guestbook.pl cleanses user-inserted SSI commands by removing text between \<!--\ and \-->\ separators which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions since Apache allows other closing sequences besides \-->\.


The Kodak/Wang (1) Image Edit (imgedit.ocx) (2) Image Annotation (imgedit.ocx) (3) Image Scan (imgscan.ocx) (4) Thumbnail Image (imgthumb.ocx) (5) Image Admin (imgadmin.ocx) (6) HHOpen (hhopen.ocx) (7) Registration Wizard (regwizc.dll) and (8) IE Active Setup (setupctl.dll) ActiveX controls for Internet Explorer (IE) 4.01 and 5.0 are marked as \Safe for Scripting \ which allows remote attackers to create and modify files and execute arbitrary commands.


LakeWeb Mail List CGI script allows remote attackers to execute arbitrary commands via shell metacharacters in the recipient email address.


automatic download option in ncftp 2.4.2 FTP client in Red Hat Linux 5.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the names of files that are to be downloaded.


Vulnerability in rcp on SunOS 4.0.x allows remote attackers from trusted hosts to execute arbitrary commands as root possibly related to the configuration of the nobody user.


Internet Explorer with a security setting below Medium allows remote attackers to execute arbitrary commands via a malicious web page that uses the FileSystemObject ActiveX object.


Microsoft Excel 97 does not warn the user before executing worksheet functions which could allow attackers to execute arbitrary commands by using the CALL function to execute a malicious DLL aka the Excel \CALL Vulnerability.\


HAMcards Postcard CGI script 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the recipient email address.


The textcounter.pl by Matt Wright allows remote attackers to execute arbitrary commands via shell metacharacters.


Vulnerability in rexec daemon (rexecd) in AT&T TCP/IP 4.0 for various SVR4 systems allows remote attackers to execute arbitrary commands.


Ray Chan WWW Authorization Gateway 0.1 CGI program allows remote attackers to execute arbitrary commands via shell metacharacters in the \user\ parameter.


SystemSoft SystemWizard package in HP Pavilion PC with Windows 98 and possibly other platforms and operating systems installs two ActiveX controls that are marked as safe for scripting which allows remote attackers to execute arbitrary commands via a malicious web page that references (1) the Launch control or (2) the RegObj control.


(1) ipxchk and (2) ipxlink in SGI OS2 IRIX 6.3 does not properly clear the IFS environmental variable before executing system calls which allows local users to execute arbitrary commands.


abuse.console in Red Hat 2.1 uses relative pathnames to find and execute the undrv program which allows local users to execute arbitrary commands via a path that points to a Trojan horse program.


FTP installation script anon.ftp in AIX insecurely configures anonymous FTP which allows remote attackers to execute arbitrary commands.


Internet Explorer 3.01 on Windows 95 allows remote malicious web sites to execute arbitrary commands via a .isp file which is automatically downloaded and executed without prompting the user.


The Windows NT 4.0 print spooler allows a local user to execute arbitrary commands due to inappropriate permissions that allow the user to specify an alternate print provider.


Java Bytecode Verifier allows malicious applets to execute arbitrary commands as the user of the applet.


SunOS/Solaris FTP clients can be forced to execute arbitrary commands from a malicious FTP server.


webdist CGI program (webdist.cgi) in SGI IRIX allows remote attackers to execute arbitrary commands via shell metacharacters in the distloc parameter.


Hylafax faxsurvey CGI script on Linux allows remote attackers to execute arbitrary commands via shell metacharacters in the query string.


sudo 1.5.x allows local users to execute arbitrary commands via a .. (dot dot) attack.


IIS 1.0 allows users to execute arbitrary commands using .bat or .cmd files.


The Eyedog ActiveX control is marked as \safe for scripting\ for Internet Explorer which allows a remote attacker to execute arbitrary commands as demonstrated by Bubbleboy.


The campas CGI program provided with some NCSA web servers allows an attacker to execute arbitrary commands via encoded carriage return characters in the query string as demonstrated by reading the password file.


The scriptlet.typelib ActiveX control is marked as \safe for scripting\ for Internet Explorer which allows a remote attacker to execute arbitrary commands as demonstrated by Bubbleboy.


In Solaris an SNMP subagent has a default community string that allows remote attackers to execute arbitrary commands as root or modify system parameters.


The CDE dtspcd daemon allows local users to execute arbitrary commands via a symlink attack.


Talkd when given corrupt DNS information can be used to execute arbitrary commands with root privileges.


The Microsoft Java Virtual Machine allows a malicious Java applet to execute arbitrary commands outside of the sandbox environment.


go.cgi in GoScript 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) query string or (2) artarchive parameter.


i-mall.cgi in I-Mall Commerce allows remote attackers to execute arbitrary commands via shell metacharacters via the p parameter.


The read_list_from_file function in vacation.pl for OpenWebmail before 2.32 20040629 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename argument.


blog.cgi in Leif M. Wright Web Blog 1.1 and 1.1.5 allows remote attackers to execute arbitrary commands via shell metacharacters such as '|' in the file parameter of ViewFile requests.


The Altiris Client Service for Windows 5.6 SP1 Hotfix E (5.6.181) allows local users to execute arbitrary commands by opening the AClient tray icon and using the View Log File option a different vulnerability than CVE-2005-1590.


The

MIME

transformation

system

(transformations/text_plain__external.inc.php)

in

phpMyAdmin

up

to

allows

remote

attackers

to

execute

arbitrary

commands

via

shell

metacharacters

in

unspecified

vectors.


The exec_dir PHP patch (php-exec-dir) 4.3.2 through 4.3.7 with safe mode disabled allows remote attackers to bypass restrictions and execute arbitrary commands via a backtick operator which is not handled using the php_escape_shell_cmd function.


The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.


Serv-U FTP server before 5.1.0.0 has a default account and password for local administration which allows local users to execute arbitrary commands by connecting to the server using the default administrator account creating a new user logging in as that new user and then using the SITE EXEC command.


Axis Network Camera 2.40 and earlier and Video Server 3.12 and earlier allows remote attackers to execute arbitrary commands via accent (`) and possibly other shell metacharacters in the query string to virtualinput.cgi.


The EPSF pipe support in enscript 1.6.3 allows remote attackers or local users to execute arbitrary commands via shell metacharacters.


Extproc in Oracle 9i and 10g does not require authentication to load a library or execute a function which allows local users to execute arbitrary commands as the Oracle user.


The patch to the checklogin function in omail.pl for omail webmail 0.98.5 is incomplete which allows remote attackers to execute arbitrary commands via shell metacharacters such as \`\ (backticks) in the password.


picmgmtbatch.inc.php in Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers with administrative privileges to execute arbitrary commands via shell metacharacters in the (1) $CONFIG'impath' or (2) $CONFIG'jpeg_qual' parameters.


Enscript 1.6.3 does not sanitize filenames which allows remote attackers or local users to execute arbitrary commands via crafted filenames.


Tomcat before 5.0.27-r3 in Gentoo Linux sets the default permissions on the init scripts as tomcat:tomcat but executes the scripts with root privileges which could allow local users in the tomcat group to execute arbitrary commands as root by modifying the scripts.


The id3tag_sort function in id3tag.c for YAMT 0.5 allows remote attackers to execute arbitrary commands via an MP3 file with double quotes in the Artist tag.


a2ps 4.13 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename.


display.cgi in Aborior Encore WebForum allows remote to execute arbitrary commands via shell metacharacters in the file variable.


filediff in CVStrac allows remote attackers to execute arbitrary commands via shell metacharacters in rcsinfo.


Unknown vulnerability in the Veritas NetBackup Administrative Assistant interface for NetBackup BusinesServer 3.4 3.4.1 and 4.5 DataCenter 3.4 3.4.1 and 4.5 Enterprise Server 5.1 and NetBackup Server 5.0 and 5.1 allows attackers to execute arbitrary commands via the bpjava-susvc process possibly related to the call-back feature.


sudo before 1.6.8p2 allows local users to execute arbitrary commands by using \()\ style environment variables to create functions that have the same name as any program within the bash script that is called without using the program's full pathname.


The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search string.


athenareg.php in Athena Web Registration allows remote attackers to execute arbitrary commands via shell metacharacters in the pass parameter.


VIM before 6.3 and gVim before 6.3 allow local users to execute arbitrary commands via a file containing a crafted modeline that is executed when the file is viewed using options such as (1) termcap (2) printdevice (3) titleold (4) filetype (5) syntax (6) backupext (7) keymap (8) patchmode or (9) langmenu.


page.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the url parameter.


The web mail functionality in Usermin 1.x and Webmin 1.x allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail message.


The \%f\ feature in the VirusEvent directive in Clam AntiVirus daemon (clamd) before 0.70 allows local users to execute arbitrary commands via shell metacharacters in a file name.


The gui_popup_view_fly function in gui_tview_popup.c for junkie 0.3.1 allows remote malicious FTP servers to execute arbitrary commands via shell metacharacters in a filename.


weblibs.pl in WebLibs 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the TextFile parameter.


