A vulnerability in the AppDynamics .NET Agent for Windows could allow an attacker to leverage an authenticated local user account to gain SYSTEM privileges. This vulnerability is due to the .NET Agent Coordinator Service executing code with SYSTEM privileges. An attacker with local access to a device that is running the vulnerable agent could create a custom process that would be launched with those SYSTEM privileges. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system. This vulnerability is fixed in AppDynamics .NET Agent Release 21.7.


An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex ATP and VPN series firmware versions 4.35 through 5.01 which could allow a remote attacker to execute arbitrary commands on an affected device.


An authenticated attacker can execute arbitrary commands as root in Terramaster F4-210 F2-210 TOS 4.2.X (4.2.15-2107141517) by injecting a maliciously crafted input in the request through /tos/index.php?app/hand_app.


Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions.


The specific function of HR Portal of Soar Cloud System accepts any type of object to be deserialized. Attackers can send malicious serialized objects to execute arbitrary commands.


IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 199184.


Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote authenticated attacker to execute arbitrary commands with SYSTEM privileges.


IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 195766.


A

flaw

was

found

in

the

OpenShift

Installer

before

version

During

installation

of

OpenShift

Container

Platform

clusters

bootstrap

nodes

are

provisioned

with

anonymous

authentication

enabled

on

kubelet

port

A

remote

attacker

able

to

reach

this

port

during

installation

can

make

unauthenticated

`/exec`

requests

to

execute

arbitrary

commands

within

running

containers.

The

highest

threat

from

this

vulnerability

is

to

data

confidentiality

and

integrity

as

well

as

system

availability.


The management interface of BenQ smart wireless conference projector does not properly control user's privilege. Attackers can access any system directory of this device through the interface and execute arbitrary commands if he enters the local subnetwork.


Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4 Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.


Dell PowerScale OneFS 8.1.0 - 9.1.0 contains a privilege escalation in SmartLock compliance mode that may allow compadmin to execute arbitrary commands as root.


A conference management system of ZTE is impacted by a command execution vulnerability. Since the soapmonitor's java object service is enabled by default the attacker could exploit this vulnerability to execute arbitrary commands by sending a deserialized payload to port 5001.


QSAN SANOS factory reset function does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0.


WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter.


Gerapy is a distributed crawler management framework. Prior to version 0.9.9 an authenticated user could execute arbitrary commands. This issue is fixed in version 0.9.9. There are no known workarounds.


The QSAN SANOS setting page does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0.


QuickInstall in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and execute arbitrary commands. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3.


QsanTorture in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and execute arbitrary commands. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3.


Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiPortal 6.0.0 through 6.0.4 5.3.0 through 5.3.5 5.2.0 through 5.2.5 and 4.2.2 and earlier may allow an attacker with regular user's privileges to execute arbitrary commands on the underlying SQL database via specifically crafted HTTP requests.


OpenMage Magento LTS is an alternative to the Magento CE official releases. Prior to versions 19.4.15 and 20.0.11 layout XML enabled admin users to execute arbitrary commands via block methods. The latest OpenMage Versions up from v19.4.15 and v20.0.11 have this Issue patched.


An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name when exported as excel file and opened unsafely on the victim host.


Multiple improper neutralization of special elements used in an OS command vulnerabilities (CWE-78) in the Web GUI of FortiWAN before 4.5.9 may allow an authenticated attacker to execute arbitrary commands on the underlying system's shell via specifically crafted HTTP requests.


MashZone

NextGen

through

GA

allows

a

remote

authenticated

user

with

access

to

the

admin

console

to

upload

a

new

JDBC

driver

that

can

execute

arbitrary

commands

on

the

underlying

host.

This

occurs

in

com.idsscheer.ppmmashup.business.jdbc.DriverUploadController.


SQL injection vulnerability was discovered in Aanderaa GeoView Webservice prior to version 2.1.3 that could allow an unauthenticated attackers to execute arbitrary commands.


A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabilities in the AirWave web-base management interface could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system leading to partial system compromise.


A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabilities in the AirWave CLI could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to full system compromise.


A deserialization vulnerability exists in how the ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.


A deserialization vulnerability exists in how the AosService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.


Realtek xPON RTL9601D SDK 1.9 stores passwords in plaintext which may allow attackers to possibly gain access to the device with root permissions via the build-in network monitoring tool and execute arbitrary commands.


A deserialization vulnerability exists in how the LogService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.


The api/zrDm/set_ZRElink interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the bssaddr abiaddr devtoken devid elinksync or elink_proc_enable parameter.


The api/zrDm/set_zrDm interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the dm_enable AppKey or Pwd parameter.


The api/ZRFirmware/set_time_zone interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the zonename parameter.


The api/ZRAndlink/set_ZRAndlink interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the iandlink_proc_enable parameter.


The api/ZRIGMP/set_MLD_PROXY interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the MLD_PROXY_WAN_CONNECT parameter.


The api/ZRIGMP/set_IGMP_PROXY interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the IGMP_PROXY_WAN_CONNECT parameter.


The api/ZRIptv/setIptvInfo interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the iptv_vlan parameter.


A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated remote attacker with administrative privileges to inject arbitrary commands into the underlying operating system and execute them using root-level privileges. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious input to a specific field in the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system as a user with root-level privileges.


The bna_pass program in Optivity NETarchitect uses the PATH environmental variable for finding the \rm\ program which allows local users to execute arbitrary commands.


A backdoor password in Cart32 3.0 and earlier allows remote attackers to execute arbitrary commands.


xpdf PDF viewer client earlier than 0.91 does not properly launch a web browser for embedded URL's which allows an attacker to execute arbitrary commands via a URL that contains shell metacharacters.


libedit searches for the .editrc file in the current directory instead of the user's home directory which may allow local users to execute arbitrary commands by installing a modified .editrc in another directory.


The default configuration of Big Brother 1.4h2 and earlier does not include proper access restrictions which allows remote attackers to execute arbitrary commands by using bbd to upload a file whose extension will cause it to be executed as a CGI script by the web server.


The window.showHelp() method in Internet Explorer 5.x does not restrict HTML help files (.chm) to be executed from the local host which allows remote attackers to execute arbitrary commands via Microsoft Networking.


The mailto CGI script allows remote attacker to execute arbitrary commands via shell metacharacters in the emailadd form field.


A default ECL in Lotus Notes before 5.02 allows remote attackers to execute arbitrary commands by attaching a malicious program in an email message that is automatically executed when the user opens the email.


uagentsetup in ARCServeIT Client Agent 6.62 does not properly check for the existence or ownership of a temporary file which is moved to the agent.cfg configuration file which allows local users to execute arbitrary commands by modifying the temporary file before it is moved.


The process_bug.cgi script in Bugzilla allows remote attackers to execute arbitrary commands via shell metacharacters.


Linux tmpwatch --fuser option allows local users to execute arbitrary commands by creating files whose names contain shell metacharacters.


pgxconfig in the Raptor GFX configuration tool uses a relative path name for a system call to the \cp\ program which allows local users to execute arbitrary commands by modifying their path to point to an alternate \cp\ program.


Horde library 1.02 allows attackers to execute arbitrary commands via shell metacharacters in the \from\ address.


ISC DHCP client program dhclient allows remote attackers to execute arbitrary commands via shell metacharacters.


The passwd.php3 CGI script in the Red Hat Piranha Virtual Server Package allows local users to execute arbitrary commands via shell metacharacters.


mopd (Maintenance Operations Protocol loader daemon) does not properly cleanse user-injected format strings which allows remote attackers to execute arbitrary commands.


The view_page.html sample page in the MiniVend shopping cart program allows remote attackers to execute arbitrary commands via shell metacharacters.


The

administration

module

in

Sun

Java

web

server

allows

remote

attackers

to

execute

arbitrary

commands

by

uploading

Java

code

to

the

module

and

invoke

the

com.sun.server.http.pagecompile.jsp92.JspServlet

by

requesting

a

URL

that

begins

with

a

/servlet/

tag.


The Panda Antivirus console on port 2001 allows local users to execute arbitrary commands without authentication via the CMD command.


Telnetd telnet server in IRIX 5.2 through 6.1 does not properly cleans user-injected format strings which allows remote attackers to execute arbitrary commands via a long RLD variable in the IAC-SB-TELOPT_ENVIRON request.


IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root and possibly execute arbitrary commands via malformed URLs that contain UNICODE encoded characters aka the \Web Server Folder Traversal\ vulnerability.


Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings which allows local attackers to execute arbitrary commands via functions such as gettext and catopen.


The registry entry for the Windows Shell executable (Explorer.exe) in Windows NT and Windows 2000 uses a relative path name which allows local users to execute arbitrary commands by inserting a Trojan Horse named Explorer.exe into the %Systemdrive% directory aka the \Relative Shell Path\ vulnerability.


