PT-2014-3429 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.4.5 Foreman versions 1.5.x prior to 1.5.1 Description: The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to the "tftp/fetch boot file" endpoint...

CVE-2014-3496: Improper Control of Generation of Code

cartridgerepository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url ending with a 1 .tar.gz, 2 .zip, 3 .tgz, or 4 .tar file extension in a cartridge manifest file...

foreman-proxy: smart-proxy remote command injection

The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetchbootfile...

Origin: Command execution as root via downloadable cartridge source-url

cartridgerepository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url ending with a 1 .tar.gz, 2 .zip, 3 .tgz, or 4 .tar file extension in a cartridge manifest file...

DEBIAN-CVE-2013-7323

python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors...

CVE-2013-7323

python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors...

CVE-2013-7323

python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors...

CVE-2013-7323

python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors...

Code injection

python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors...

PYSEC-2014-89

python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors...

PYSEC-2014-89

python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors...

UBUNTU-CVE-2013-7323

python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors...

CVE-2013-7323: Undefined Security Weakness

python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors...

Design/Logic Flaw

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to unspecified methods...

CVE-2014-2507: Improper Neutralization of Special Elements used in an OS Command

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to unspecified methods...

CVE-2014-2959

logViewer.htm on the Dell ML6000 tape backup system with firmware before i8.2.0.2 641G.GS103 and the Quantum Scalar i500 tape backup system with firmware before i8.2.2.1 646G.GS002 allows remote attackers to execute arbitrary commands via shell metacharacters in a pathname parameter...

CVE-2014-2959

logViewer.htm on the Dell ML6000 tape backup system with firmware before i8.2.0.2 641G.GS103 and the Quantum Scalar i500 tape backup system with firmware before i8.2.2.1 646G.GS002 allows remote attackers to execute arbitrary commands via shell metacharacters in a pathname parameter...

CVE-2014-2959

The CVE-2014-2959 issue affects Dell ML6000 and Quantum Scalar i500 tape libraries. The remote pre-authentication vulnerability stems from logViewer.htm, where a pathname parameter is used directly in shell commands, allowing command execution via metacharacters. Affected firmwares are Dell i8.2....

CVE-2014-2959: Improper Neutralization of Special Elements used in an OS Command

logViewer.htm on the Dell ML6000 tape backup system with firmware before i8.2.0.2 641G.GS103 and the Quantum Scalar i500 tape backup system with firmware before i8.2.2.1 646G.GS002 allows remote attackers to execute arbitrary commands via shell metacharacters in a pathname parameter...

CVE-2013-2090

The setmetadata function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the file name of an email attachment. NOTE: some of these details are obtained from third party information...