McAfee ePolicy Orchestrator (ePO) 2.5.1 Patch 13 and 3.0 SP2a Patch 3 allows remote attackers to execute arbitrary commands via certain HTTP POST requests to the spipe/file handler on ePO TCP port 81.


The xatitv program in the gatos package does not properly drop root privileges when the configuration file does not exist which allows local users to execute arbitrary commands via shell metacharacters in a system call.


The smiley theme functionality in Gaim before 0.82 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of the tar file that is dragged to the smiley selector.


Unknown vulnerability in xitalk 1.1.11 and earlier allows local users to execute arbitrary commands.


Unknown vulnerability in foomatic-rip in Foomatic before 3.0.2 allows local users or remote attackers with access to CUPS to execute arbitrary commands.


FirstClass Desktop Client 7.1 allows remote attackers to execute arbitrary commands via hyperlinks in FirstClass RTF messages.


X-Cart 3.4.3 allows remote attackers to execute arbitrary commands via the perl_binary argument in (1) upgrade.php or (2) general.php.


gzexe in gzip 1.3.3 and earlier will execute an argument when the creation of a temp file fails instead of exiting the program which could allow remote attackers or local users to execute arbitrary commands a different vulnerability than CVE-1999-1332.


Web_Store.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter.


The calendar program in bsdmainutils 6.0 through 6.0.14 does not drop root privileges when executed with the -a flag which allows attackers to execute arbitrary commands via a calendar event file.


IBM MQ Appliance 8.0 and 9.0 could allow an authenticated messaging administrator to execute arbitrary commands on the system caused by command execution. IBM X-Force ID: 125730.


IBM Notes 8.5 and 9.0 could allow a local attacker to execute arbitrary commands by carefully crafting a command line sent via the shared memory IPC. IBM X-Force ID: 134807.


IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 127394.


IBM Tivoli Monitoring Portal v6 could allow a local (network adjacent) attacker to execute arbitrary commands on the system when default client-server default communications HTTP are being used. IBM X-Force ID: 123493.


IBM API Connect 5.0.6.0 could allow a remote attacker to execute arbitrary commands on the system caused by improper validation of URLs for the Developer Portal. By crafting a malicious URL an attacker could exploit this vulnerability to execute arbitrary commands on the system with the privileges of the www-data user. IBM X-Force ID: 122956.


IBM Security Access Manager Appliance 9.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 128372.


IBM Security Guardium 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 124633.


IBM QRadar 7.2 and 7.3 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 134178.


The JMX server embedded in Apache James also used by the command line client is exposed to a java de-serialization issue and thus can be used to execute arbitrary commands. As James exposes JMX socket by default only on local-host this vulnerability can only be used for privilege escalation. Release 3.0.1 upgrades the incriminated library.


It was discovered that the bpserverd proprietary protocol in Unitrends Backup (UB) before 10.0.0 as invoked through xinetd has an issue in which its authentication can be bypassed. A remote attacker could use this issue to execute arbitrary commands with root privilege on the target system.


git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname as demonstrated by an ssh://-eProxyCommand= URL a related issue to CVE-2017-9800 CVE-2017-12836 CVE-2017-1000116 and CVE-2017-1000117.


Insufficient validation of user-supplied input for the Solstice Pod before 2.8.4 networking configuration enables authenticated attackers to execute arbitrary commands as root.


A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated local attacker to escape the Python parser and gain unauthorized access to the underlying operating system of the device. The vulnerability exists due to insufficient sanitization of user-supplied parameters that are passed to certain Python functions within the scripting sandbox of the affected device. An attacker could exploit this vulnerability to escape the scripting sandbox and execute arbitrary commands on the underlying operating system with the privileges of the authenticated user. To exploit this vulnerability an attacker must have local access and be authenticated to the targeted device with administrative or Python execution privileges. These requirements could limit the possibility of a successful exploit. This vulnerability affects the following Cisco products if they are running Cisco NX-OS Software: Multilayer Director Switches Nexus 2000 Series Fabric Extenders Nexus 3000 Series Switches Nexus 3500 Platform Switches Nexus 5000 Series Switches Nexus 5500 Platform Switches Nexus 5600 Platform Switches Nexus 6000 Series Switches Nexus 7000 Series Switches Nexus 7700 Series Switches Nexus 9000 Series Switches - Standalone NX-OS mode Nexus 9500 R-Series Line Cards and Fabric Modules. Cisco Bug IDs: CSCvb86832 CSCvd86474 CSCvd86479 CSCvd86484 CSCvd86490 CSCve97102 CSCvf12757 CSCvf12804 CSCvf12815 CSCvf15198.


A vulnerability in certain system script files that are installed at boot time on Cisco Application Policy Infrastructure Controllers could allow an authenticated local attacker to gain elevated privileges and execute arbitrary commands with root privileges on an affected host operating system. The vulnerability is due to insufficient validation of user-controlled input that is supplied to certain script files of an affected system. An attacker could exploit this vulnerability by submitting crafted input to a script file on an affected system. A successful exploit could allow the attacker to gain elevated privileges and execute arbitrary commands with root privileges on the affected system. To exploit this vulnerability the attacker would need to authenticate to the affected system by using valid administrator credentials. Cisco Bug IDs: CSCvf57274.


It was discovered that an issue in the session logic in Unitrends Backup (UB) before 10.0.0 allowed using the LOGDIR environment variable during a web session to elevate an existing low-privilege user to root privileges. A remote attacker with existing low-privilege credentials could then execute arbitrary commands with root privileges.


Password file exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to execute arbitrary commands with administrative privileges by retrieving credentials from this file.


The XML-RPC server in supervisor before 3.0.1 3.1.x before 3.1.4 3.2.x before 3.2.4 and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request related to nested supervisord namespace lookups.


Microsoft Outlook 2010 SP2 Outlook 2013 SP1 and RT SP1 and Outlook 2016 allow an attacker to execute arbitrary commands due to how Microsoft Office handles objects in memory aka \Microsoft Outlook Security Feature Bypass Vulnerability.\


The Basic authentication code in WEBrick library in Ruby before 2.2.8 2.3.x before 2.3.5 and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.


Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.


In the EyesOfNetwork web interface (aka eonweb) 5.1-0 module\\tool_all\\tools\\snmpwalk.php does not properly restrict popen calls which allows remote attackers to execute arbitrary commands via shell metacharacters in a parameter.


In the EyesOfNetwork web interface (aka eonweb) 5.1-0 module\\tool_all\\tools\\interface.php does not properly restrict exec calls which allows remote attackers to execute arbitrary commands via shell metacharacters in the host_list parameter to module/tool_all/select_tool.php.


Bazaar through 2.7.0 when Subprocess SSH is used allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname a related issue to CVE-2017-9800 CVE-2017-12836 CVE-2017-12976 CVE-2017-16228 CVE-2017-1000116 and CVE-2017-1000117.


The Screensavercc component in eLux RP before 5.5.0 allows attackers to bypass intended configuration restrictions and execute arbitrary commands with root privileges by inserting commands in a local configuration dialog in the control panel.


SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to execute arbitrary commands.


AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow remote authenticated users to execute arbitrary commands in a privileged context or launch a reverse shell via vectors involving the PHP session ID and the NfSen PHP code aka AlienVault ID ENG-104862.


A vulnerability in the USB-modem code of Cisco IOS XE Software running on Cisco ASR 920 Series Aggregation Services Routers could allow an authenticated local attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to improper input validation of the platform usb modem command in the CLI of the affected software. An attacker could exploit this vulnerability by modifying the platform usb modem command in the CLI of an affected device. A successful exploit could allow the attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. Cisco Bug IDs: CSCve48949.


AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow local users to execute arbitrary commands in a privileged context via an NfSen socket aka AlienVault ID ENG-104863.


A

vulnerability

in

a

startup

script

of

Cisco

IOS

XE

Software

could

allow

an

unauthenticated

attacker

with

physical

access

to

the

targeted

system

to

execute

arbitrary

commands

on

the

underlying

operating

system

with

the

privileges

of

the

root

user.

More

Information:

Known

Affected

Releases:

Known

Fixed

Releases:


A vulnerability in the esc_listener.py script of Cisco Elastic Services Controllers could allow an authenticated remote attacker to execute arbitrary commands as the tomcat user on an affected system aka an Authentication Request Processing Arbitrary Command Execution Vulnerability. More Information: CSCvc76642. Known Affected Releases: 2.2(9.76).


QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors.


A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated remote attacker to execute arbitrary commands on an affected system. The vulnerability exists because the affected software does not sufficiently sanitize user-supplied HTTP input. An attacker could exploit this vulnerability by sending an HTTP POST request that contains crafted deserialized user data to the affected software. A successful exploit could allow the attacker to execute arbitrary commands with root-level privileges on the affected system which the attacker could use to conduct further attacks. Cisco Bug IDs: CSCvd14591.


A vulnerability in the debug plug-in functionality of the Cisco Unified Computing System (UCS) Manager Cisco Firepower 4100 Series Next-Generation Firewall (NGFW) and Cisco Firepower 9300 Security Appliance could allow an authenticated local attacker to execute arbitrary commands aka Privilege Escalation. More Information: CSCvb86725 CSCvb86797. Known Affected Releases: 2.0(1.68) 3.1(1k)A. Known Fixed Releases: 92.2(1.105) 92.1(1.1733) 2.1(1.69).


QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands via unspecified vectors.


An issue was discovered in network-manager-applet (aka network-manager-gnome) in Ubuntu 12.04 LTS 14.04 LTS 16.04 LTS and 16.10. A local attacker could use this issue at the default Ubuntu login screen to access local files and execute arbitrary commands as the lightdm user. The exploitation requires physical access to the locked computer and the Wi-Fi must be turned on. An access point that lets you use a certificate to login is required as well but it's easy to create one. Then it's possible to open a nautilus window and browse directories. One also can open some applications such as Firefox which is useful for downloading malicious binaries.


The TELNET service in Mobatek MobaXterm 10.4 does not require authentication which allows remote attackers to execute arbitrary commands via TCP port 23.


CSRF exists in Webmin 1.850. By sending a GET request to at/create_job.cgi containing dir=/&cmd= in the URI an attacker to execute arbitrary commands.


http_transport.c in Fossil before 2.4 when the SSH sync protocol is used allows user-assisted remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname a related issue to CVE-2017-9800 CVE-2017-12836 CVE-2017-12976 CVE-2017-14176 CVE-2017-16228 CVE-2017-1000116 and CVE-2017-1000117.


TP-Link

TL-WVR

and

TL-WAR

devices

allow

remote

authenticated

users

to

execute

arbitrary

commands

via

shell

metacharacters

in

the

interface

field

of

an

admin/wportal

command

to

cgi-bin/luci

related

to

the

function

in

in

uhttpd.


GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname located on a \url =\ line in a .lfsconfig file within a repository.


Sangoma NetBorder / Vega Session Controller before 2.3.12-80-GA allows remote attackers to execute arbitrary commands via the web interface.


TP-Link

TL-WVR

and

TL-WAR

devices

allow

remote

authenticated

users

to

execute

arbitrary

commands

via

shell

metacharacters

in

the

interface

field

of

an

admin/dhcps

command

to

cgi-bin/luci

related

to

the

function

in

in

uhttpd.


TP-Link

TL-WVR

TL-WAR

TL-ER

and

TL-R

devices

allow

remote

authenticated

users

to

execute

arbitrary

commands

via

shell

metacharacters

in

the

iface

field

of

an

admin/diagnostic

command

to

cgi-bin/luci

related

to

the

function

in

in

uhttpd.


Summit is a node web framework. When using the PouchDB driver in the module Summit 0.1.0 and later allows an attacker to execute arbitrary commands via the collection name.


Dulwich before 0.18.5 when an SSH subprocess is used allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname a related issue to CVE-2017-9800 CVE-2017-12836 CVE-2017-12976 CVE-2017-1000116 and CVE-2017-1000117.


Xplico before 1.2.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the name of an uploaded PCAP file. NOTE: this issue can be exploited without authentication by leveraging the user registration feature.


TP-Link

TL-WVR

TL-WAR

TL-ER

and

TL-R

devices

allow

remote

authenticated

users

to

execute

arbitrary

commands

via

shell

metacharacters

in

the

field

of

an

admin/interface

command

to

cgi-bin/luci

related

to

the

function

in

in

uhttpd.


TP-Link

TL-WVR

TL-WAR

TL-ER

and

TL-R

devices

allow

remote

authenticated

users

to

execute

arbitrary

commands

via

shell

metacharacters

in

the

field

of

an

admin/bridge

command

to

cgi-bin/luci

related

to

the

function

in

in

uhttpd.


The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts which allows remote attackers to execute arbitrary commands via a crafted Content-Type Content-Disposition or Content-Length HTTP header as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.


OpenText Documentum D2 (formerly EMC Documentum D2) 4.x allows remote attackers to execute arbitrary commands via a crafted serialized Java object related to the BeanShell (bsh) and Apache Commons Collections (ACC) libraries.


An arbitrary command execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.


backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a \--\ command-line option substring as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.


Redmine before 3.2.9 3.3.x before 3.3.6 and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg program which allows remote attackers to execute arbitrary commands (through the Mercurial adapter) via vectors involving a branch whose name begins with a --config= or --debugger= substring a related issue to CVE-2017-17536.


The

Comcast

firmware

on

Cisco

(firmware

version

devices

allows

remote

attackers

to

execute

arbitrary

commands

as

root

by

leveraging

local

network

access

and

connecting

to

the

syseventd

server

as

demonstrated

by

copying

configuration

data

into

a

readable

filesystem.


Aruba ClearPass 6.6.3 and later includes a feature called \SSH Lockout\ which causes ClearPass to lock accounts with too many login failures through SSH. When this feature is enabled an unauthenticated remote command execution vulnerability is present which could allow an unauthenticated user to execute arbitrary commands on the underlying operating system with \root\ privilege level. This vulnerability is only present when a specific feature has been enabled. The SSH Lockout feature is not enabled by default so only systems which have enabled this feature are vulnerable.


The Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) devices allows physically proximate attackers to execute arbitrary commands as root by pulling up the diagnostics menu on the set-top box and then posting to a Web Inspector route.


gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload which can lead to leaving extensions enabled in the lock screen. With these extensions a bystander could launch applications (but not interact with them) see information from the extensions (e.g. what applications you have opened or what music you were playing) or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.


The management interface for the Teltonika RUT9XX routers (aka LuCI) with firmware 00.03.265 and earlier allows remote attackers to execute arbitrary commands with root privileges via shell metacharacters in the username parameter in a login request.


In Veritas NetBackup Appliance 3.0 and earlier unauthenticated users can execute arbitrary commands as root.


ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote attackers to bypass intended access restrictions via a direct request. NOTE: this issue can be combined with CVE-2015-6024 to execute arbitrary commands.


The vertica-udx-zygote process in HP Vertica 7.1.1 UDx does not require authentication which allows remote attackers to execute arbitrary commands via a crafted packet aka ZDI-CAN-2914.


Cisco Prime Network Services Controller 3.0 allows local users to bypass intended access restrictions and execute arbitrary commands via additional parameters to an unspecified command aka Bug ID CSCus99427.


bpcd

in

Veritas

NetBackup

through

through

through

and

before

and

NetBackup

Appliance

through

through

through

and

before

allows

remote

attackers

to

execute

arbitrary

commands

via

crafted

input.


Serialized-object interfaces in VMware vRealize Orchestrator 6.x vCenter Orchestrator 5.x vRealize Operations 6.x vCenter Operations 5.x and vCenter Application Discovery Manager (vADM) 7.x allow remote attackers to execute arbitrary commands via a crafted serialized Java object related to the Apache Commons Collections library.


install.php in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to execute arbitrary commands via the adminPassword parameter a different issue than CVE-2015-7381.


The publish-event event-manager feature in Cisco IOS 15.5(2)S and 15.5(3)S on Cloud Services Router 1000V devices allows local users to execute arbitrary commands with root privileges by leveraging administrative access to enter crafted environment variables aka Bug ID CSCux14943.


The diagnostic-ping implementation on ZyXEL PMG5318-B20A devices with firmware before 1.00(AANC.2)C0 allows remote attackers to execute arbitrary commands via the PingIPAddr parameter.


Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application Service and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video Streaming TelePresence and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object related to the Apache Commons Collections (ACC) library.


ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the DIA_IPADDRESS parameter.


Serialized-object interfaces in certain IBM analytics business solutions cognitive IT infrastructure and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object related to the InvokerTransformer class in the Apache Commons Collections library.


Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x 5.x and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object related to the Apache Commons Collections (ACC) library.


The default configuration of the server in MobaXterm before 8.3 has a disabled Access Control setting and consequently does not require authentication for X11 connections which allows remote attackers to execute arbitrary commands or obtain sensitive information via X11 packets.


SolarWinds

Log

and

Event

Manager

(LEM)

allows

remote

attackers

to

execute

arbitrary

commands

on

managed

computers

via

a

request

to

services/messagebroker/nonsecurestreamingamf

involving

the

traceroute

functionality.


Adobe

Reader

and

Acrobat

before

and

before

Acrobat

and

Acrobat

Reader

DC

Classic

before

and

Acrobat

and

Acrobat

Reader

DC

Continuous

before

on

Windows

and

OS

X

allow

attackers

to

bypass

JavaScript

API

execution

restrictions

and

execute

arbitrary

commands

via

an

app.launchURL

call

a

different

vulnerability

than

and


redhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager (aka RHEV Manager) before 3.6 allows remote authenticated users with the SuperUser role on any Entity to execute arbitrary commands on any host in the RHEV environment.


ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to execute arbitrary commands via unspecified vectors.


rubygem-openshift-origin-console in Red Hat OpenShift 2.2 allows remote authenticated users to execute arbitrary commands via a crafted request to the Broker.


BitTorrent and uTorrent allow remote attackers to inject command line parameters and execute arbitrary commands via a crafted URL using the (1) bittorrent or (2) magnet protocol.


The portal in IBM Tivoli Monitoring (ITM) 6.2.2 through FP9 6.2.3 through FP5 and 6.3.0 before FP7 allows remote authenticated users to execute arbitrary commands by leveraging Take Action view authority and providing crafted input.


