands by using the UIVM to create a network connection.


Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary commands.


Sophos Web Appliance before 3.7.8.2 allows (1) remote attackers to execute arbitrary commands via shell metacharacters in the client-ip parameter to the Block page when using the user_workstation variable in a customized template and remote authenticated users to execute arbitrary commands via shell metacharacters in the (2) url parameter to the Diagnostic Tools functionality or (3) entries parameter to the Local Site List functionality.


lib/entry_controller.rb in the fastreader Gem 1.0.8 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.


cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130 TL-SC3130G TL-SC3171 TL-SC3171G and possibly other models before beta firmware LM.1.6.18P12_sign6 allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the ServerName parameter and (2) other unspecified parameters.


The password reset feature in Courion Access Risk Management Suite Version 8 Update 9 allows remote authenticated users to bypass intended Internet Explorer usage restrictions and execute arbitrary commands by using keyboard shortcuts to navigate the file system and open a command prompt.


lib/mini_magick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.


in

Subversion

before

allows

remote

authenticated

users

with

commit

permissions

to

execute

arbitrary

commands

via

shell

metacharacters

in

a

filename.


The set_meta_data function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the file name of an email attachment. NOTE: some of these details are obtained from third party information.


Emerson Process Management ROC800 RTU with software 3.50 and earlier DL8000 RTU with software 2.30 and earlier and ROC800L RTU with software 1.20 and earlier allows remote attackers to execute arbitrary commands via a TCP replay attack.


The download_from_url function in OpenShift Origin allows remote attackers to execute arbitrary commands via shell metacharacters in the URL of a request to download a cart.


lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.


The Cybozu Live application before 2.0.1 for Android allows remote attackers to execute arbitrary Java methods and obtain sensitive information or execute arbitrary commands via a crafted web site. NOTE: this vulnerability exists because of a CVE-2012-4008 regression.


The web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013 7.5 before 7.5.0-838 and 7.7 before 7.7.0-550; Email Security Appliance devices before 7.1.5-104 7.3 before 7.3.2-026 7.5 before 7.5.2-203 and 7.6 before 7.6.3-019; and Content Security Management Appliance devices before 7.2.2-110 7.7 before 7.7.0-213 and 7.8 and 7.9 before 7.9.1-102 allows remote authenticated users to execute arbitrary commands via crafted command-line input in a URL aka Bug IDs CSCzv85726 CSCzv44633 and CSCzv24579.


SAP BASIS Communication Services 4.6B through 7.30 allows remote authenticated users to execute arbitrary commands via unspecified vectors.


The LG Hidden Menu component for Android on the LG Optimus G E973 allows physically proximate attackers to execute arbitrary commands by entering USB Debugging mode using Android Debug Bridge (adb) to establish a USB connection dialing 3845#*973# modifying the WLAN Test Wi-Fi Ping Test/User Command tcpdump command string and pressing the CANCEL button.


The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC* H8DG* H8SCM-F H8SGL-F H8SM* X7SP* X8DT* X8SI* X9DAX-* X9DB* X9DR* X9QR* X9SBAA-F X9SC* X9SPU-F and X9SR* devices allows remote authenticated users to execute arbitrary commands via shell metacharacters as demonstrated by the IP address field in config_date_time.cgi.


cgi-bin/performance/perfchart.cgi in the Performance component in GroundWork Monitor Enterprise 6.7.0 does not properly restrict XML content which allows remote attackers to execute arbitrary commands by creating a .shtml file and leveraging Server Side Includes (SSI) functionality.


TRENDnet TEW-812DRU router allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) wan network prefix to internet/ipv6.asp; (2) remote port to adm/management.asp; (3) pptp username (4) pptp password (5) ip (6) gateway (7) l2tp username or (8) l2tp password to internet/wan.asp; (9) NtpDstStart (10) NtpDstEnd or (11) NtpDstOffset to adm/time.asp; or (12) device url to adm/management.asp. NOTE: vectors 9 10 and 11 can be exploited by unauthenticated remote attackers by leveraging CVE-2013-3098.


The license-installation module in Cisco NX-OS on Nexus 1000V devices allows local users to execute arbitrary commands via crafted \install license\ arguments aka Bug ID CSCuh30824.


monarch_scan.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands and consequently obtain sensitive information by leveraging a JOSSO SSO cookie.


The EAP-FAST authentication module in Cisco Secure Access Control Server (ACS) 4.x before 4.2.1.15.11 when a RADIUS server configuration is enabled does not properly parse user identities which allows remote attackers to execute arbitrary commands via crafted EAP-FAST packets aka Bug ID CSCui57636.


Unspecified vulnerability in SOAP Gateway in IBM IMS Enterprise Suite 1.1 2.1 and 2.2 allows remote authenticated users to execute arbitrary commands via unknown vectors.


ginkgosnmp.inc in HP System Management Homepage (SMH) allows remote authenticated users to execute arbitrary commands via shell metacharacters in the PATH_INFO to smhutil/snmpchp.php.en.


html/System-Files.php in the System File Overview feature in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands via vectors involving file editing.