The Mail Merge tool in Microsoft Word does not prompt the user before executing Visual Basic (VBA) scripts in an Access database which could allow an attacker to execute arbitrary commands.


The CGI counter 4.0.7 by George Burgyan allows remote attackers to execute arbitrary commands via shell metacharacters.


The BizDB CGI script bizdb-search.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the dbname parameter.


sshd program in the Rapidstream 2.1 Beta VPN appliance has a hard-coded \rsadmin\ account with a null password which allows remote attackers to execute arbitrary commands via ssh.


When a Microsoft Office 2000 document is launched the directory of that document is first used to locate DLL's such as riched20.dll and msi.dll which could allow an attacker to execute arbitrary commands by inserting a Trojan Horse DLL into the same directory as the document.


PHP 3 and 4 do not properly cleanse user-injected format strings which allows remote attackers to execute arbitrary commands by triggering error messages that are improperly written to the error logs.


Mailman 1.1 allows list administrators to execute arbitrary commands via shell metacharacters in the %(listname) macro expansion.


Auction Weaver CGI script 1.02 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the fromfile parameter.


The unsetenv function in glibc 2.1.1 does not properly unset an environmental variable if the variable is provided twice to a program which could allow local users to execute arbitrary commands in setuid programs by specifying their own duplicate environmental variables such as LD_PRELOAD or LD_LIBRARY_PATH.


The default installation of VirusScan 4.5 and NetShield 4.5 has insecure permissions for the registry key that identifies the AutoUpgrade directory which allows local users to execute arbitrary commands by replacing SETUP.EXE in that directory with a Trojan Horse.


The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string which allows remote attackers to execute arbitrary commands via the SITE EXEC command.


The calender.pl and the calendar_admin.pl calendar scripts by Matt Kruse allow remote attackers to execute arbitrary commands via shell metacharacters.


Vulnerability in bbd server in Big Brother System and Network Monitor allows an attacker to execute arbitrary commands.


Internet Explorer 5.x does not warn a user before opening a Microsoft Access database file that is referenced within ActiveX OBJECT tags in an HTML document which could allow remote attackers to execute arbitrary commands aka the \IE Script\ vulnerability.


Pine 4.x allows a remote attacker to execute arbitrary commands via an index.html file which executes lynx and obtains a uudecoded file from a malicious web server which is then executed by Pine.


Mediahouse Statistics Server 5.02x allows remote attackers to execute arbitrary commands via a long HTTP GET request.


bbd server in Big Brother System and Network Monitor before 1.5c2 allows remote attackers to execute arbitrary commands via the \&\ shell metacharacter.


IRC Xchat client versions 1.4.2 and earlier allows remote attackers to execute arbitrary commands by encoding shell metacharacters into a URL which XChat uses to launch a web browser.


DNSTools CGI applications allow remote attackers to execute arbitrary commands via shell metacharacters.


Heap overflow in savestr function in LBNL traceroute 1.4a5 and earlier allows a local user to execute arbitrary commands via the -g option.


The web GUI for the Linux Virtual Server (LVS) software in the Red Hat Linux Piranha package has a backdoor password that allows remote attackers to execute arbitrary commands.


The cvsweb CGI script in CVSWeb 1.80 allows remote attackers with write access to a CVS repository to execute arbitrary commands via shell metacharacters.


Pine before version 4.21 does not properly filter shell metacharacters from URLs which allows remote attackers to execute arbitrary commands via a malformed URL.


Kootenay Web KW Whois 1.0 CGI program allows remote attackers to execute arbitrary commands via shell metacharacters in the \whois\ parameter.


MultiHTML CGI script allows remote attackers to read arbitrary files and possibly execute arbitrary commands by specifying the file name to the \multi\ parameter.


The web configuration interface for Catalyst 3500 XL switches allows remote attackers to execute arbitrary commands without authentication when the enable password is not set via a URL containing the /exec/ directory.


Microsoft Excel 97 and 2000 allows an attacker to execute arbitrary commands by specifying a malicious .dll using the Register.ID function aka the \Excel REGISTER.ID Function\ vulnerability.


quikstore.cgi in Quikstore Shopping Cart allows remote attackers to execute arbitrary commands via shell metacharacters in the URL portion of an HTTP GET request.


modprobe in the modutils 2.3.x package on Linux systems allows a local user to execute arbitrary commands via shell metacharacters.


Bill Kendrick web site guestbook (GBook) allows remote attackers to execute arbitrary commands via shell metacharacters in the _MAILTO form variable.


pollit.cgi in Poll It 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the poll_options parameter.


Microsoft Virtual Machine (VM) in Internet Explorer 4.x and 5.x allows an unsigned applet to create and use ActiveX controls which allows a remote attacker to bypass Internet Explorer's security settings and execute arbitrary commands via a malicious web page or email aka the \Microsoft VM ActiveX Component\ vulnerability.


eWave ServletExec 3.0C and earlier does not restrict access to the UploadServlet Java/JSP servlet which allows remote attackers to upload files and execute arbitrary commands.


crontab by Paul Vixie uses predictable file names for a temporary file and does not properly ensure that the file is owned by the user executing the crontab -e command which allows local users with write access to the crontab spool directory to execute arbitrary commands by creating world-writeable temporary files and modifying them while the victim is editing the file.


iCal 2.1 Patch 2 installs many files with world-writeable permissions which allows local users to modify the iCal configuration and execute arbitrary commands by replacing the iplncal.sh program with a Trojan horse.


clamav-milter in ClamAV before 0.91.2 when run in black hole mode allows remote attackers to execute arbitrary commands via shell metacharacters that are used in a certain popen call involving the \recipient field of sendmail.\


pygrub (tools/pygrub/src/GrubConf.py) in Xen 3.0.3 when booting a guest domain allows local users with elevated privileges in the guest domain to execute arbitrary commands in domain 0 via a crafted grub.conf file whose contents are used in exec statements.


Multiple argument injection vulnerabilities in Netscape Navigator 9 allow remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metacharacters in a (1) mailto (2) nntp (3) news (4) snews or (5) telnet URI a similar issue to CVE-2007-3670.


Argument injection vulnerability in Mozilla Firefox before 2.0.0.5 when running on systems with Thunderbird 1.5 installed and certain URIs registered allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a mailto URI which are inserted into the command line that is created when invoking Thunderbird.exe a similar issue to CVE-2007-3670.


The cmdjob utility in Autodesk Backburner 3.0.2 allows remote attackers to execute arbitrary commands on render servers by queueing jobs that contain these commands. NOTE: this is only a vulnerability in environments in which the administrator has not followed documentation that outlines the security risks of operating Backburner on untrusted networks.


The ewirePC_Decrypt function in ewirepcfunctions.php in eWire Payment Client (ePC) 1.60 and 1.70 allows remote attackers to execute arbitrary commands via shell metacharacters in the paymentinfo parameter to simplePHPLinux/3payment_receive.php.


Mozilla Firefox before 2.0.0.8 Thunderbird before 2.0.0.8 and SeaMonkey before 1.1.5 allows remote attackers to execute arbitrary commands via a (1) mailto (2) nntp (3) news or (4) snews URI with invalid \%\ encoding related to improper file type handling on Windows XP with Internet Explorer 7 installed a variant of CVE-2007-3845.


The win32std extension in PHP 5.2.3 does not follow safe_mode and disable_functions restrictions which allows remote attackers to execute arbitrary commands via the win_shell_execute function.


Argument injection vulnerability in Apple QuickTime 7.2 for Windows XP SP2 and Vista allows remote attackers to execute arbitrary commands via a URL in the qtnext field in a crafted QTL file. NOTE: this issue may be related to CVE-2006-4965 or CVE-2007-5045.


Argument injection vulnerability involving Mozilla when certain URIs are registered allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in an unspecified URI which are inserted into the command line when invoking the handling process a similar issue to CVE-2007-3670.


email_in.pl in Bugzilla 2.23.4 through 3.0.0 allows remote attackers to execute arbitrary commands via the -f (From address) option to the Email::Send::Sendmail function probably involving shell metacharacters.


The default configuration of Centre for Speech Technology Research (CSTR) Festival 1.95 beta (aka 2.0 beta) on Gentoo Linux SUSE Linux and possibly other distributions is run locally with elevated privileges without requiring authentication which allows local and remote attackers to execute arbitrary commands via the local daemon on port 1314 a different vulnerability than CVE-2001-0956. NOTE: this issue is local in some environments but remote on others.


Multiple argument injection vulnerabilities in Mozilla Firefox 2.0.0.5 and 3.0alpha allow remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metacharacters in a (1) mailto (2) nntp (3) news (4) snews or (5) telnet URI a similar issue to CVE-2007-3670.


Argument injection vulnerability involving Microsoft Outlook and Outlook Express when certain URIs are registered allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in an unspecified URI which are inserted into the command line when invoking the handling process a similar issue to CVE-2007-3670.