The Switch Configuration Tools Backend (clcmd_server) in Cumulus Linux 2.5.3 and earlier allows local users to execute arbitrary commands via shell metacharacters in a cl-rctl command label.


The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via \escape characters\ in a URL.


The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.


Apache Camel 2.6.x through 2.14.x 2.15.x before 2.15.5 and 2.16.x before 2.16.1 when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.


Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW_PASSWORD_1 or (2) NEW_PASSWORD_2 parameter to cgi-bin/chpasswd.cgi.


Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the id parameter to ADMIN/mailqueue.spl.


The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values which might allow attackers to execute arbitrary commands by leveraging a crafted LDAP entry that is interpreted as a formula when imported into a spreadsheet.


eventapp/lib/gcloud.rb in the ISUCON5 qualifier portal (aka eventapp) web application before 2015-10-30 makes improper popen calls which allows remote attackers to execute arbitrary commands via an HTTP request that includes shell metacharacters in an argument to a \gcloud compute\ command.


Belkin N300 Dual-Band Wi-Fi Range Extender with firmware before 1.04.10 allows remote authenticated users to execute arbitrary commands via the (1) sub_dir parameter in a formUSBStorage request; pinCode parameter in a (2) formWpsStart or (3) formiNICWpsStart request; (4) wps_enrolee_pin parameter in a formWlanSetupWPS request; or unspecified parameters in a (5) formWlanMP (6) formBSSetSitesurvey (7) formHwSet or (8) formConnectionSetting request.


Cisco Unified Communications Manager IM and Presence Service 9.1(1) does not properly restrict access to encrypted passwords which allows remote attackers to determine cleartext passwords and consequently execute arbitrary commands by visiting an unspecified web page and then conducting a decryption attack aka Bug ID CSCuq46194.


IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges by leveraging admin access.


The asset discovery scanner in AlienVault OSSIM before 5.0.1 allows remote authenticated users to execute arbitrary commands via the assets array parameter to netscan/do_scan.php.


cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute arbitrary commands via a file containing filenames with shell metacharacters as demonstrated by using the backup comments feature to create the file.


Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup parameter to list/backup/index.php.


The log-gather implementation in the web administration interface in EMC Isilon OneFS 6.5.x.x through 7.1.1.x before 7.1.1.5 and 7.2.0.x before 7.2.0.2 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors.


The

WLS

Security

component

in

Oracle

WebLogic

Server

and

allows

remote

attackers

to

execute

arbitrary

commands

via

a

crafted

serialized

Java

object

in

protocol

traffic

to

TCP

port

related

to

NOTE:

the

scope

of

this

CVE

is

limited

to

the

WebLogic

Server

product.


ftagent.exe in EMC AutoStart 5.4.x and 5.5.x before 5.5.0.508 HF4 allows remote attackers to execute arbitrary commands via crafted packets.


Cisco UCS Central Software before 1.3(1a) allows remote attackers to execute arbitrary commands via a crafted HTTP request aka Bug ID CSCut46961.


The DHCP implementation in the PowerOn Auto Provisioning (POAP) feature in Cisco NX-OS does not properly restrict the initialization process which allows remote attackers to execute arbitrary commands as root by sending crafted response packets on the local network aka Bug ID CSCur14589.


svn-workbench 1.6.2 and earlier on a system with xeyes installed allows local users to execute arbitrary commands by using the \Command Shell\ menu item while in the directory trunk/$(xeyes).


Cool Projects TarDiff allows remote attackers to execute arbitrary commands via shell metacharacters in the name of a (1) tar file or (2) file within a tar file.


A certain Cisco JAR file as distributed in Cache Cleaner in Cisco Secure Desktop (CSD) allows remote attackers to execute arbitrary commands via a crafted web site aka Bug ID CSCup83001.


osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.


The web framework in Cisco TelePresence Advanced Media Gateway Series Software before 1.1(1.40) Cisco TelePresence IP Gateway Series Software Cisco TelePresence IP VCR Series Software before 3.0(1.27) Cisco TelePresence ISDN Gateway Software before 2.2(1.94) Cisco TelePresence MCU Software before 4.4(3.54) and 4.5 before 4.5(1.45) Cisco TelePresence MSE Supervisor Software before 2.3(1.38) Cisco TelePresence Serial Gateway Series Software before 1.0(1.42) Cisco TelePresence Server Software for Hardware before 3.1(1.98) and Cisco TelePresence Server Software for Virtual Machine before 4.1(1.79) allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors aka Bug IDs CSCul55968 CSCur08993 CSCur15803 CSCur15807 CSCur15825 CSCur15832 CSCur15842 CSCur15850 and CSCur15855.


App/HelperFunctions.pm in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image name that is mishandled during a \Show in Folder\ action.


The

function

in

in

Centreon

(formerly

Merethis

Centreon)

and

earlier

(fixed

in

Centreon

uses

an

incorrect

regular

expression

which

allows

remote

authenticated

users

to

execute

arbitrary

commands

via

shell

metacharacters

in

the

parameter.


The do_ed_script function in pch.c in GNU patch through 2.7.6 and patch in FreeBSD 10.1 before 10.1-RELEASE-p17 10.2 before 10.2-BETA2-p3 10.2-RC1 before 10.2-RC1-p2 and 0.2-RC2 before 10.2-RC2-p1 allows remote attackers to execute arbitrary commands via a crafted patch file because a '!' character can be passed to the ed program.


radexecd.exe in Persistent Systems Radia Client Automation (RCA) 7.9 8.1 9.0 and 9.1 allows remote attackers to execute arbitrary commands via a crafted request to TCP port 3465.


The \RAP console\ feature in ArubaOS 5.x through 6.2.x 6.3.x before 6.3.1.15 and 6.4.x before 6.4.2.4 on Aruba access points in Remote Access Point (AP) mode allows remote attackers to execute arbitrary commands via unspecified vectors.


The get_rpm_nvr_by_file_path_temporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file name.


The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian when using dash does not properly handle local variables which allows remote attackers to execute arbitrary commands via a crafted file.


The GMS ViewPoint (GMSVP) web application in Dell Sonicwall GMS Analyzer and UMA EM5000 before 7.2 SP4 allows remote authenticated users to execute arbitrary commands via vectors related to configuration.


D-Link DAP-1320 Rev Ax with firmware before 1.21b05 allows attackers to execute arbitrary commands via unspecified vectors.


The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.


The network diagnostics tool (CommandLineServlet) in the Appliance Manager command line utility (CLU) in Websense TRITON 7.8.3 and V-Series appliances before 7.8.4 Hotfix 02 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the \second\ parameter of a command as demonstrated by the Destination parameter in the ping command.


The logrotation script (/etc/cron.daily/upstart) in the Ubuntu Upstart package before 1.13.2-0ubuntu9 as used in Ubuntu Vivid 15.04 allows local users to execute arbitrary commands and gain privileges via a crafted file in /run/user/*/upstart/sessions/.


BitTorrent Sync allows remote attackers to execute arbitrary commands via a crafted btsync: link.


Anyterm Daemon in Infoblox Network Automation NetMRI before NETMRI-23483 allows remote attackers to execute arbitrary commands with root privileges via a crafted terminal/anyterm-module request.


The saveObject function in moadmin.php in phpMoAdmin 1.1.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the object parameter.


The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1420434000 allows remote attackers to execute arbitrary commands via the $action portion of the PATH_INFO.


The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1421902800 allows remote attackers to execute arbitrary commands via the $type portion of the PATH_INFO.


The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password.


The xmlrpc.cgi Webmin script in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors.


The devtools.sh script in AXIS network cameras allows remote authenticated users to execute arbitrary commands via shell metacharacters in the app parameter to (1) app_license.shtml (2) app_license_custom.shtml (3) app_index.shtml or (4) app_params.shtml.


The generate_smb_nt_hash function in include/functions.inc in GOsa allows remote attackers to execute arbitrary commands via a crafted password.


Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.4.0 and in foomatic-filters in Foomatic 4.0.x allows remote attackers to execute arbitrary commands via a ; (semicolon) character in a print job a different vulnerability than CVE-2015-8327.


The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.


OSSP shiela 1.1.5 and earlier allows remote authenticated users to execute arbitrary commands on the CVS server via shell metacharacters in a filename that is committed.


Unspecified vulnerability in the command line interface (CLI) in Cisco Unified CallManager (CUCM) 5.0(1) through 5.0(3a) allows local users to execute arbitrary commands with elevated privileges via unspecified vectors involving \certain CLI commands \ aka bug CSCse11005.


The Management Console server in EMC NetWorker (formerly Legato NetWorker) 7.3.2 before Jumbo Update 1 uses weak authentication which allows remote attackers to execute arbitrary commands.


M4 Macro Library in Symantec Security Information Manager before 4.0.2.29 HOTFIX 1 allows local users to execute arbitrary commands via crafted \rule definitions\ which produces dangerous Java code during M4 transformation.


c2faxrecv in capi4hylafax 01.02.03 allows remote attackers to execute arbitrary commands via null (\\0) and shell metacharacters in the TSI string as demonstrated by a fax from an anonymous number.