An unspecified function in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(2) allows remote authenticated users to execute arbitrary commands via unknown vectors aka Bug ID CSCuh73440.


The Cron service in rpc.php in OpenMediaVault allows remote authenticated users to execute cron jobs as arbitrary users and execute arbitrary commands via the username parameter.


The web framework in Cisco WAAS Software before 4.x and 5.x before 5.0.3e 5.1.x before 5.1.1c and 5.2.x before 5.2.1; Cisco ACNS Software 4.x and 5.x before 5.5.29.2; Cisco ECDS Software 2.x before 2.5.6; Cisco CDS-IS Software 2.x before 2.6.3.b50 and 3.1.x before 3.1.2b54; Cisco VDS-IS Software 3.2.x before 3.2.1.b9; Cisco VDS-SB Software 1.x before 1.1.0-b96; Cisco VDS-OE Software 1.x before 1.0.1; and Cisco VDS-OS Software 1.x in central-management mode allows remote authenticated users to execute arbitrary commands by appending crafted strings to values in GUI fields aka Bug IDs CSCug40609 CSCug48855 CSCug48921 CSCug48872 CSCuh21103 CSCuh21020 and CSCug56790.


** DISPUTED ** Atlassian Crowd 2.6.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to a \symmetric backdoor.\ NOTE: as of 20130704 the vendor could not reproduce the issue stating \We've been unable to substantiate the existence of CVE-2013-3926. The author of the article has not contacted Atlassian and has provided no detail making it difficult to validate the claim... If we can confirm that there is a vulnerability a patch will be issued.\


The web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013 7.5 before 7.5.0-838 and 7.7 before 7.7.0-550 allows remote authenticated users to execute arbitrary commands via crafted command-line input in a URL sent over IPv4 aka Bug ID CSCzv69294.


html/System-NeDi.php in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the scan functionality in the System / NeDi menu.


Adobe Digital Editions 4.5.11.187646 (and earlier) are affected by an arbitrary command execution vulnerability. An authenticated attacker could leverage this vulnerability to execute arbitrary commands. User interaction is required to abuse this vulnerability in that a user must open a maliciously crafted .epub file.


IBM Planning Analytics 2.0 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system caused by improper validation of csv file contents. IBM X-Force ID: 208396.


IBM FileNet Content Manager 5.5.4 5.5.6 and 5.5.7 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 212346.


A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands as root via shell metacharacters in the filename parameter to assets/index.php.


SAP Business One - version 10.0 allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitation during the data export. An attacker could thereby execute arbitrary commands on the victim's computer but only if the victim allows to execute macros while opening the file and the security settings of Excel allow for command execution.


Xerox

Phaser

before

and

(Bridge)

WorkCentre

before

and

(Bridge)

VersaLink

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

have

a

remote

Command

Execution

vulnerability

in

the

Web

User

Interface

that

allows

remote

attackers

with

\a

weaponized

clone

file\

to

execute

arbitrary

commands.


Because of a incorrect escaped exec command in MagpieRSS in 0.72 in the /extlib/Snoopy.class.inc file it is possible to add a extra command to the curl binary. This creates an issue on the /scripts/magpie_debug.php and /scripts/magpie_simple.php page that if you send a specific https url in the RSS URL field you are able to execute arbitrary commands.


Xerox

Phaser

before

and

(Bridge)

WorkCentre

before

and

(Bridge)

VersaLink

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

allows

remote

attackers

with

\a

weaponized

clone

file\

to

execute

arbitrary

commands

in

the

Web

User

Interface.


IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system caused by improper validation of csv file contents. IBM X-Force ID: 199403.


A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality integrity as well as system availability.


Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities see the Details section of this advisory.


A vulnerability in the user account management system of Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an authenticated local attacker to elevate their privileges to root. This vulnerability is due to a procedural flaw in the password generation algorithm. An attacker could exploit this vulnerability by enabling specific Administrator-only features and connecting to the appliance through the CLI with elevated privileges. A successful exploit could allow the attacker to execute arbitrary commands as root and access the underlying operating system. To exploit this vulnerability the attacker must have valid Administrator credentials.


Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. These vulnerabilities are due to insufficient restrictions during the execution of affected CLI commands. An attacker could exploit these vulnerabilities by leveraging the insufficient restrictions during execution of these commands. A successful exploit could allow the attacker to elevate privileges from dnasadmin and execute arbitrary commands on the underlying operating system as root.


A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated local attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device that is running in multi-instance mode. This vulnerability is due to insufficient validation of user-supplied command arguments. An attacker could exploit this vulnerability by submitting crafted input to the affected command. A successful exploit could allow the attacker to execute commands on the underlying operating system with root privileges.


A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated local attacker to execute arbitrary commands on the underlying operating system as the root user. The attacker must be authenticated on the affected device as a low-privileged user to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by injecting arbitrary commands to a file as a lower-privileged user. The commands are then executed on the device by the root user. A successful exploit could allow the attacker to execute arbitrary commands as the root user.


