RubyGems Sounder 'sound.rb'远程命令注入漏洞

BUGTRAQ ID: 62023 Sounder是Mac OSX afplay命令的ruby gem API Sounder 1.0.1存在远程命令注入漏洞，攻击者可利用此漏洞在受影响应用上下文中执行任意命令 0 rubygems Sounder 1.0.1 厂商补丁： rubygems -------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： https://rubygems.org/gems/sounder PoC: irbmain:098:0 @file = ""id;/usr/bin/id/tmp/p;"" =...

PineApp Mail-SeCure 'livelog.html' Remote Command Injection Vulnerability

PineApp Mail-SeCure 3.70 is prone to a remote command-injection vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Rgpg 0.2.2 Ruby Gem Remote Command Injection

Title: Rgpg 0.2.2 Ruby Gem Remote Command Injection Date: 7/31/2013 Advisory Author: Larry W. Cashdollar, @larry0 CVE: CVE-2013-4203 Download: https://rubygems.org/gems/rgpg Description: "A simple Ruby wrapper around gpg command for file encryption. rgpg is a simple API for interacting with the g...

PineApp Mail-SeCure 'test_li_connection.php' Remote Command Injection Vulnerability

The remote PineApp Mail-SeCure is prone to a remote command-injection vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if...

PineApp Mail-SeCure test_li_connection.php Remote Command Injection

The version of PineApp Mail-SeCure installed on the remote host is affected by a remote command injection vulnerability because the application fails to properly sanitize input to the 'testliconnection.php' script. This could allow a remote, unauthenticated attacker to execute arbitrary commands ...

xmonad XMonad.Hooks.DynamicLog Module - Multiple Remote Command Injection Vulnerabilities

xmonad XMonad.Hooks.DynamicLog Module - Multiple Remote Command Injection Vulnerabilities source: https://www.securityfocus.com/bid/61491/info XMonad.Hooks.DynamicLog module for xmonad is prone to multiple remote command-injection vulnerabilities. Successful exploits will result in the execution ...

xmonad XMonad.Hooks.DynamicLog Module - Multiple Remote Command Injection Vulnerabilities

source: https://www.securityfocus.com/bid/61491/info XMonad.Hooks.DynamicLog module for xmonad is prone to multiple remote command-injection vulnerabilities. Successful exploits will result in the execution of arbitrary commands in the context of the affected applications. This may aid in further...

ZamFoo - date Remote Command Injection

ZamFoo - date Remote Command Injection source: https://www.securityfocus.com/bid/60826/info ZamFoo is prone to a remote command-injection vulnerability. Attackers can exploit this issue to execute arbitrary commands in the context of the application. ZamFoo 12.0 is vulnerable; other versions may...

ZamFoo - 'date' Remote Command Injection

source: https://www.securityfocus.com/bid/60826/info ZamFoo is prone to a remote command-injection vulnerability. Attackers can exploit this issue to execute arbitrary commands in the context of the application. ZamFoo 12.0 is vulnerable; other versions may also be affected...

ASUS RT56U Router Multiple Vulnerabilities (Jun 2013) - Active Check

ASUS RT56U Router is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Asus RT56U 3.0.0.4.360 - Remote Command Injection

Router information: http://www.asus.com/Networking/RTN56U/ Firmware: http://www.asus.com/Networking/RTN56U/supportDownload30 Insufficient or rather, a complete lack thereof input sanitization leads to the injection of shell commands. It's possible to upload and execute a backdoor. Example request...

ASUS RT56U Remote Command Injection

Exploit Title: Asus RT56U Remote Command Injection Date: 05/05/2013 Exploit Author: drone @dronesec Vendor Homepage: asus.com Version: = 3.0.0.4.360 latest Device Details: ============== Router information: http://www.asus.com/Networking/RTN56U/ Firmware:...

Asus RT56U 3.0.0.4.360 - Remote Command Injection

Asus RT56U 3.0.0.4.360 - Remote Command Injection Exploit Title: Asus RT56U Remote Command Injection Date: 05/05/2013 Exploit Author: drone @dronesec Vendor Homepage: asus.com Version: = 3.0.0.4.360 latest Device Details: ============== Router information: http://www.asus.com/Networking/RTN56U/...

Asus RT56U 3.0.0.4.360 - Remote Command Injection

Exploit Title: Asus RT56U Remote Command Injection Date: 05/05/2013 Exploit Author: drone @dronesec Vendor Homepage: asus.com Version: = 3.0.0.4.360 latest Device Details: ============== Router information: http://www.asus.com/Networking/RTN56U/ Firmware:...

Linksys WRT160nv2 apply.cgi Remote Command Injection

Exploit for hardware platform in category remote exploits require 'msf/core' require 'rex/proto/tftp' class Metasploit3 'Linksys WRT160nv2 apply.cgi Remote Command Injection', 'Description' = %q Some Linksys Routers are vulnerable to an authenticated OS command injection on their web interface...

Linksys WRT160n apply.cgi Remote Command Injection

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex/proto/tftp' class Metasploit3 'Linksys...

Linksys WRT160N v2 - 'apply.cgi' Remote Command Injection (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex/proto/tftp' class Metasploit3 'Linksys...

Linksys WRT160nv2 apply.cgi Remote Command Injection

Some Linksys Routers are vulnerable to an authenticated OS command injection on their web interface where default credentials are admin/admin or admin/password. Since it is a blind OS command injection vulnerability, there is no output for the executed command when using the cmd generic payload...

RubyGems 'md2pdf'远程命令注入漏洞(CVE-2013-1948)

BUGTRAQ ID: 59061 CVECAN ID: CVE-2013-1948 md2pdf是将Markdown文档转换为PDF文档的软件。 md2pdf converter.rb中的用户输入，没有经过过滤即传递给命令行，攻击者可利用此漏洞在受影响应用中执行任意命令。 0 rubygems md2pdf 厂商补丁： rubygems -------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： https://rubygems.org/gems/md2pdf...

Ruby Gem kelredd-pruview 0.3.8 Command Injection Vulnerability

Ruby Gem kelredd-pruview version 0.3.8 suffers from a remote command injection vulnerability. Remote command injection in Ruby Gem kelredd-pruview 0.3.8 Larry W. Cashdollar 4/4/2013 @larry0 Description: "A gem to ease generating image previews thumbnails of various files."...