PHP remote file inclusion vulnerability in Core CoreNews 2.0.1 and earlier allows remote authenticated users to execute arbitrary commands via the show parameter. NOTE: this is a different vector than CVE-2006-1212 although it might be the same primary issue.


ping.php in Russcom.Ping allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter.


Untrusted search path vulnerability in opcontrol in OProfile 0.9.1 and earlier allows local users to execute arbitrary commands via a modified PATH that references malicious (1) which or (2) dirname programs. NOTE: while opcontrol normally is not run setuid a common configuration suggests accessing opcontrol using sudo. In such a context this is a vulnerability.


Unspecified vulnerability in context.py in Albatross web application toolkit before 1.33 allows remote attackers to execute arbitrary commands via unspecified vectors involving template files and the \handling of submitted form fields\.


Etomite Content Management System 0.6 and possibly earlier versions when downloaded from the web site in January 2006 after January 10 contains a back door in manager/includes/todo.inc.php which allows remote attackers to execute arbitrary commands via the \cij\ parameter.


Format string vulnerability in a logging function as used by various SFTP servers including (1) AttachmateWRQ Reflection for Secure IT UNIX Server before 6.0.0.9 (2) Reflection for Secure IT Windows Server before 6.0 build 38 (3) F-Secure SSH Server for Windows before 5.3 build 35 (4) F-Secure SSH Server for UNIX 3.0 through 5.0.8 (5) SSH Tectia Server 4.3.6 and earlier and 4.4.0 and (6) SSH Shell Server 3.2.9 and earlier allows remote authenticated users to execute arbitrary commands via unspecified vectors involving crafted filenames and the stat command.


The \Open 'safe' files after downloading\ option in Safari on Apple Mac OS X allows remote user-assisted attackers to execute arbitrary commands by tricking a user into downloading a __MACOSX folder that contains metadata (resource fork) that invokes the Terminal which automatically interprets the script using bash as demonstrated using a ZIP file that contains a script with a safe file extension.


Unspecified vulnerability in WeBWorK 2.1.3 and 2.2-pre1 allows remote privileged attackers to execute arbitrary commands as the web server via unknown attack vectors.


scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces which are expanded twice.


myquiz.pl in Dale Ray MyQuiz 1.01 allows remote attackers to execute arbitrary commands via shell metacharacters in the URL which are not properly handled as part of the PATH_INFO environment variable.


** DISPUTED ** Multiple PHP remote file include vulnerabilities in dotProject 2.0.1 and earlier when register_globals is enabled allow remote attackers to execute arbitrary commands via the baseDir parameter in (1) db_adodb.php (2) db_connect.php (3) session.php (4) vw_usr_roles.php (5) calendar.php (6) date_format.php and (7) tasks/gantt.php; and the dPconfigroot_dir parameter in (8) projects/gantt.php (9) gantt2.php and (10) vw_files.php. NOTE: the vendor disputes this issue stating that the product documentation clearly recommends that the system administrator disable register_globals and that the check.php script warns against this setting. Also the vendor says that the protection.php/siteurl vector is incorrect because protection.php does not exist in the product.


Unspecified vulnerability in mklvcopy in BOS.RTE.LVM in IBM AIX 5.3 allows local users to execute arbitrary commands when mklvcopy calls external commands possibly due to an untrusted search path vulnerability.


Unspecified vulnerability in VCEngine.php in v-creator before 1.3-pre3 when the VC_CRYPTO_METHOD option is OPENSSL allows remote attackers to execute arbitrary commands possibly due to problems in the (1) encrypt and (2) decrypt functions.


censtore.cgi in Censtore 7.3.002 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter.


Sun Java Studio Enterprise 8 when installed as root creates certain files with world-writable permissions which allows local users to execute arbitrary commands via unspecified vectors.


Unspecified vulnerability in index.php in Core CoreNews 2.0.1 allows remote attackers to execute arbitrary commands via the page parameter possibly due to a PHP remote file include vulnerability. NOTE: this vulnerability could not be confirmed by source code inspection of CoreNews 2.0.1 which does not appear to use a \page\ parameter or variable.


lib/exec/fetch.php in DokuWiki before 2006-03-09e when confimconvert is configured to use ImageMagick allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) w and (2) h parameters which are not filtered when invoking convert.


CRLF injection vulnerability in the evalFolderLine function in fvwm 2.5.18 and earlier allows local users to execute arbitrary commands via carriage returns in a directory name which is not properly handled by fvwm-menu-directory a variant of CVE-2003-1308.


The spell checking component of (1) Asbru Web Content Management before 6.1.22 (2) Asbru Web Content Editor before 6.0.22 and (3) Asbru Website Manager before 6.0.22 allows remote attackers to execute arbitrary commands via an unspecified parameter that is not sanitized before Aspell is invoked.


procmail in Ingo H3 before 1.1.2 Horde module allows remote authenticated users to execute arbitrary commands via shell metacharacters in the mailbox destination of a filter rule.


Unspecified vulnerability in bos.net.tcp.client in IBM AIX 5.2.0 and 5.3.0 allows local users to execute arbitrary commands via unspecified vectors involving /etc/slip.login.


Unspecified vulnerability in utape in IBM AIX 5.2.0 and 5.3.0 allows attackers to execute arbitrary commands and overwrite arbitrary files via unspecified vectors.


eoc.py in Enemies of Carlotta (EoC) before 1.2.4 allows remote attackers to execute arbitrary commands via shell metacharacters in an \SMTP level e-mail address\.


pstotext before 1.9 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a file name.


The NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0_MP7 5.1 before 5.1_MP6 and 6.0 before 6.0_MP4 does not properly check for chained commands which allows remote attackers to execute arbitrary commands by appending malicious commands to valid commands.


Argument injection vulnerability in the Windows Object Packager (packager.exe) in Microsoft Windows XP SP1 and SP2 and Server 2003 SP1 and earlier allows remote user-assisted attackers to execute arbitrary commands via a crafted file with a \/\ (slash) character in the filename of the Command Line property followed by a valid file extension which causes the command before the slash to be executed aka \Object Packager Dialogue Spoofing Vulnerability.\


idmlib.sh in nxdrv in Novell Identity Manager (IDM) 3.0.1 allows local users to execute arbitrary commands via unspecified vectors possibly involving the \ (quote) and \\ (backslash) characters and eval injection.


SQL injection vulnerability in Cacti 0.8.6i and earlier when register_argc_argv is enabled allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd.php. NOTE: this issue can be leveraged to execute arbitrary commands since the SQL query results are later used in the polling_items array and popen function.


Microsoft Internet Information Services (IIS) 5.1 permits the IUSR_Machine account to execute non-EXE files such as .COM files which allows attackers to execute arbitrary commands via arguments to any .COM file that executes those arguments as demonstrated using win.com when it is in a web directory with certain permissions.


maketorrent.php in TorrentFlux 2.2 allows remote authenticated users to execute arbitrary commands via shell metacharacters (\;\ semicolon) in the announce parameter.


in

through

and

with

the

rtehtmlarea

extension

and

beta

allows

remote

authenticated

users

to

execute

arbitrary

commands

via

shell

metacharacters

in

the

userUid

parameter

to

and

possibly

another

vector.


metaInfo.php in TorrentFlux 2.2 when $cfg\enable_file_priority\ is false allows remote attackers to execute arbitrary commands via shell metacharacters (backticks) in the torrent parameter to (1) details.php and (2) startpop.php.


Acer Notebook LunchApp.APlunch ActiveX control allows remote attackers to execute arbitrary commands by calling the Run method.


execInBackground.php in J-OWAMP Web Interface 2.1b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters to the (1) exe and (2) args parameters which are used in an exec function call. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts probably including construction of an unzip command line which allows attackers to execute arbitrary commands via shell metacharacters.


index.php for TorrentFlux 2.2 allows remote registered users to execute arbitrary commands via shell metacharacters in the kill parameter.


Coalescent Systems freePBX (formerly Asterisk Management Portal) before 2.2.0rc1 allows attackers to execute arbitrary commands via shell metacharacters in (1) CALLERID(name) or (2) CALLERID(number).


The edit_textarea function in form-file.c in Netrik 1.15.4 and earlier does not properly verify temporary filenames when editing textarea fields which allows attackers to execute arbitrary commands via shell metacharacters in the filename.


scart.cgi in SCart 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter of a show_text action.


webcart.cgi in Mountain Network Systems WebCart 8.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the NEXTPAGE parameter.


edit_image.php in Vibechild Directory Manager before 0.91 allows remote attackers to execute arbitrary commands via shell metacharacters in the userfile_name parameter which is sent unfiltered to the PHP passthru function.


PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.


FTP Voyager ActiveX control before 8.0 when it is marked as safe for scripting (the default) or if allowed by the IObjectSafety interface allows remote attackers to execute arbitrary commands.


udirectory.pl in Microburst Technologies uDirectory 2.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the category_file field.