A vulnerability in the web UI of Cisco Modeling Labs could allow an authenticated remote attacker to execute arbitrary commands with the privileges of the web application on the underlying operating system of an affected Cisco Modeling Labs server. This vulnerability is due to insufficient validation of user-supplied input to the web UI. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected server. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the web application virl2 on the underlying operating system of the affected server. To exploit this vulnerability the attacker must have valid user credentials on the web UI.


A vulnerability in ConfD could allow an authenticated local attacker to execute arbitrary commands at the level of the account under which ConfD is running which is commonly root. To exploit this vulnerability an attacker must have a valid account on an affected device. The vulnerability exists because the affected software incorrectly runs the SFTP user service at the privilege level of the account that was running when the ConfD built-in Secure Shell (SSH) server for CLI was enabled. If the ConfD built-in SSH server was not enabled the device is not affected by this vulnerability. An attacker with low-level privileges could exploit this vulnerability by authenticating to an affected device and issuing a series of commands at the SFTP interface. A successful exploit could allow the attacker to elevate privileges to the level of the account under which ConfD is running which is commonly root. Note: Any user who can authenticate to the built-in SSH server may exploit this vulnerability. By default all ConfD users have this access if the server is enabled. Software updates that address this vulnerability have been released.


A vulnerability in the web-based management interface of Cisco Small Business RV160 RV160W RV260 RV260P and RV260W VPN Routers could allow an unauthenticated remote attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on an affected device using root-level privileges. Due to the nature of the vulnerability only commands without parameters can be executed.


A local privilege escalation vulnerability in telnetd.real of Juniper Networks Junos OS may allow a locally authenticated shell user to escalate privileges and execute arbitrary commands as root. telnetd.real is shipped with setuid permissions enabled and is owned by the root user allowing local users to run telnetd.real with root privileges. This issue affects Juniper Networks Junos OS: all versions prior to 15.1R7-S9; 17.3 versions prior to 17.3R3-S11; 17.4 versions prior to 17.4R2-S12 17.4R3-S3; 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R3-S6; 18.3 versions prior to 18.3R2-S4 18.3R3-S4; 18.4 versions prior to 18.4R2-S7 18.4R3-S6; 19.1 versions prior to 19.1R2-S2 19.1R3-S4; 19.2 versions prior to 19.2R1-S6 19.2R3-S1; 19.3 versions prior to 19.3R3-S1; 19.4 versions prior to 19.4R2-S2 19.4R3; 20.1 versions prior to 20.1R1-S4 20.1R2; 20.2 versions prior to 20.2R2.


This affects the package kill-by-port before 0.0.2. If (attacker-controlled) user input is given to the killByPort function it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.


A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. This issue also affects installations of the VRM DIVAR IP BVMS with VRM installed the VIDEOJET decoder (VJD-7513 and VJD-8000).


This affects all versions of package kill-process-by-name. If (attacker-controlled) user input is given it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization in the index.js file.


Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions which will cause attackers to execute arbitrary commands remotely (RCE).


This affects all versions of package onion-oled-js. If attacker-controlled user input is given to the scroll function it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.


This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.


Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions which will cause attackers to execute arbitrary commands remotely(RCE).


This affects all versions of package wincred. If attacker-controlled user input is given to the getCredential function it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.


This affects all versions of package port-killer. If (attacker-controlled) user input is given it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will cause the command touch success to be executed leading to the creation of a file called success.


This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.


This affects the package killport before 1.0.2. If (attacker-controlled) user input is given it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will cause the command touch success to be executed leading to the creation of a file called success.


This affects all versions of package ps-kill. If (attacker-controlled) user input is given to the kill function it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization in the index.js file. PoC (provided by reporter): var ps_kill = require('ps-kill'); ps_kill.kill('$(touch success)' function(){});


This affects the package portprocesses before 1.0.5. If (attacker-controlled) user input is given to the killProcess function it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.


This affects all versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certain operating systems it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.


Linux users running Lens 5.2.6 and earlier could be compromised by visiting a malicious website. The malicious website could make websocket connections from the victim's browser to Lens and so operate the local terminal feature. This would allow the attacker to execute arbitrary commands as the Lens user.


A vulnerability in the CLI of Cisco IOS XE SD-WAN Software and Cisco IOS XE Software could allow an authenticated local attacker to execute arbitrary commands with elevated privileges on an affected device. This vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input in the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands with elevated privileges on the underlying operating system. An attacker would need valid user credentials to exploit this vulnerability.


Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated local attacker to gain access to the underlying root shell of an affected device and execute arbitrary commands with root privileges. For more information about these vulnerabilities see the Details section of this advisory.


An unauthenticated attacker with physical access to a computer with NetSetMan Pro before 5.0 installed that has the pre-logon profile switch button within the Windows logon screen enabled is able to drop to an administrative shell and execute arbitrary commands as SYSTEM via the \save log to file\ feature. To accomplish this the attacker can navigate to cmd.exe.


Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated local attacker to execute arbitrary commands with root privileges. For more information about these vulnerabilities see the Details section of this advisory.