CVE-2014-1927

The shellquote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$" command-substitution sequences, a different vulnerability than CVE-2014-1928...

CVE-2014-1928

The shellquote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "" backslash characters to form multi-command sequences, a different...

CVE-2014-1928

The shellquote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "" backslash characters to form multi-command sequences, a different...

CVE-2014-1927

The shellquote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$" command-substitution sequences, a different vulnerability than CVE-2014-1928...

CVE-2014-1927

The CVE-2014-1927 entry concerns the shell_quote function in python-gnupg 0.3.5, which does not properly quote strings and can allow context-dependent attackers to execute arbitrary code via shell metacharacters. The documented vector examples reference using "$(" command-substitution sequences, ...

CVE-2014-1928: Improper Input Validation

The shellquote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "" backslash characters to form multi-command sequences, a different...

CVE-2014-1927: Improper Input Validation

The shellquote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$" command-substitution sequences, a different vulnerability than CVE-2014-1928...

CVE-2014-3829

displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 fixed in Centreon web 2.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 sessionid or 2 templateid parameter, related to the commandline variable...

Design/Logic Flaw

displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 fixed in Centreon web 2.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 sessionid or 2 templateid parameter, related to the commandline variable...

CVE-2014-3829: Improper Control of Generation of Code

displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 fixed in Centreon web 2.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 sessionid or 2 templateid parameter, related to the commandline variable...

WordPress DBManager Plugin <= 2.7.1 - Multiple Vulnerabilities

There are multiple vulnerabilities in this plugin, that allow remote authenticated users to execute arbitrary commands via shell metacharacters in the $backup'filepath' or $backup'mysqldumppath' variable. Solution Update the plugin...

CVE-2014-4868

The management console on the Brocade Vyatta 5400 vRouter 6.4Rx, 6.6Rx, and 6.7R1 allows remote authenticated users to execute arbitrary Linux commands via shell metacharacters in a console command...

Code injection

backup.php in PHPCompta/NOALYSS before 6.7.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the d parameter...

CVE-2014-6389: Improper Control of Generation of Code

backup.php in PHPCompta/NOALYSS before 6.7.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the d parameter...

CVE-2014-5519

The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the editcontent parameter to index.php/HeIp. NOTE: some of these details are obtained from third party information...

CVE-2014-5519: Improper Control of Generation of Code

The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the editcontent parameter to index.php/HeIp. NOTE: some of these details are obtained from third party information...

CVE-2014-5521

plugins/useradmin/fingeruser.php in XRMS CRM, possibly 1.99.2, allows remote authenticated users to execute arbitrary code via shell metacharacters in the username parameter...

CVE-2014-5521

plugins/useradmin/fingeruser.php in XRMS CRM, possibly 1.99.2, allows remote authenticated users to execute arbitrary code via shell metacharacters in the username parameter...

CVE-2014-5521

XRMS CRM (plugin path plugins/useradmin/fingeruser.php) is affected by CVE-2014-5521. The vulnerability allows remote authenticated users to execute arbitrary code through shell metacharacters in the username parameter, due to insufficient input validation in fingeruser.php (likely in XRMS CRM 1....

CVE-2014-5521: Improper Neutralization of Special Elements used in an SQL Command

plugins/useradmin/fingeruser.php in XRMS CRM, possibly 1.99.2, allows remote authenticated users to execute arbitrary code via shell metacharacters in the username parameter...