Argument injection vulnerability in Apple QuickTime 7.1.5 and earlier when running on systems with Mozilla Firefox before 2.0.0.7 installed allows remote attackers to execute arbitrary commands via a QuickTime Media Link (QTL) file with an embed XML element and a qtnext parameter containing the Firefox \-chrome\ argument. NOTE: this is a related issue to CVE-2006-4965 and the result of an incomplete fix for CVE-2007-3670.


GUI.pm in yarssr 0.2.2 when Gnome default URL handling is disabled allows remote attackers to execute arbitrary commands via shell metacharacters in a link element in a feed.


hpssd in Hewlett-Packard Linux Imaging and Printing Project (hplip) 1.x and 2.x before 2.7.10 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a from address which is not properly handled when invoking sendmail.


Unspecified vulnerability in Webmin before 1.370 on Windows allows remote authenticated users to execute arbitrary commands via a crafted URL.


Unspecified vulnerability in Sun Fire X2100 M2 and X2200 M2 Embedded Lights Out Manager (ELOM) on x86 before firmware 2.70 allows remote attackers to execute arbitrary commands as root on the Service Processor (SP) via unspecified vectors a different vulnerability than CVE-2007-5170.


kb_whois.cgi in K+B-Bestellsystem (aka KB-Bestellsystem) allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) domain or (2) tld parameter in a check_owner action.


showCode.php in xml2owl 0.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter.


Anon Proxy Server 0.100 and probably 0.101 allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the host parameter to diagdns.php and (2) the host parameter and possibly (3) the port parameter to diagconnect.php a different vulnerability than CVE-2007-6460.


unp 1.0.12 and other versions before 1.0.14 does not properly escape file names which might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument. NOTE: this might only be a vulnerability when unp is invoked by a third party product.


registry.pl in Fonality Trixbox 2.0 PBX products when running in certain environments reads and executes a set of commands from a remote web site without sufficiently validating the origin of the commands which allows remote attackers to disable trixbox and execute arbitrary commands via a DNS spoofing attack.


core/spellcheck/spellcheck.php in Fundanemt before 2.2.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the dict parameter.


admin/config.php in the music-on-hold module in freePBX 2.2.x allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the del parameter.


The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function when the \username map script\ smb.conf option is enabled and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.


The get_url function in DODS_Dispatch.pm for the CGI_server in OPeNDAP 3 allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.


BES before 3.5.0 in OPeNDAP 4 (Hydrax) before 1.2.1 does not properly handle compressed files which allows remote attackers to upload arbitrary files or execute arbitrary commands via a crafted compressed file.


AFFLIB 2.2.8 and earlier allows attackers to execute arbitrary commands via shell metacharacters involving (1) certain command line parameters in tools/afconvert.cpp and (2) arguments to the get_parameter function in aimage/ident.cpp. NOTE: it is unknown if the get_parameter vector (2) is ever called.


The parseIrcUrl function in src/kvirc/kernel/kvi_ircurl.cpp in KVIrc 3.2.0 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in an (1) irc:// or (2) irc6:// URI.


Eval injection vulnerability in (1) courier-imapd.indirect and (2) courier-pop3d.indirect in Courier-IMAP before 4.0.6-r2 and 4.1.x before 4.1.2-r1 on Gentoo Linux allows remote attackers to execute arbitrary commands via the XMAILDIR variable related to the LOGINRUN variable.


The VCDAPILibApi ActiveX control in vc9api.DLL 9.0.0.57 in Virtual CD 9.0.0.2 allows remote attackers to execute arbitrary commands via a command line in the first argument to the VCDLaunchAndWait function.


The launch method in the LocalExec ActiveX control (LocalExec.ocx) in Novell exteNd Director 4.1 and Portal Services allows remote attackers to execute arbitrary commands.


gfax 0.4.2 and probably other versions creates temporary files insecurely which allows local users to execute arbitrary commands via unknown vectors.


Argument injection vulnerability in Microsoft Internet Explorer when running on systems with SeaMonkey installed and certain URIs registered allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a mailto URI which are inserted into the command line that is created when invoking SeaMonkey.exe a related issue to CVE-2007-3670.


Apple Safari Beta 3.0.1 for Windows allows remote attackers to execute arbitrary commands via shell metacharacters in a URI in the SRC of an IFRAME as demonstrated using a gopher URI.


Argument injection vulnerability in Microsoft Internet Explorer when running on systems with Firefox installed and certain URIs registered allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1) FirefoxURL or (2) FirefoxHTML URI which are inserted into the command line that is created when invoking firefox.exe. NOTE: it has been debated as to whether the issue is in Internet Explorer or Firefox. As of 20070711 it is CVE's opinion that IE appears to be failing to properly delimit the URL argument when invoking Firefox and this issue could arise with other protocol handlers in IE as well. However Mozilla has stated that it will address the issue with a \defense in depth\ fix that will \prevent IE from sending Firefox malicious data.\


Incomplete blacklist vulnerability in cgi-bin/runDiagnostics.cgi in the web interface on the Yoggie Pico and Pico Pro allows remote attackers to execute arbitrary commands via shell metacharacters in the param parameter as demonstrated by URL encoded \`\ (backtick) characters (%60 sequences).


The DBAsciiAccess CGI Script in the web interface in Fujitsu-Siemens Computers ServerView before 4.50.09 allows remote attackers to execute arbitrary commands via shell metacharacters in the Servername subparameter of the ParameterList parameter.


The terminal_helper_execute function in terminal/terminal.c in Xfce Terminal 0.2.6 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a crafted link as demonstrated using the \Open Link\ functionality.


The Menu Manager Mod for (1) web-app.net WebAPP (aka WebAPP NE) 0.9.9.3.3 through 0.9.9.8 and (2) web-app.org WebAPP before 0.9.9.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the titles of items in a personal menu.


Mozilla Firefox before 2.0.0.6 Thunderbird before 1.5.0.13 and 2.x before 2.0.0.6 and SeaMonkey before 1.1.4 allow remote attackers to execute arbitrary commands via certain vectors associated with launching \a file handling program based on the file extension at the end of the URI \ a variant of CVE-2007-4041. NOTE: the vendor states that \it is still possible to launch a filetype handler based on extension rather than the registered protocol handler.\


The G/PGP (GPG) Plugin 2.0 and 2.1dev before 20060912 for Squirrelmail allows remote attackers to execute arbitrary commands via shell metacharacters in the messageSignedText parameter to the gpg_check_sign_pgp_mime function in gpg_hook_functions.php. NOTE: a parameter value can be set in the contents of an e-mail message.


Unspecified vulnerability in the G/PGP (GPG) Plugin 2.0 for Squirrelmail 1.4.10a allows remote authenticated users to execute arbitrary commands via unspecified vectors possibly related to the passphrase variable in the gpg_sign_attachment function aka ZD-00000004. this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes but duplicates with other CVEs are difficult to determine.


Argument injection vulnerability in Microsoft Internet Explorer when running on systems with Netscape installed and certain URIs registered allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a -chrome argument to the navigatorurl URI which are inserted into the command line that is created when invoking netscape.exe a related issue to CVE-2007-3670. NOTE: there has been debate about whether the issue is in Internet Explorer or Netscape. As of 20070713 it is CVE's opinion that IE appears to not properly delimit the URL argument when invoking Netscape; this issue could arise with other protocol handlers in IE.


masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.


The (1) session_save_path (2) ini_set and (3) error_log functions in PHP 4.4.7 and earlier and PHP 5 5.2.3 and earlier when invoked from a .htaccess file allow remote attackers to bypass safe_mode and open_basedir restrictions and possibly execute arbitrary commands as demonstrated using (a) php_value (b) php_flag and (c) directives in .htaccess.


hook.c in BitchX 1.1-final allows remote IRC servers to execute arbitrary commands by sending a client certain data containing NICK and EXEC strings which exceeds the bounds of a hash table and injects an EXEC hook function that receives and executes shell commands.


VShieldCheck in McAfee VirusScan for Mac (Virex) before 7.7 patch 1 allow local users to change permissions of arbitrary files via a symlink attack on /Library/Application Support/Virex/VShieldExclude.txt as demonstrated by symlinking to the root crontab file to execute arbitrary commands.


The Run function in SolidWorks sldimdownload ActiveX control in sldimdownload.dll before 16.0.0.6 allows remote attackers to execute arbitrary commands via the (1) installerpath and (2) applicationarguments arguments.


Plash permits sandboxed processes to open /dev/tty which allows local users to escape sandbox restrictions and execute arbitrary commands by sending characters to a shell process on the same termimal via the TIOCSTI ioctl.


WordPress 2.1.1 as downloaded from some official distribution sites during February and March 2007 contains an externally introduced backdoor that allows remote attackers to execute arbitrary commands via (1) an eval injection vulnerability in the ix parameter to wp-includes/feed.php and (2) an untrusted passthru call in the iz parameter to wp-includes/theme.php.