CardBoard 2.4 greeting card CGI by Michael Barretto allows remote attackers to execute arbitrary commands via shell metacharacters in the recipient field.


eshop.pl in WebDiscount(e)shop allows remote attackers to execute arbitrary commands via shell metacharacters in the seite parameter.


sendmessage.cgi in W3Mail 1.0.2 and possibly other CGI programs allows remote attackers to execute arbitrary commands via shell metacharacters in any field of the 'Compose Message' page.


A module in Roxen 2.0 before 2.0.92 and 2.1 before 2.1.264 does not properly decode UTF-8 Mac and ISO-2202 encoded URLs which could allow a remote attacker to execute arbitrary commands or view arbitrary files via an encoded URL.


phpMyAdmin 2.2.0rc3 and earlier allows remote attackers to execute arbitrary commands by inserting them into (1) the strCopyTableOK argument in tbl_copy.php or (2) the strRenameTableOK argument in tbl_rename.php.


Un-CGI 1.9 and earlier does not verify that a CGI script has the execution bits set before executing it which allows remote attackers to execute arbitrary commands by directing Un-CGI to a document that begins with \#!\ and the desired program name.


run.cgi in Webmin 0.80 and 0.88 creates temporary files with world-writable permissions which allows local users to execute arbitrary commands.


Matrix CGI vault Last Lines 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the $error_log variable.


csvform.pl 0.1 allows remote attackers to execute arbitrary commands via metacharacters in the file parameter.


book.cgi in NetCode NC Book 0.2b allows remote attackers to execute arbitrary commands via shell metacharacters in the \current\ parameter.


network_query.php in Network Query Tool 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the target parameter.


Lotus Notes R5 Client 4.6 allows remote attackers to execute arbitrary commands via a Lotus Notes object with code in an event which is automatically executed when the user processes the e-mail message.


Sdbsearch.cgi in SuSE Linux 6.0-7.2 could allow remote attackers to execute arbitrary commands by uploading a keylist.txt file that contains filenames with shell metacharacters then causing the file to be searched using a .. in the HTTP referer (from the HTTP_REFERER variable) to point to the directory that contains the keylist.txt file.


lpd daemon (in.lpd) in Solaris 8 and earlier allows remote attackers to execute arbitrary commands via a job request with a crafted control file that is not properly handled when lpd invokes a mail program. NOTE: this might be the same vulnerability as CVE-2000-1220.


fortran math component in Infobot 0.44.5.3 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters.


MailMan Webmail 3.0.25 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the alternate_template parameter.


Sendpage.pl allows remote attackers to execute arbitrary commands via a message containing shell metacharacters.


shopplus.cgi in ShopPlus shopping cart allows remote attackers to execute arbitrary commands via shell metacharacters in the \file\ parameter.


Microsoft Windows 2000 telnet service creates named pipes with predictable names and does not properly verify them which allows local users to execute arbitrary commands by creating a named pipe with the predictable name and associating a malicious program with it the first of two variants of this vulnerability.


wu-ftpd 2.6.1 allows remote attackers to execute arbitrary commands via a \~{\ argument to commands such as CWD which is not properly handled by the glob function (ftpglob).


register.cgi in Ikonboard 2.1.7b and earlier allows remote attackers to execute arbitrary commands via the SEND_MAIL parameter which overwrites an internal program variable that references a program to be executed.


nph-maillist.pl allows remote attackers to execute arbitrary commands via shell metacharacters (\`\) in the email address.


Vulnerabilities in CGI scripts in susehelp in SuSE 7.2 and 7.3 allow remote attackers to execute arbitrary commands by not opening files securely.


Carello E-Commerce 1.2.1 and earlier allows a remote attacker to gain additional privileges and execute arbitrary commands via a specially constructed URL.


Lars Ellingsen guestserver.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the \email\ parameter.


statsconfig.pl in OmniHTTPd 2.07 allows remote attackers to execute arbitrary commands via the mostbrowsers parameter whose value is used as part of a generated Perl script.


Microsoft Windows 2000 telnet service creates named pipes with predictable names and does not properly verify them which allows local users to execute arbitrary commands by creating a named pipe with the predictable name and associating a malicious program with it the second of two variants of this vulnerability.


Textor Webmasters Ltd listrec.pl CGI program allows remote attackers to execute arbitrary commands via shell metacharacters in the TEMPLATE parameter.


vim (aka gvim) processes VIM control codes that are embedded in a file which could allow attackers to execute arbitrary commands when another user opens a file containing malicious VIM control codes.


licq before 1.0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.


Internet Explorer 5.5 and earlier executes Telnet sessions using command line arguments that are specified by the web site which could allow remote attackers to execute arbitrary commands if the IE client is using the Telnet client provided in Services for Unix (SFU) 2.0 which creates session transcripts.


The BAT! mail client allows remote attackers to bypass user warnings of an executable attachment and execute arbitrary commands via an attachment whose file name contains many spaces which also causes the BAT! to misrepresent the attachment's type with a different icon.


lpsched in IRIX 6.5.13f and earlier allows remote attackers to execute arbitrary commands via shell metacharacters.


PGPMail.pl 1.31 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) recipient or (2) pgpuserid parameters.


mailnews.cgi 1.3 and earlier allows remote attackers to execute arbitrary commands via a user name that contains shell metacharacters.


Unknown vulnerability in netprint in IRIX 6.2 and possibly other versions allows local users with lp privileges attacker to execute arbitrary commands via the -n option.


Vulnerability in (1) Microsoft Excel 2002 and earlier and (2) Microsoft PowerPoint 2002 and earlier allows attackers to bypass macro restrictions and execute arbitrary commands by modifying the data stream in the document.


gnatsweb.pl in GNATS GnatsWeb 2.7 through 3.95 allows remote attackers to execute arbitrary commands via certain characters in the help_file parameter.


shop.pl in Hassan Consulting Shopping Cart 1.23 allows remote attackers to execute arbitrary commands via shell metacharacters in the \page\ parameter.


docview before 1.0-15 allows remote attackers to execute arbitrary commands via shell metacharacters that are processed when converting a man page to a web page.


bslist.cgi mailing list script allows remote attackers to execute arbitrary commands via shell metacharacters in the email address.


Microsoft Outlook View ActiveX Control in Microsoft Outlook 2002 and earlier allows remote attackers to execute arbitrary commands via a malicious HTML e-mail message or web page.


UploadServlet in Bajie HTTP JServer 0.78 and possibly other versions before 0.80 allows remote attackers to execute arbitrary commands by calling the servlet to upload a program then using a ... (modified ..) to access the file that was created for the program.


PALS Library System pals-cgi program allows remote attackers to execute arbitrary commands via shell metacharacters in the documentName parameter.


bsguest.cgi guestbook script allows remote attackers to execute arbitrary commands via shell metacharacters in the email address.


Heap overflow in FTP daemon in Solaris 8 allows remote attackers to execute arbitrary commands by creating a long pathname and calling the LIST command which uses glob to generate long strings.


The default permissions for the RAS Administration key in Windows NT 4.0 allows local users to execute arbitrary commands by changing the value to point to a malicious DLL aka one of the \Registry Permissions\ vulnerabilities.


ovactiond in HP OpenView Network Node Manager (NNM) 6.1 and Tivoli Netview 5.x and 6.x allows remote attackers to execute arbitrary commands via shell metacharacters in a certain SNMP trap message.


dcboard.cgi in DCForum 2000 1.0 allows remote attackers to execute arbitrary commands by uploading a Perl program to the server and using a .. (dot dot) in the AZ parameter to reference the program.


Internet Explorer 5.1 for Macintosh on Mac OS X allows remote attackers to execute arbitrary commands by causing a BinHex or MacBinary file type to be downloaded which causes the files to be executed if automatic decoding is enabled.


The default keybindings for wwm in LTSP Display Manager (ldm) 2.2.x before 2.2.7 allow remote attackers to execute arbitrary commands via the KP_RETURN keybinding which launches a terminal window.


osc before 0.134 might allow remote OBS repository servers or package maintainers to execute arbitrary commands via a crafted (1) build log or (2) build status that contains an escape sequence for a terminal emulator.


Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13 and Puppet Enterprise (PE) Users 1.0 1.1 1.2.x 2.0.x and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters then performing a filebucket request.


kg_callffmpeg.php in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to execute arbitrary commands via unspecified vectors.


webglimpse.cgi in Webglimpse before 2.20.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter as exploited in the wild in March 2012.


** DISPUTED ** The DebuggingInterceptor component in Apache Struts before 2.3.1.1 when developer mode is used allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not \a security vulnerability itself.\


op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the password parameter.


interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter.


InfoSphere Import Export Manager in InfoSphere Information Server MetaBrokers & Bridges (MBB) in IBM InfoSphere Information Server 8.1 8.5 before FP3 8.7 and 9.1 does not validate unspecified input data which allows remote authenticated users to execute arbitrary commands via unknown vectors.


The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.


license.php in system-portal before 1.6.2 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the timestamp parameter for an install action.


main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24 1.8.x before 1.8.11.1 and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4 does not properly enforce System class authorization requirements which allows remote authenticated users to execute arbitrary commands via (1) the originate action in the MixMonitor application (2) the SHELL and EVAL functions in the GetVar manager action or (3) the SHELL and EVAL functions in the Status manager action.


scripts/dget.pl in devscripts before 2.10.73 allows remote attackers to execute arbitrary commands via a crafted (1) .dsc or (2) .changes file related to \arguments to external commands\ that are not properly escaped a different vulnerability than CVE-2012-2240.


