CVE-2019-10631: Improper Neutralization of Special Elements used in an OS Command

Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via multiple different requests...

PT-2019-11950

Name of the Vulnerable Software and Affected Versions Zyxel NAS 326 versions 5.21 and below Description The issue allows an authenticated attacker to execute arbitrary code via multiple different requests due to Shell Metacharacter Injection in the package installer. Recommendations For Zyxel NAS...

Grandstream GXP16xx Shell Metacharacter Injection Vulnerability

The Grandstream GXP16xx VoIP is a 16XX series IP phone from Grandstream. A shell metacharacter injection vulnerability exists in the SSH configuration interface of the Grandstream GXP16xx 1.0.4.128, which can be exploited by an attacker to execute arbitrary system commands and obtain a root shell...

CVE-2018-17565

Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commands and gain a root shell...

CVE-2018-17565

The CVE-2018-17565 entry concerns a Shell Metacharacter Injection vulnerability in the SSH configuration interface of Grandstream GXP16xx VoIP phones (firmware 1.0.4.128). The vulnerability allows an attacker to execute arbitrary system commands and obtain a root shell. Public documents identify ...

CVE-2018-17565: Improper Neutralization of Special Elements used in an OS Command

Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commands and gain a root shell...

PT-2019-9506

Name of the Vulnerable Software and Affected Versions Grandstream GXP16xx VoIP version 1.0.4.128 Description The issue allows attackers to execute arbitrary system commands and gain a root shell due to Shell Metacharacter Injection in the SSH configuration interface. Recommendations For Grandstre...

Design/Logic Flaw

Shell Metacharacter Injection in www/modules/save.php in FruityWifi aka PatatasFritas/PatataWifi through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted modname parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid...

CVE-2018-19168

Shell Metacharacter Injection in www/modules/save.php in FruityWifi aka PatatasFritas/PatataWifi through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted modname parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid...

CVE-2018-19168: Improper Neutralization of Special Elements used in an OS Command

Shell Metacharacter Injection in www/modules/save.php in FruityWifi aka PatatasFritas/PatataWifi through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted modname parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid...

CVE-2018-19168

Shell Metacharacter Injection in www/modules/save.php in FruityWifi aka PatatasFritas/PatataWifi through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted modname parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid...

CVE-2018-19168

Shell Metacharacter Injection in www/modules/save.php in FruityWifi aka PatatasFritas/PatataWifi through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted modname parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid...

PT-2018-13980

Name of the Vulnerable Software and Affected Versions FruityWifi version 2.1 Description The issue allows remote attackers to execute arbitrary commands. This can be achieved by injecting shell metacharacters into specific parameters in two API endpoints: "/www/script/config iface.php" and...

Remote code execution

ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution...

CVE-2017-1000203

ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution...

CVE-2017-1000203

ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution...

CVE-2017-1000203

CVE-2017-1000203 concerns ROOT (the data analysis framework) versions 6.9.03 and earlier. The rootd daemon is vulnerable to an authenticated shell metacharacter injection, enabling remote code execution. Documents from multiple vendors/advisories consistently describe this vulnerability and its i...

CVE-2017-1000203

ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution...

PT-2017-10901

Name of the Vulnerable Software and Affected Versions ROOT version 6.9.03 and below Description The issue is related to an authenticated shell metacharacter injection in the rootd daemon, which can result in remote code execution. Recommendations For versions 6.9.03 and below, update to a version...

Shell Metacharacter Injection in kelredd-pruview

kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to document.rb, video.rb, or videoimage.rb...