The Network Analysis Module (NAM) in Cisco Catalyst Series 6000 6500 and 7600 allows remote attackers to execute arbitrary commands via certain SNMP packets that are spoofed from the NAM's own IP address.


The command line administration interface in Data Domain OS before 4.0.3.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in certain arguments to various commands as demonstrated by the interface argument to the (1) ifconfig and (2) ping commands.


OpenOffice.org (OOo) Office Suite allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a prepared link in a crafted document.


Unspecified vulnerability in kcms_calibrate in Sun Solaris 8 and 9 before 20071122 allows local users to execute arbitrary commands via unknown vectors.


bin/compile-messages.py in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function which allows attackers to execute arbitrary commands via shell metacharacters in a (1) .po or (2) .mo file.


plugins/scmcvs/www/cvsweb.php in the CVSWeb CGI in GForge 4.5.16 before 20070524 aka gforge-plugin-scmcvs allows remote attackers to execute arbitrary commands via shell metacharacters in the PATH_INFO.


The DWUpdateService ActiveX control in the agent (agent.exe) in Macrovision FLEXnet Connect 6.0 and Update Service 3.x to 5.x allows remote attackers to execute arbitrary commands via (1) the Execute method and obtain the exit status using (2) the GetExitCode method.


The MicroWorld Agent service (MWAGENT.EXE) in MicroWorld Technologies eScan 8.0.671.1 and possibly other versions allows remote or local attackers to gain privileges and execute arbitrary commands by connecting directly to TCP port 2222.


Git before 1.8.5.6 1.9.x before 1.9.5 2.0.x before 2.0.5 2.1.x before 2.1.4 and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint (2) a git~1/config representation or (3) mixed case that is improperly handled on a case-insensitive filesystem.


Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to execute arbitrary commands via shell metacharacters in the ping field (setobject_ip parameter).


The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command.


AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter to cgi-bin/webcm.


Phoenix Contact ProConOs and MultiProg do not require authentication which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.


The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.


The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddr parameter to zhnping.cmd.


Lantronix xPrintServer does not properly restrict access to ips/ which allows remote attackers to execute arbitrary commands via the c parameter in an rpc action.


The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the i4w_trace parameter. NOTE: this can be leveraged with CVE-2014-8948 to allow remote attackers to execute code. NOTE: it is not clear whether this issue itself crosses privileges.


The WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) $backup'filepath' (aka \Path to Backup:\ field) or (2) $backup'mysqldumppath' variable.


SAP Document Management Services allows local users to execute arbitrary commands via unspecified vectors.


The SAP CRM Internet Sales module allows remote attackers to execute arbitrary commands via unspecified vectors.


cgi/utility.cgi in Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point allows remote authenticated users to execute arbitrary commands via shell metacharacters in the pinghost parameter to ping.cgi.


default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.


The fetch_url function in usr.bin/ftp/fetch.c in tnftp as used in NetBSD 5.1 through 5.1.4 5.2 through 5.2.2 6.0 through 6.0.6 and 6.1 through 6.1.5 allows remote attackers to execute arbitrary commands via a | (pipe) character at the end of an HTTP redirect.


The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65 iDRAC6 monolithic before 1.98 and iDRAC7 before 1.57.57 does not properly select session ID values which makes it easier for remote attackers to execute arbitrary commands via a brute-force attack.


Bugzilla before 4.0.16 4.1.x and 4.2.x before 4.2.12 4.3.x and 4.4.x before 4.4.7 and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a two-argument Perl open call as demonstrated by shell metacharacters in a product name.


ovirt_safe_delete_config in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0-474-gb852fd7 as packaged in Red Hat Enterprise Virtualization 3 do not properly quote input strings which allows remote authenticated users and physically proximate attackers to execute arbitrary commands via a ; (semicolon) in an input string.


costview3/xmlrpc_server/xmlrpc.php in CostView in Caldera 9.20 allows remote attackers to execute arbitrary commands via shell metacharacters in a methodCall element in a PHP XMLRPC request.


expand.c in Exim before 4.83 expands mathematical comparisons twice which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value.


kcleanup.cpp in KDirStat 2.7.0 does not properly quote strings when deleting a directory which allows remote attackers to execute arbitrary commands via a \ (double quote) character in the directory name a different vulnerability than CVE-2014-2528.


lib/string_utf_support.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) downloaded_file or (2) url variable.


CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine (HHVM) before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \\n (newline) character before the end of a string.


cups-browsed in cups-filters 1.0.41 before 1.0.51 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the (1) model or (2) PDL related to \System V interface scripts generated for queues.\


The iControl API in F5 BIG-IP LTM APM ASM GTM Link Controller and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1 BIG-IP AAM 11.4.0 through 11.5.1 BIG-IP AFM and PEM 11.3.0 through 11.5.1 BIG-IP Analytics 11.0.0 through 11.5.1 BIG-IP Edge Gateway WebAccelerator WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0 Enterprise Manager 2.1.0 through 2.3.0 and 3.0.0 through 3.1.1 and BIG-IQ Cloud Device and Security 4.0.0 through 4.3.0 allows remote administrators to execute arbitrary commands via shell metacharacters in the hostname element in a SOAP request.


EMC Documentum Content Server before 6.7 SP1 P28 6.7 SP2 before P14 7.0 before P15 and 7.1 before P05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to unspecified methods.


The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter.


XCloner Standalone 3.5 and earlier when enable_db_backup and sql_mem are enabled allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the dbbackup_comp parameter in a generate action to index2.php. NOTE: it is not clear whether this issue crosses privilege boundaries since administrators might already have the privileges to execute code. NOTE: this can be leveraged by remote attackers using CVE-2014-2579.


lib/sfpagent/bsig.rb in the sfpagent gem before 0.4.15 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the module name in a JSON request.


GKSu 2.0.2 when sudo-mode is not enabled uses \ (double quote) characters in a gksu-run-helper argument which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument as demonstrated by an untrusted filename encountered during installation of a VirtualBox extension pack.


** DISPUTED ** Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as \expected behavior.\ Also this issue can only occur when the administrator enables the \dont_blame_nrpe\ option in nrpe.conf despite the \HIGH security risk\ warning within the comments.


lib/rrd.php in Cacti 0.8.7g 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters.


kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory which allows remote attackers to execute arbitrary commands via a ' (single quote) character in the directory name a different vulnerability than CVE-2014-2527.


The network-diagnostics administration interface in the Cisco RV router firmware on RV220W devices before 1.0.5.9 on RV120W devices and before 1.0.4.14 on RV180 and RV180W devices allows remote authenticated users to execute arbitrary commands via a crafted HTTP request aka Bug ID CSCuh87126.


TIBCO Enterprise Administrator 1.0.0 and Enterprise Administrator SDK 1.0.0 do not properly enforce administrative authentication requirements which allows remote attackers to execute arbitrary commands via unspecified vectors.


The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files which allows local users to execute arbitrary commands via a temporary file with a predictable name.


lib/graph_export.php in Cacti 0.8.7g 0.8.8b and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors.


The management console in Aruba Networks ClearPass Policy Manager 6.3.0.60730 allows local users to execute arbitrary commands via shell metacharacters in certain arguments of a valid command as demonstrated by the (1) system status-rasession and (2) network ping commands.


logViewer.htm on the Dell ML6000 tape backup system with firmware before i8.2.0.2 (641G.GS103) and the Quantum Scalar i500 tape backup system with firmware before i8.2.2.1 (646G.GS002) allows remote attackers to execute arbitrary commands via shell metacharacters in a pathname parameter.


The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allow local users to execute arbitrary commands via a symlink attack on a temporary file with a predictable name.


Ruby vSphere Console (RVC) in VMware vCenter Server Appliance allows remote authenticated users to execute arbitrary commands as root by escaping from a chroot jail.


The

userRequest

servlet

in

the

Admin

Center

for

Tivoli

Storage

Manager

in

Rocket

Servergraph

allows

remote

attackers

to

execute

arbitrary

commands

via

a

auth

add

remove

runAsync

or

tsmRequest

command.


Unitrends Enterprise Backup 7.3.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the comm parameter to recoveryconsole/bpl/snmpd.php.


cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url ending with a (1) .tar.gz (2) .zip (3) .tgz or (4) .tar file extension in a cartridge manifest file.


wpa_supplicant and hostapd 0.7.2 through 2.2 when running with certain configurations and using wpa_cli or hostapd_cli with action scripts allows remote attackers to execute arbitrary commands via a crafted frame.


Unity before 7.2.1 as used in Ubuntu 14.04 does not properly handle keyboard shortcuts which allows physically proximate attackers to bypass the lock screen and execute arbitrary commands as demonstrated by right-clicking on the indicator bar and then pressing the ALT and F2 keys.


The DHCP client implementation in Universal Small Cell firmware on Cisco Small Cell products allows remote attackers to execute arbitrary commands via crafted DHCP messages aka Bug ID CSCup47513.


config/userAdmin/login.tdf in Infoblox NetMRI before 6.8.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the skipjackUsername parameter.