The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.


lhn/public/network/ping in HP SAN/iQ 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) first (2) third or (3) fourth parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4361.


file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname as demonstrated by a | (pipe) character.


The exec_command function in common/helpers.py in Gajim before 0.15 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in an href attribute.


The loopback plug-in in ConnMan before 0.85 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) host name or (2) domain name in a DHCP reply.


cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters which might allow user-assisted remote attackers to inject terminal emulator escape sequences and execute arbitrary commands or delete arbitrary files via a crafted HTTP request.


scripts/dscverify.pl in devscripts before 2.12.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to \arguments to external commands.\


The Sleipnir Mobile application 2.2.0 and earlier and Sleipnir Mobile Black Edition application 2.2.0 and earlier for Android allow remote attackers to execute arbitrary Java methods and obtain sensitive information or execute arbitrary commands via a crafted web site.


The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary commands via a PDF containing an escape sequence for a terminal emulator.


Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1 Certified Asterisk 1.8.11 before 1.8.11-cert6 Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones and Asterisk Business Edition C.3.x before C.3.7.6 allows remote authenticated users to execute arbitrary commands by leveraging originate privileges and providing an ExternalIVR value in an AMI Originate action.


An unspecified API on Cisco TelePresence Immersive Endpoint Devices before 1.9.1 allows remote attackers to execute arbitrary commands by leveraging certain adjacency and sending a malformed request on TCP port 61460 aka Bug ID CSCtz38382.


The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server).


Config/diff.php in Basilic 1.5.14 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter.


The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket notation which allows context-dependent attackers to execute arbitrary commands via crafted input to an application that accepts translation strings from users as demonstrated by the TWiki application before 5.1.3 and the Foswiki application 1.0.x through 1.0.10 and 1.1.x through 1.1.6.


REDCap before 4.14.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the logic of a custom rule.


Cisco Prime LAN Management Solution (LMS) 4.1 through 4.2.2 on Linux does not properly validate authentication and authorization requests in TCP sessions which allows remote attackers to execute arbitrary commands via a crafted session aka Bug ID CSCuc79779.


Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote authenticated users to execute arbitrary commands as demonstrated by a ; (semicolon) to the ping command feature.


Cisco NX-OS allows local users to gain privileges and execute arbitrary commands via shell metacharacters in unspecified command parameters aka Bug IDs CSCtf19827 and CSCtf27788.


The Amazon Lab126 com.lab126.system sendEvent implementation on the Kindle Touch before 5.1.2 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a string as demonstrated by using lipc-set-prop to set an LIPC property a different vulnerability than CVE-2012-4248.


The scriptfu network server in GIMP 2.6 does not require authentication which allows remote attackers to execute arbitrary commands via the python-fu-eval command.


Cisco NX-OS allows local users to gain privileges and execute arbitrary commands via shell metacharacters in a command that calls the system library function aka Bug IDs CSCtf23559 and CSCtf27780.


A cluster setup script for fabric interconnect devices in Cisco Unified Computing System (UCS) allows remote attackers to execute arbitrary commands via invalid parameters aka Bug ID CSCtg20793.


The Cybozu Live application 1.0.4 and earlier for Android allows remote attackers to execute arbitrary Java methods and obtain sensitive information or execute arbitrary commands via a crafted web site.


Midnight Commander (mc) 4.8.5 does not properly handle the (1) MC_EXT_SELECTED or (2) MC_EXT_ONLYTAGGED environment variables when multiple files are selected which allows user-assisted remote attackers to execute arbitrary commands via a crafted file name.


The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9 2.10 and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action.


The fabric-interconnect component in Cisco Unified Computing System (UCS) uses the same privilege level for execution of every script which allows local users to gain privileges and execute arbitrary commands via an unspecified script-execution approach aka Bug ID CSCtq86477.


The fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges and execute arbitrary commands via crafted parameters to a file-related command aka Bug ID CSCtq86489.


Cisco NX-OS allows local users to gain privileges and execute arbitrary commands via the sed e option aka Bug IDs CSCtf25457 and CSCtf27651.


lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the second parameter.


A setup script for fabric interconnect devices in Cisco Unified Computing System (UCS) allows remote attackers to execute arbitrary commands via invalid parameters aka Bug ID CSCtg20790.


The Cybozu KUNAI application before 2.0.6 for Android allows remote attackers to execute arbitrary Java methods and obtain sensitive information or execute arbitrary commands via a crafted web site.


Unspecified vulnerability in the CLA2 server in IBM Gentran Integration Suite 4.3 Sterling Integrator 5.0 and 5.1 and Sterling B2B Integrator 5.2 as used in IBM Sterling File Gateway 1.1 through 2.2 and other products allows remote attackers to execute arbitrary commands via unknown vectors.


The hook_process function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a command from a plugin related to \shell expansion.\


ping.php on the Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA management server) Sinapsi eSolar and Sinapsi eSolar DUO with firmware before 2.0.2870_2.2.12 allows remote attackers to execute arbitrary commands via shell metacharacters in the ip_dominio parameter.


The send_to_sourcefire function in manage_sql.c in OpenVAS Manager 3.x before 3.0.4 allows remote attackers to execute arbitrary commands via the (1) IP address or (2) port number field in an OMP request.


Cisco Prime Data Center Network Manager (DCNM) before 6.1(1) does not properly restrict access to certain JBoss MainDeployer functionality which allows remote attackers to execute arbitrary commands via JBoss Application Server Remote Method Invocation (RMI) services aka Bug ID CSCtz44924.


node-util/www/html/restorer.php in the Red Hat OpenShift Origin before 1.0.5-3 allows remote attackers to execute arbitrary commands via a crafted uuid in the PATH_INFO.


CA XCOM Data Transport r11.0 and r11.5 on UNIX and Linux allows remote attackers to execute arbitrary commands via a crafted request.


Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddressTB parameter to (1) remoteAttack.pl or (2) guessPassword.pl in frameworkgui/; the filename parameter to (3) CSAttack.pl or (4) SEAttack.pl in frameworkgui/; the phNo2Attack parameter to (5) CSAttack.pl or (6) SEAttack.pl in frameworkgui/; the (7) platformDD2 parameter to frameworkgui/SEAttack.pl; the (8) agentURLPath or (9) agentControlKey parameter to frameworkgui/attach2agents.pl; or the (10) controlKey parameter to frameworkgui/attachMobileModem.pl. NOTE: The hostingPath parameter to CSAttack.pl and SEAttack.pl vectors and the appURLPath parameter to attachMobileModem.pl vector are covered by CVE-2012-5878.


Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostingPath parameter to (1) SEAttack.pl or (2) CSAttack.pl in frameworkgui/ or the (3) appURLPath parameter to frameworkgui/attachMobileModem.pl.


FreeSWITCH through 1.8.2 when mod_xml_rpc is enabled allows remote attackers to execute arbitrary commands via the api/system or txtapi/system (or api/bg_system or txtapi/bg_system) query string on TCP port 8080 as demonstrated by an api/system?calc URI. This can also be exploited via CSRF. Alternatively the default password of works for the freeswitch account can sometimes be used.


OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.


An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code) an unescaped filename string is used to construct a shell command. This vulnerability can be abused by a malicious authenticated user to execute arbitrary commands by tweaking the original filename of the STIX import.


If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipulate the rpm listing (e.g. with CVE-2018-19638) he can execute arbitrary commands as root.


An issue was discovered in ADTRAN PMAA 1.6.2-1 1.6.3 and 1.6.4. NETCONF Access Management (NACM) allows unprivileged users to create privileged users and execute arbitrary commands via the use of the diagnostic-profile over RESTCONF.


The Floureon IP Camera SP012 provides a root terminal on a UART serial interface without proper access control. This allows attackers with physical access to execute arbitrary commands with root privileges.


Digi TransPort LR54 4.4.0.26 and possible earlier devices have Improper Input Validation that allows users with 'super' CLI access privileges to bypass a restricted shell and execute arbitrary commands as root.


eScan Agent Application (MWAGENT.EXE) 4.0.2.98 in MicroWorld Technologies eScan 14.0 allows remote or local attackers to execute arbitrary commands by sending a carefully crafted payload to TCP port 2222.


An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Insecure permissions in a service interface may allow authenticated attackers in the adjacent network to execute arbitrary commands on the operating system.


Concatenating unsanitized user input in the `whereis` npm module < 0.4.1 allowed an attacker to execute arbitrary commands. The `whereis` module is deprecated and it is recommended to use the `which` npm module instead.


TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the wps_setup_pin parameter to /data/wps.setup.json.


The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions which allows unprivileged local users to execute arbitrary commands via modification of the CorsairService BINARY_PATH_NAME leading to complete control of the affected system. The issue exists due to the Windows \Everyone\ group being granted SERVICE_ALL_ACCESS permissions to the CorsairService Service.


