31 matches found
ruby: Code injection via command argument of Shell#test / Shell#[]
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument aka the "command" argument to Shell or Shelltest in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method...
DEBIAN-CVE-2019-16255
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument aka the "command" argument to Shell or Shelltest in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method...
CVE-2019-9794
A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This could be used to retrieve and execute files whose location is supplied through these command line arguments if Firefox is configured as the...
UBUNTU-CVE-2017-5207
Firejail before 0.9.44.4, when running a bandwidth command, allows local users to gain root privileges via the --shell argument...
ImageMagick driver does not escape all shell arguments.
More info at https://fuelphp.com/security-advisories...
Fedora 21 : lsyncd-2.1.5-6.fc21 (2014-15338)
Fix bad shell argument escaping Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...
Fedora 20 : lsyncd-2.1.4-4.fc20.1 (2014-15393)
Fix bad shell argument escaping Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...
RHEL 2.1 : mod_auth_any (RHSA-2003:114)
Updated modauthany packages are available for Red Hat Enterprise Linux. These updated packages fix vulnerabilities associated with the manner in which modauthany escapes shell arguments when calling external programs. The Web server module modauthany allows the Apache httpd server to call arbitra...
phpEscape.txt
SEC-CONSULT Security Advisory - PHP: Hypertext Preprocessor Vendor: PHP http://www.php.net Product: PHP 4.3.6 and below verified in 4.3.5 which was current when the bug was discovered Vendor status: vendor contacted 04-04-2004 Patch status: Problem fixed in 4.3.7 =========== DESCRIPTION =========...
BitKeeper remote shell command execution/local vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Synopsis: BitKeeper remote shell command execution/local vulnerability Product: BitKeeper http://www.bitkeeper.com Version: 3.0.x Author: Maurycy Prodeus [email protected] Date: 11 November 2002 Issue: - ------ BitKeeper is a source management software. It...