The printDirect function in lib/printer.js in the node-printer module 0.0.1 and earlier for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in the lpr command.


GetPermissions.asp in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary commands via unspecified vectors.


The

av-centerd

SOAP

service

in

AlienVault

OSSIM

before

allows

remote

attackers

to

execute

arbitrary

commands

via

a

crafted

or

request

a

different

vulnerability

than


Unity before 7.2.1 as used in Ubuntu 14.04 does not properly restrict access to the Dash when the lock screen is active which allows physically proximate attackers to bypass the lock screen and execute arbitrary commands as demonstrated by pressing the SUPER key before the screen auto-locks.


displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) session_id or (2) template_id parameter related to the command_line variable.


Unspecified vulnerability in Juniper Junos Space before 13.3R1.8 when the firewall in disabled allows remote attackers to execute arbitrary commands via unspecified vectors.


Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932 possibly JpegImagePlugin.py.


The CTIManager module in Cisco Unified Communications Manager (CM) 10.0(1) when single sign-on is enabled does not properly validate Kerberos SSO tokens which allows remote authenticated users to gain privileges and execute arbitrary commands via crafted token data aka Bug ID CSCum95491.


Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafted Calc spreadsheet.


The Agent Control Interface in the management server in Symantec Critical System Protection (SCSP) 5.2.9 before MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x before 6.0 MP1 allows remote authenticated users to execute arbitrary commands by leveraging client-system access to upload a log file.


The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.


The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to execute arbitrary commands via the cmd parameter to functions/ezpz-archive-cmd.php.


rxvt-unicode before 9.20 does not properly handle OSC escape sequences which allows user-assisted remote attackers to manipulate arbitrary X window properties and execute arbitrary commands.


systest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the lpres parameter.


The

function

in

Eyou

Mail

System

before

allows

remote

attackers

to

execute

arbitrary

commands

via

shell

metacharacters

in

the

domain

parameter

to


FitNesse Wiki 20131110 20140201 and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page.


The administrative interface in Allied Telesis AT-RG634A ADSL Broadband router 3.3+ iMG624A firmware 3.5 iMG616LH firmware 2.4 and iMG646BD firmware 3.5 allows remote attackers to gain privileges and execute arbitrary commands via a direct request to cli.html.


The

bashMail

function

in

in

SkyBlueCanvas

CMS

before

when

the

pid

parameter

is

allows

remote

attackers

to

execute

arbitrary

commands

via

shell

metacharacters

in

the

name

email

subject

or

message

parameter

to

index.php.


MediaWiki 1.22.x before 1.22.2 1.21.x before 1.21.5 and 1.19.x before 1.19.11 when DjVu or PDF file upload support is enabled allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.


The CGI component in Cybozu Garoon 3.1.0 through 3.7 SP3 allows remote attackers to execute arbitrary commands via unspecified vectors.


The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetch_boot_file.


The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors.


The Cisco WAP4410N access point with firmware through 2.0.6.1 WRVS4400N router with firmware 1.x through 1.1.13 and 2.x through 2.0.2.1 and RVS4000 router with firmware through 2.0.3.2 allow remote attackers to read credential and configuration data and execute arbitrary commands via requests to the test interface on TCP port 32764 aka Bug IDs CSCum37566 CSCum43693 CSCum43700 and CSCum43685.


The admin terminal in Hawt.io does not require authentication which allows remote attackers to execute arbitrary commands via the k parameter.


reportbug before 6.4.4+deb7u1 and 6.5.x before 6.5.0+nmu1 allows remote attackers to execute arbitrary commands via vectors related to compare_versions and reportbug/checkversions.py.


The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location.


Cisco Prime Infrastructure 1.2 and 1.3 before 1.3.0.20-2 1.4 before 1.4.0.45-2 and 2.0 before 2.0.0.0.294-2 allows remote authenticated users to execute arbitrary commands with root privileges via an unspecified URL aka Bug ID CSCum71308.


The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands via unspecified vectors.


Xangati XSR before 11 and XNR before 7 allows remote attackers to execute arbitrary commands via shell metacharacters in a gui_input_test.pl params parameter to servlet/Installer.


The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs which allows context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file.


The generate_local_queue function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the host name. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.


Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in outputs/.


The installPackage function in the installerHelper subcomponent in Libmacgpg in GPG Suite before 2015.06 allows local users to execute arbitrary commands with root privileges via shell metacharacters in the xmlPath argument.


pfSense before 2.1.4 allows remote authenticated users to execute arbitrary commands via (1) the hostname value to diag_dns.php in a Create Alias action (2) the smartmonemail value to diag_smart.php or (3) the database value to status_rrd_graph_img.php.


The MKDQUOTESAFE function in the Fan-out driver scripts in Fan-Out Platform Services in Novell Identity Manager (aka IDM) 4.0.2 allows local users to execute arbitrary commands by leveraging eDirectory POSIX attribute changes to insert shell metacharacters.


Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1) blame (2) file or (3) stats page as demonstrated by requests to blame/master/ master/ and stats/master/.


LPAR2RRD in 3.5 and earlier allows remote attackers to execute arbitrary commands due to insufficient input sanitization of the web GUI parameters.


Repository.php in Gitter as used in Gitlist allows remote attackers with commit privileges to execute arbitrary commands via shell metacharacters in a branch name as demonstrated by a \git checkout -b\ command.


The graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size related to the rrdtool commandline in lib/rrd.php.


admin/options/logs.php in Status2k allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the Location field in Add Logs in the Admin Panel.


Aruba Networks ClearPass before 6.3.5 and 6.4.x before 6.4.1 allows remote attackers to execute arbitrary commands via unspecified vectors a different vulnerability than CVE-2014-6627.


vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands via shell metacharacters in the fileDate parameter in a DOWN call.


The mdcheck script of the mdadm package for openSUSE 13.2 prior to version 3.3.1-5.14.1 does not properly sanitize device names which allows local attackers to execute arbitrary commands as root.


maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter.


The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters in image_magic_path.


FUJITSU F-12C ARROWS Tab LTE F-01D ARROWS Kiss F-03D and REGZA Phone T-01D for Android allows local users to execute arbitrary commands via unspecified vectors.


BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address.


GParted before 0.15.0 allows local users to execute arbitrary commands with root privileges via shell metacharacters in a crafted filesystem label.


The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag which allows context-dependent attackers to execute arbitrary commands as demonstrated by input containing \$((`...`))\.


Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header which is provided to the passthru PHP function.


run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.


The Server Side Includes (SSI) implementation in the File Upload BBS component in ULTRAPOP.JP i-HTTPD allows remote attackers to execute arbitrary commands by uploading files containing commands in SSI directives.


Cisco-Meraki MS MR and MX devices with firmware before 2014-09-24 allow remote attackers to execute arbitrary commands by leveraging knowledge of a cross-device secret and a per-device secret and sending a request to an unspecified HTTP handler on the local network aka Cisco-Meraki defect ID 00301991.


GNOME Shell 3.14.x before 3.14.1 when the Screen Lock feature is used does not limit the aggregate memory consumption of all active PrtSc requests which allows physically proximate attackers to execute arbitrary commands on an unattended workstation by making many PrtSc requests and leveraging a temporary lock outage and the resulting temporary shell availability caused by the Linux kernel OOM killer.


gpExec in GoPro HERO 3+ allows remote attackers to execute arbitrary commands via a the (1) a1 or (2) a2 parameter in a restart action.


IBM Tivoli Monitoring (ITM) 6.2.0 through FP03 6.2.1 through FP04 6.2.2 through FP09 6.2.3 through FP05 and 6.3.0 before FP04 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands by leveraging Take Action view authority to modify in-progress commands.


backup.php in PHPCompta/NOALYSS before 6.7.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the d parameter.


IBM

Security

AppScan

Enterprise

before

IFix

before

IFix

before

IFix

before

iFix

before

iFix

and

before

iFix

allows

remote

authenticated

users

to

write

to

arbitrary

folders

and

consequently

execute

arbitrary

commands

via

a

modified

argument.


The safe_eval function in trytond in Tryton before 2.4.15 2.6.x before 2.6.14 2.8.x before 2.8.11 3.0.x before 3.0.7 and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module.


IBM Rational AppScan Source 8.0 through 8.0.0.2 and 8.5 through 8.5.0.1 and Security AppScan Source 8.6 through 8.6.0.2 8.7 through 8.7.0.1 8.8 9.0 through 9.0.0.1 and 9.0.1 allow remote attackers to execute arbitrary commands on the installation server via unspecified vectors. IBM X-Force ID: 96721.


Aruba Networks ClearPass before 6.3.5 and 6.4.x before 6.4.1 allows remote attackers to execute arbitrary commands via unspecified vectors a different vulnerability than CVE-2014-5342.