QQQ SYSTEMS version 2.24 allows an attacker to execute arbitrary commands via unspecified vectors.


A vulnerability in the role-based access-checking mechanisms of Cisco Unified Computing System (UCS) Software could allow an authenticated local attacker to execute arbitrary commands on an affected system. The vulnerability exists because the affected software lacks proper input and validation checks for certain file systems. An attacker could exploit this vulnerability by issuing crafted commands in the CLI of an affected system. A successful exploit could allow the attacker to cause other users to execute unwanted arbitrary commands on the affected system. Cisco Bug IDs: CSCvf52994.


A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability exist because the affected software improperly sanitizes command arguments failing to prevent access to certain internal data structures on an affected device. An attacker who has privileged EXEC mode (privilege level 15) access to an affected device could exploit these vulnerabilities on the device by executing CLI commands that contain custom arguments. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the affected device.


A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated remote attacker to log in to an affected system by using an administrative account that has default static user credentials. The vulnerability is due to the presence of undocumented static user credentials for the default administrative account for the affected software. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands with root privileges. This vulnerability affects all releases of Cisco DNA Center Software prior to Release 1.1.3. Cisco Bug IDs: CSCvh98929.


Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated local attacker to inject arbitrary commands into the CLI of the affected software which could allow the attacker to gain access to the underlying Linux shell of an affected device and execute commands with root privileges on the device. The vulnerabilities exist because the affected software does not sufficiently sanitize command arguments before passing commands to the Linux shell for execution. An attacker could exploit these vulnerabilities by submitting a malicious CLI command to the affected software. A successful exploit could allow the attacker to break from the CLI of the affected software which could allow the attacker to gain access to the underlying Linux shell on an affected device and execute arbitrary commands with root privileges on the device. Cisco Bug IDs: CSCuz03145 CSCuz56419 CSCva31971 CSCvb09542.


A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series routers could allow an authenticated local attacker to execute arbitrary commands with root privileges on an affected host operating system. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by injecting malicious command arguments into a vulnerable CLI command. A successful exploit could allow the attacker to execute arbitrary commands with root privileges. To exploit this vulnerability the attacker would need to authenticate to the affected system by using valid administrator credentials. Cisco Bug IDs: CSCvf93332.


A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated local attacker to gain access to the underlying Linux shell of an affected device and execute arbitrary commands with root privileges on the device. The vulnerability is due to the affected software improperly sanitizing command arguments to prevent access to internal data structures on a device. An attacker who has privileged EXEC mode (privilege level 15) access to an affected device could exploit this vulnerability on the device by executing CLI commands that contain crafted arguments. A successful exploit could allow the attacker to gain access to the underlying Linux shell of the affected device and execute arbitrary commands with root privileges on the device. Cisco Bug IDs: CSCuv91356.


Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated local attacker to gain access to the underlying Linux shell of an affected device and execute arbitrary commands with root privileges on the device. The vulnerabilities are due to the affected software improperly sanitizing command arguments to prevent access to internal data structures on a device. An attacker who has user EXEC mode (privilege level 1) access to an affected device could exploit these vulnerabilities on the device by executing CLI commands that contain crafted arguments. A successful exploit could allow the attacker to gain access to the underlying Linux shell of the affected device and execute arbitrary commands with root privileges on the device. Cisco Bug IDs: CSCtw85441 CSCus42252 CSCuv95370.


A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary commands on the device with root privileges. Cisco Bug IDs: CSCvh25988.


A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated remote attacker to inject and execute arbitrary commands with root privileges on an affected device. The vulnerability is due to insufficient validation of command input by the affected software. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to inject and execute arbitrary system-level commands with root privileges on an affected device.


A vulnerability in the ACS Report component of Cisco Secure Access Control System (ACS) could allow an unauthenticated remote attacker to execute arbitrary commands on an affected system. Commands executed by the attacker are processed at the targeted user's privilege level. The vulnerability is due to insufficient validation of the Action Message Format (AMF) protocol. An attacker could exploit this vulnerability by sending a crafted AMF message that contains malicious code to a targeted user. A successful exploit could allow the attacker to execute arbitrary commands on the ACS device. This vulnerability affects all releases of Cisco Secure ACS prior to Release 5.8 Patch 7. Cisco Bug IDs: CSCve69037.


A vulnerability in the role-based access-checking mechanisms of Cisco NX-OS Software could allow an authenticated local attacker to execute arbitrary commands on an affected device. The vulnerability exists because the affected software lacks proper input and validation checks for certain file systems. An attacker could exploit this vulnerability by issuing crafted commands in the CLI of an affected device. A successful exploit could allow the attacker to cause other users to execute unwanted arbitrary commands on the affected device. Cisco Bug IDs: CSCvd06339 CSCvd15698 CSCvd36108 CSCvf52921 CSCvf52930 CSCvf52953 CSCvf52976.


A vulnerability in the configuration and management database of the Cisco SD-WAN Solution could allow an authenticated remote attacker to execute arbitrary commands with the privileges of the vmanage user in the configuration management system of the affected software. The vulnerability is due to insufficient validation of command arguments that are passed to the configuration and management database of the affected software. An attacker could exploit this vulnerability by creating custom functions that contain malicious code and are executed as the vmanage user of the configuration management system. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the vmanage user in the configuration management system of the affected software. This vulnerability affects the following Cisco products if they are running a release of the Cisco SD-WAN Solution prior to Release 18.3.0: vBond Orchestrator Software vManage Network Management Software vSmart Controller Software. Cisco Bug IDs: CSCvi69937.


A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated remote attacker to send a malicious packet to the management interface on an affected system and execute a command-injection exploit. The vulnerability is due to incorrect input validation of user-supplied data to the NX-API subsystem. An attacker could exploit this vulnerability by sending a malicious HTTP or HTTPS packet to the management interface of an affected system that has the NX-API feature enabled. A successful exploit could allow the attacker to execute arbitrary commands with root privileges. Note: NX-API is disabled by default. This vulnerability affects MDS 9000 Series Multilayer Switches Nexus 2000 Series Fabric Extenders Nexus 3000 Series Switches Nexus 3500 Platform Switches Nexus 5500 Platform Switches Nexus 5600 Platform Switches Nexus 6000 Series Switches Nexus 7000 Series Switches Nexus 7700 Series Switches Nexus 9000 Series Switches in standalone NX-OS mode Nexus 9500 R-Series Line Cards and Fabric Modules. Cisco Bug IDs: CSCvd47415 CSCve03216 CSCve03224 CSCve03234.


A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authenticated local attacker to execute arbitrary commands with root privileges on an affected operating system. The vulnerability is due to insufficient validation of user-supplied input by the affected operating system. An attacker could exploit this vulnerability by authenticating to an affected system and injecting malicious arguments into a vulnerable CLI command. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the affected system. Cisco Bug IDs: CSCvg38807.


A vulnerability in the Cluster Manager of Cisco Policy Suite before 18.2.0 could allow an unauthenticated remote attacker to log in to an affected system using the root account which has default static user credentials. The vulnerability is due to the presence of undocumented static user credentials for the root account. An attacker could exploit this vulnerability by using the account to log in to an affected system. An exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user. Cisco Bug IDs: CSCvh02680.


A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated local attacker to gain access to the underlying Linux shell of an affected device and execute arbitrary commands with root privileges on the device. The vulnerability is due to the affected software improperly sanitizing command arguments to prevent access to internal data structures on a device. An attacker who has privileged EXEC mode (privilege level 15) access to an affected device could exploit this vulnerability on the device by executing CLI commands that contain crafted arguments. A successful exploit could allow the attacker to gain access to the underlying Linux shell of the affected device and execute arbitrary commands with root privileges on the device. Cisco Bug IDs: CSCve74432.


An

issue

was

discovered

in

MyBiz

MyProcureNet

A

malicious

file

can

be

uploaded

to

the

webserver

by

an

attacker.

It

is

possible

for

an

attacker

to

upload

a

script

to

issue

operating

system

commands.

This

vulnerability

occurs

because

an

attacker

is

able

to

adjust

the

\HiddenFieldControlCustomWhiteListedExtensions\

parameter

and

add

arbitrary

extensions

to

the

whitelist

during

the

upload.

For

instance

if

the

extension

.asp

is

added

to

the

parameter

the

server

accepts

\secctest.asp\

as

a

legitimate

file.

Hence

malicious

files

can

be

uploaded

in

order

to

execute

arbitrary

commands

to

take

over

the

server.


The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.


RSA NetWitness Platform versions prior to 11.1.0.2 and RSA Security Analytics versions prior to 10.6.6 are vulnerable to a server-side template injection vulnerability due to insecure configuration of the template engine used in the product. A remote authenticated malicious RSA NetWitness Server user with an Admin or Operator role could exploit this vulnerability to execute arbitrary commands on the server with root privileges.


Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC allowing an attacker to execute arbitrary commands as root.


The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads.


IBM Spectrum Symphony and Platform Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to execute arbitrary commands due to improper handling of user supplied input. IBM X-Force ID: 143622.


IBM QRadar 7.2 and 7.3 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 143121.


IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 144580.