IBM

Security

Network

Protection

before

before

before

before

before

and

before

on

XGS

devices

allows

remote

authenticated

users

to

execute

arbitrary

commands

via

unspecified

vectors.


GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables which allows remote attackers to execute arbitrary commands via a crafted environment as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd the mod_cgi and mod_cgid modules in the Apache HTTP Server scripts executed by unspecified DHCP clients and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 CVE-2014-7169 and CVE-2014-6277.


programs/pluto/xauth.c in the client in Openswan 2.6.25 through 2.6.28 allows remote authenticated gateways to execute arbitrary commands via shell metacharacters in (1) cisco_dns_info or (2) cisco_domain_info data in a packet a different vulnerability than CVE-2010-3302.


programs/pluto/xauth.c in the client in Openswan 2.6.26 through 2.6.28 allows remote authenticated gateways to execute arbitrary commands via shell metacharacters in the cisco_banner (aka server_banner) field a different vulnerability than CVE-2010-3308.


The notify function in pidgin-knotify.c in the pidgin-knotify plugin 0.2.1 and earlier for Pidgin allows remote attackers to execute arbitrary commands via shell metacharacters in a message.


in

EGroupware

and

possibly

other

versions

before

and

EPL

before

and

before

allows

remote

attackers

to

execute

arbitrary

commands

via

shell

metacharacters

in

the

or

parameters.


Ruby Version Manager (RVM) before 1.2.1 writes file contents to a terminal without sanitizing non-printable characters which might allow remote attackers to execute arbitrary commands via a crafted file related to an \escape sequence injection vulnerability.\ NOTE: some of these details are obtained from third party information.


/usr/local/cm/bin/pktCap_protectData in Cisco Unified Communications Manager (aka CUCM formerly CallManager) 6 7 and 8 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in a request to the administrative interface aka Bug IDs CSCti52041 and CSCti74930.


The default configuration of the <Button2> binding in Uzbl before 2010.08.05 does not properly use the @SELECTED_URI feature which allows user-assisted remote attackers to execute arbitrary commands via a crafted HREF attribute of an A element in an HTML document.


index.pl in Miyabi CGI Tools SEO Links 1.02 allows remote attackers to execute arbitrary commands via shell metacharacters in the fn command. NOTE: some of these details are obtained from third party information.


Linksys WAP54Gv3 firmware 3.04.03 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) data2 and (2) data3 parameters to (a) Debug_command_page.asp and (b) debug.cgi.


UnrealIRCd 3.2.8.1 as distributed on certain mirror sites from November 2009 through June 2010 contains an externally introduced modification (Trojan Horse) in the DEBUG3_DOLOG_SYSTEM macro which allows remote attackers to execute arbitrary commands.


freeciv 2.2 before 2.2.1 and 2.3 before 2.3.0 allows attackers to read arbitrary files or execute arbitrary commands via a scenario that contains Lua functionality related to the (1) os (2) io (3) package (4) dofile (5) loadfile (6) loadlib (7) module and (8) require modules or functions.


Multiple unspecified vulnerabilities in the Virtual Appliance Management Infrastructure (VAMI) in VMware Studio 2.0 allow remote authenticated users to execute arbitrary commands via vectors involving (1) the Studio virtual appliance or (2) a virtual appliance created by the Studio virtual appliance.


The

vte_sequence_handler_window_manipulation

function

in

vteseq.c

in

libvte

(aka

in

VTE

and

earlier

as

used

in

gnome-terminal

does

not

properly

handle

escape

sequences

which

allows

remote

attackers

to

execute

arbitrary

commands

or

obtain

potentially

sensitive

information

via

a

window

title

or

icon

title

sequence.

NOTE:

this

issue

exists

because

of

a

regression.


The ExecuteExe method in the DVBSExeCall Control ActiveX control 1.0.0.1 in DVBSExeCall.ocx in DATEV Base System (aka Grundpaket Basis) allows remote attackers to execute arbitrary commands via unspecified vectors.


The helpmanager servlet in the web server in HP OpenView Performance Insight (OVPI) 5.4 and earlier does not properly authenticate and validate requests which allows remote attackers to execute arbitrary commands via vectors involving upload of a JSP document.


The eval_js function in uzbl-core.c in Uzbl before 2010.01.05 exposes the run method of the Uzbl object which allows remote attackers to execute arbitrary commands via JavaScript code.


PyGIT.py in the Trac Git plugin (trac-git) before 0.0.20080710-3+lenny1 and before 0.0.20090320-1 on Debian GNU/Linux when enabled in Trac allows remote attackers to execute arbitrary commands via shell metacharacters in a crafted HTTP query that is used to generate a certain git command.


Linksys WAP54Gv3 firmware 3.04.03 and earlier uses a hard-coded username (Gemtek) and password (gemtekswd) for a debug interface for certain web pages which allows remote attackers to execute arbitrary commands via the (1) data1 (2) data2 or (3) data3 parameters to (a) Debug_command_page.asp and (b) debug.cgi.


The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH contains an entry for \.\ which allows local users to execute arbitrary commands via a Trojan horse executable as demonstrated using sudoedit a different vulnerability than CVE-2010-0426.


Cacti before 0.8.7f as used in Red Hat High Performance Computing (HPC) Solution and other products allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in (1) the FQDN field of a Device or (2) the Vertical Label field of a Graph Template.


The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server 2003 does not properly handle malformed escape sequences which allows remote attackers to bypass the trusted documents whitelist (fromHCP option) and execute arbitrary commands via a crafted hcp:// URL aka \Help Center URL Validation Vulnerability.\


phpThumb.php in phpThumb() 1.7.9 and possibly other versions when ImageMagick is installed allows remote attackers to execute arbitrary commands via the fltr parameter as discovered in the wild in April 2010. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


awstats.cgi in AWStats before 7.0 on Windows accepts a configdir parameter in the URL which allows remote attackers to execute arbitrary commands via a crafted configuration file located at a UNC share pathname.


The web authentication form in the NT4 authentication component in Citrix Access Gateway Enterprise Edition 9.2-49.8 and earlier and the NTLM authentication component in Access Gateway Standard and Advanced Editions before Access Gateway 5.0 allows attackers to execute arbitrary commands via shell metacharacters in the password field.


awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL which allows remote attackers to execute arbitrary commands via a crafted configuration file located on a (1) WebDAV server or (2) NFS server.


recorder_test.cgi on the D-Link DCS-2121 camera with firmware 1.04 allows remote attackers to execute arbitrary commands via shell metacharacters in the Password field related to a \semicolon injection\ vulnerability.


Unspecified vulnerability in the Space Management client in the Hierarchical Storage Management (HSM) component in IBM Tivoli Storage Manager (TSM) 5.4.x before 5.4.3.4 5.5.x before 5.5.3 6.1.x before 6.1.4 and 6.2.x before 6.2.2 on Unix and Linux allows remote attackers to execute arbitrary commands via unknown vectors related to a \script execution vulnerability.\


ess.pm in NitroSecurity NitroView ESM 8.4.0a when ESSPMDebug is enabled allows remote attackers to execute arbitrary commands via shell metacharacters in the Request parameter to ess.


operation/agentes/networkmap.php in Pandora FMS before 3.1.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the layout parameter in an operation/agentes/networkmap action to index.php.


The affected On-Premise cnMaestro is vulnerable inside a specific route where a user can upload a crafted package to the system. An attacker could abuse this user-controlled data to execute arbitrary commands on the server.


The config restore function of Voipmonitor GUI before v24.96 does not properly check files sent as restore archives allowing remote attackers to execute arbitrary commands via a crafted file in the web root.


NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters to password.cgi.


NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the ipv6_fix.cgi ipv6_wan_ipaddr ipv6_lan_ipaddr ipv6_wan_length or ipv6_lan_length parameter.


NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters to admin_account.cgi.


VMware NSX Edge contains a CLI shell injection vulnerability. A malicious actor with SSH access to an NSX-Edge appliance can execute arbitrary commands on the operating system as root.


A

vulnerability

in

${\freemarker.template.utility.Execute\?new()

of

UJCMS

Jspxcms

allows

attackers

to

execute

arbitrary

commands

via

uploading

malicious

files.


Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. These vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by sending malicious input to an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system of the affected device. To exploit these vulnerabilities an attacker would need to have valid Administrator credentials on the affected device.


A vulnerability in the CLI of Cisco IOS XE Software for Cisco Catalyst 9000 Family Switches and Cisco Catalyst 9000 Family Wireless Controllers could allow an authenticated local attacker to elevate privileges to level 15 on an affected device. This vulnerability is due to insufficient validation of user privileges after the user executes certain CLI commands. An attacker could exploit this vulnerability by logging in to an affected device as a low-privileged user and then executing certain CLI commands. A successful exploit could allow the attacker to execute arbitrary commands with level 15 privileges on the affected device.


A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated local attacker to execute arbitrary commands on the underlying operating system as the root user. The attacker must be authenticated on the affected system as a low-privileged user to exploit this vulnerability. This vulnerability exists because a file leveraged by a root user is executed when a low-privileged user runs specific commands on an affected system. An attacker could exploit this vulnerability by injecting arbitrary commands to a specific file as a lower-privileged user and then waiting until an admin user executes specific commands. The commands would then be executed on the device by the root user. A successful exploit could allow the attacker to escalate their privileges on the affected system from a low-privileged user to the root user.


httpd.c in httpd in the management GUI in DD-WRT 24 sp1 and other versions before build 12533 allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI.


nilfs-utils before 2.0.14 installs multiple programs with unnecessary setuid privileges which allows local users to execute arbitrary commands via the device string in a -c command line option to mkfs.nilfs2.


Worldweaver DX Studio Player 3.0.29.0 3.0.22.0 3.0.12.0 and probably other versions before 3.0.29.1 when used as a plug-in for Firefox does not restrict access to the shell.execute JavaScript API method which allows remote attackers to execute arbitrary commands via a .dxstudio file that invokes this method.


statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters.


Multiple unspecified vulnerabilities in Common Desktop Environment (CDE) in Sun Solaris 10 when Trusted Extensions is enabled allow local users to execute arbitrary commands or bypass the Mandatory Access Control (MAC) policy via unknown vectors related to a menu typo and the Style Manager.


Adobe Photoshop Elements 8.0 installs the Adobe Active File Monitor V8 service with an insecure security descriptor which allows local users to (1) stop the service via the stop command (2) execute arbitrary commands as SYSTEM by using the config command to modify the binPath variable or (3) restart the service via the start command.


The launch method in the Deployment Toolkit plugin in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 6 before Update 17 allows remote attackers to execute arbitrary commands via a crafted web page aka Bug Id 6869752.


The doHotCopy subroutine in socket-server.pl in Zmanda Recovery Manager (ZRM) for MySQL 2.x before 2.1.1 allows remote attackers to execute arbitrary commands via vectors involving a crafted $MYSQL_BINPATH variable.


The port-3443 HTTP server in HP OpenView Network Node Manager (OV NNM) 7.01 7.51 and 7.53 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostname parameter to unspecified Perl scripts.


The Backend subcomponent in TYPO3 4.0.13 and earlier 4.1.x before 4.1.13 4.2.x before 4.2.10 and 4.3.x before 4.3beta2 when the DAM extension or ftp upload is enabled allows remote authenticated users to execute arbitrary commands via shell metacharacters in a filename.


The Intel LANDesk Common Base Agent (CBA) in Symantec Alert Management System 2 (AMS2) as used in Symantec System Center (SSS); Symantec AntiVirus Server; Symantec AntiVirus Central Quarantine Server; Symantec AntiVirus (SAV) Corporate Edition 9 before 9.0 MR7 10.0 and 10.1 before 10.1 MR8 and 10.2 before 10.2 MR2; Symantec Client Security (SCS) 2 before 2.0 MR7 and 3 before 3.1 MR8; and Symantec Endpoint Protection (SEP) before 11.0 MR3 allows remote attackers to execute arbitrary commands via a crafted packet whose contents are interpreted as a command to be launched in a new process by the CreateProcessA function.


dig.php in GScripts.net DNS Tools allows remote attackers to execute arbitrary commands via shell metacharacters in the host parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Sun Java System Identity Manager (IdM) 7.0 through 8.0 on Linux AIX Solaris and HP-UX permits \control characters\ in the passwords of user accounts which allows remote attackers to execute arbitrary commands via vectors involving \resource adapters.\


The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.18 and NaSMail before 1.7 allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program.


The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux and possibly other operating systems and versions allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.


The smarty_function_math function in libs/plugins/function.math.php in Smarty 2.6.22 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the equation attribute of the math function. NOTE: some of these details are obtained from third party information.


The getdirective function in mathtex.cgi in mathTeX when downloaded before 20090713 allows remote attackers to execute arbitrary commands via shell metacharacters in the dpi tag.


The system.openURL function in StoneTrip Ston3D StandalonePlayer (aka S3DPlayer StandAlone) 1.6.2.4 and 1.7.0.1 and WebPlayer (aka S3DPlayer Web) 1.6.0.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the first argument (the sURL argument).


dig.php in GScripts.net DNS Tools allows remote attackers to execute arbitrary commands via shell metacharacters in the ns parameter.


James Stone Tunapie 2.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a stream URL.


The smmsnmpd service in CA Service Metric Analysis r11.0 through r11.1 SP1 and Service Level Management 3.5 does not properly restrict access which allows remote attackers to execute arbitrary commands via unspecified vectors.


cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the type parameter in a NoAuthREQ x509List action.


The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9 4.1.0 through 4.1.7 and 4.2.0 through 4.2.3 allows remote attackers to execute arbitrary commands via a crafted filename containing shell metacharacters which is not properly handled by the command-line indexer.


The redirect implementation in curl and libcurl 5.11 through 7.19.3 when CURLOPT_FOLLOWLOCATION is enabled accepts arbitrary Location values which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers (2) read or overwrite arbitrary files via a redirect to a file: URL or (3) execute arbitrary commands via a redirect to an scp: URL.


Sage 1.4.3 and earlier extension for Firefox performs certain operations with chrome privileges which allows remote attackers to execute arbitrary commands and perform cross-domain scripting attacks via the description tag of an RSS feed.


Boa 0.94.14rc21 writes data to a log file without sanitizing non-printable characters which might allow remote attackers to modify a window's title or possibly execute arbitrary commands or overwrite files via an HTTP request containing an escape sequence for a terminal emulator.


Mort

Bay

Jetty

through

and

writes

backtrace

data

without

sanitizing

non-printable

characters

which

might

allow

remote

attackers

to

modify

a

window's

title

or

possibly

execute

arbitrary

commands

or

overwrite

files

via

an

HTTP

request

containing

an

escape

sequence

for

a

terminal

emulator

related

to

a

string

value

in

the

Age

parameter

to

the

default

URI

for

the

Cookie

Dump

Servlet

in

under

cookie/

an

alphabetic

value

in

the

A

parameter

to

jsp/expr.jsp

or

an

alphabetic

value

in

the

Content-Length

HTTP

header

to

an

arbitrary

application.


WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383 1.8.7 through patchlevel 248 1.8.8dev 1.9.1 through patchlevel 376 and 1.9.2dev writes data to a log file without sanitizing non-printable characters which might allow remote attackers to modify a window's title or possibly execute arbitrary commands or overwrite files via an HTTP request containing an escape sequence for a terminal emulator.


addons/import.php in TalkBack 2.3.14 allows remote attackers to execute arbitrary commands via the result parameter.


Lintian 1.23.x through 1.23.28 1.24.x through 1.24.2.1 and 2.x before 2.3.2 allows remote attackers to execute arbitrary commands via shell metacharacters in filename arguments.


The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7 when running on FreeBSD or Solaris allows remote attackers to bypass the EnableRemoteCommands setting and execute arbitrary commands via shell metacharacters in the argument to net.tcp.listen. NOTE: this attack is limited to attacks from trusted IP addresses.


Orion Application Server 2.0.7 writes data to a log file without sanitizing non-printable characters which might allow remote attackers to modify a window's title or possibly execute arbitrary commands or overwrite files via an HTTP request containing an escape sequence for a terminal emulator.


nginx 0.7.64 writes data to a log file without sanitizing non-printable characters which might allow remote attackers to modify a window's title or possibly execute arbitrary commands or overwrite files via an HTTP request containing an escape sequence for a terminal emulator.


stap-server in SystemTap before 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in stap command-line arguments in a request.


Yaws 1.85 writes data to a log file without sanitizing non-printable characters which might allow remote attackers to modify a window's title or possibly execute arbitrary commands or overwrite files via an HTTP request containing an escape sequence for a terminal emulator.


thttpd 2.25b0 writes data to a log file without sanitizing non-printable characters which might allow remote attackers to modify a window's title or possibly execute arbitrary commands or overwrite files via an HTTP request containing an escape sequence for a terminal emulator.


header.c in Cherokee before 0.99.32 writes data to a log file without sanitizing non-printable characters which might allow remote attackers to modify a window's title or possibly execute arbitrary commands or overwrite files via an HTTP request containing an escape sequence for a terminal emulator.


South River Technologies WebDrive 9.02 build 2232 installs the WebDrive Service without a security descriptor which allows local users to (1) stop the service via the stop command (2) execute arbitrary commands as SYSTEM by using the config command to modify the binPath variable or (3) restart the service via the start command.


infoRSS 1.1.4.2 and earlier extension for Firefox performs certain operations with chrome privileges which allows remote attackers to execute arbitrary commands and perform cross-domain scripting attacks via the description tag of an RSS feed.


ToutVirtual VirtualIQ Pro before 3.5 build 8691 does not require administrative authentication for JBoss console access which allows remote attackers to execute arbitrary commands via requests to (1) the JMX Management Console or (2) the Web Console.


Yoono extension before 6.1.1 for Firefox performs certain operations with chrome privileges which allows user-assisted remote attackers to execute arbitrary commands and perform cross-domain scripting attacks via DOM event handlers such as onload.


AlienVault Open Source Security Information Management (OSSIM) 2.1.5 and possibly other versions before 2.1.5-4 allows remote attackers to execute arbitrary commands via shell metacharacters in the uniqueid parameter to (1) wcl.php (2) storage_graphs.php (3) storage_graphs2.php (4) storage_graphs3.php and (5) storage_graphs4.php in sem/.


The node_process_command function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request.


AOLserver 4.5.1 writes data to a log file without sanitizing non-printable characters which might allow remote attackers to modify a window's title or possibly execute arbitrary commands or overwrite files via an HTTP request containing an escape sequence for a terminal emulator.


Accellion Secure File Transfer Appliance before 8_0_105 allows remote authenticated administrators to bypass the restricted shell and execute arbitrary commands via shell metacharacters to the ping command as demonstrated by modifying the cli program.


mini_httpd 1.19 writes data to a log file without sanitizing non-printable characters which might allow remote attackers to modify a window's title or possibly execute arbitrary commands or overwrite files via an HTTP request containing an escape sequence for a terminal emulator.


** DISPUTED ** Varnish 2.0.6 writes data to a log file without sanitizing non-printable characters which might allow remote attackers to modify a window's title or possibly execute arbitrary commands or overwrite files via an HTTP request containing an escape sequence for a terminal emulator. NOTE: the vendor disputes the significance of this report stating that \This is not a security problem in Varnish or any other piece of software which writes a logfile. The real problem is the mistaken belief that you can cat(1) a random logfile to your terminal safely.\


Jetty 6.x through 6.1.22 suffers from an escape sequence injection vulnerability from an attack vector by means of: 1) \Cookie Dump Servlet\ and 2) Http Content-Length header. 1) A POST request to the form at \/test/cookie/\ with the \Age\ parameter set to a string throws a \java.lang.NumberFormatException\ which reflects binary characters including ESC. These characters could be used to execute arbitrary commands or buffer dumps in the terminal. 2) The attack vector in 1) can be exploited by requesting a page using an HTTP request \Content-Length\ header set to a consonant string (string including only letters).


KDE 2 and KDE 3.1.1 and earlier 3.x versions allows attackers to execute arbitrary commands via (1) PostScript (PS) or (2) PDF files related to missing -dPARANOIDSAFER and -dSAFER arguments when using the kghostview Ghostscript viewer.


Various PDF viewers including (1) Adobe Acrobat 5.06 and (2) Xpdf 1.01 allow remote attackers to execute arbitrary commands via shell metacharacters in an embedded hyperlink.


Happycgi.com Happymall 4.3 and 4.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter for the (1) normal_html.cgi or (2) member_html.cgi scripts.


The rxvt terminal emulator 2.7.8 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal e.g. when the user views a file containing the malicious sequence which could allow the attacker to execute arbitrary commands.


cnd.c in mgetty 1.1.28 and earlier does not properly filter non-printable characters and quotes which may allow remote attackers to execute arbitrary commands via shell metacharacters in (1) caller ID or (2) caller name strings.


The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal e.g. when the user views a file containing the malicious sequence which could allow the attacker to execute arbitrary commands.


lv reads a .lv file from the current working directory which allows local users to execute arbitrary commands as other lv users by placing malicious .lv files into other directories.


The aterm terminal emulator 0.42 allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal e.g. when the user views a file containing the malicious sequence which could allow the attacker to execute arbitrary commands.


Unknown vulnerability in GNU Ghostscript before 7.07 allows attackers to execute arbitrary commands even when -dSAFER is enabled via a PostScript file that causes the commands to be executed from a malicious print job.


DirectoryServices in MacOS X trusts the PATH environment variable to locate and execute the touch command which allows local users to execute arbitrary commands by modifying the PATH to point to a directory containing a malicious touch program.


The menuBar feature in aterm 0.42 allows attackers to modify menu options and execute arbitrary commands via a certain character escape sequence that inserts the commands into the menu.


gkrellm-newsticker gkrellm plugin before 0.3-3.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the ticker title of a URI.


The GnuPG plugin in kopete before 0.6.2 does not properly cleanse the command line when executing gpg which allows remote attackers to execute arbitrary commands.


The hanterm (hanterm-xf) terminal emulator 2.0.5 and earlier and possibly later versions allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal e.g. when the user views a file containing the malicious sequence which could allow the attacker to execute arbitrary commands.


Unknown vulnerability in bonsai Mozilla CVS query tool allows remote attackers to execute arbitrary commands as the www-data user.


The uxterm terminal emulator allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal e.g. when the user views a file containing the malicious sequence which could allow the attacker to execute arbitrary commands.


Unknown vulnerability in minimalist mailing list manager 2.4 2.2 and possibly other versions allows remote attackers to execute arbitrary commands.


The PuTTY terminal emulator 0.53 allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal e.g. when the user views a file containing the malicious sequence which could allow the attacker to execute arbitrary commands.


mod_auth_any package in Red Hat Enterprise Linux 2.1 and other operating systems does not properly escape arguments when calling other programs which allows attackers to execute arbitrary commands via shell metacharacters.


The Eterm terminal emulator 0.9.1 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal e.g. when the user views a file containing the malicious sequence which could allow the attacker to execute arbitrary commands.


The menuBar feature in rxvt 2.7.8 allows attackers to modify menu options and execute arbitrary commands via a certain character escape sequence that inserts the commands into the menu.


PeopleSoft PeopleTools 8.1x 8.2x and 8.4x allows remote attackers to execute arbitrary commands by uploading a file to the IClient Servlet guessing the insufficiently random (system time) name of the directory used to store the file and directly requesting that file.


VTE as used by default in gnome-terminal terminal emulator 2.2 and as an option in gnome-terminal 2.0 allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal e.g. when the user views a file containing the malicious sequence which could allow the attacker to execute arbitrary commands.


Kdbg 1.1.0 through 1.2.8 does not check permissions of the .kdbgrc file which allows local users to execute arbitrary commands.


The dtterm terminal emulator allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal e.g. when the user views a file containing the malicious sequence which could allow the attacker to execute arbitrary commands.


The checklogin function in omail.pl for omail webmail 0.98.4 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) password (2) domainname or (3) username.


susehelp in SuSE Linux 8.1 Enterprise Server 8 Office Server and Openexchange Server 4 does not properly filter shell metacharacters which allows remote attackers to execute arbitrary commands via CGI queries.


XMMS.pm in X2 XMMS Remote as obtained from the vendor server between 4 AM 11 AM PST on May 7 2003 allows remote attackers to execute arbitrary commands via shell metacharacters in a request to TCP port 8086.


Emacs 21.2.1 does not prompt or warn the user before executing Lisp code in the local variables section of a text file which allows user-assisted attackers to execute arbitrary commands as demonstrated using the mode-name variable.


H-Sphere WebShell 2.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) mode and (2) zipfile parameters in a URL request.


guestbook.cgi in cPanel 5.0 allows remote attackers to execute arbitrary commands via the template parameter.


The escape_dangerous_chars function in CGI::Lite 2.0 and earlier does not correctly remove special characters including (1) \\\\ (backslash) (2) \?\ (3) \~\ (tilde) (4) \^\ (carat) (5) newline or (6) carriage return which could allow remote attackers to read or write arbitrary files or execute arbitrary commands in shell scripts that rely on CGI::Lite to filter such dangerous inputs.


Album.pl 6.1 allows remote attackers to execute arbitrary commands when an alternative configuration file is used via unknown attack vectors.


The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods which allows remote attackers to execute arbitrary commands.


Vulnerability in a script in Texas A&M University (TAMU) Tiger allows local users to execute arbitrary commands as the Tiger user usually root.


O'Reilly WebSite 1.1e and Website Pro 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in an argument to (1) args.cmd or (2) args.bat.


CDomain whois_raw.cgi whois CGI script allows remote attackers to execute arbitrary commands via shell metacharacters in the fqdn parameter.


LakeWeb Filemail CGI script allows remote attackers to execute arbitrary commands via shell metacharacters in the recipient email address.


Symantec Norton Utilities 2.0 for Windows 95 marks the TUNEOCX.OCX ActiveX control as safe for scripting which allows remote attackers to execute arbitrary commands via the run option through malicious web pages that are accessed by browsers such as Internet Explorer 3.0.


Vulnerability in man.sh CGI script included in May 1998 issue of SysAdmin Magazine allows remote attackers to execute arbitrary commands.


The AMaViS virus scanner 0.2.0-pre4 and earlier allows remote attackers to execute arbitrary commands as root via an infected mail message with shell metacharacters in the reply-to field.