CVE-2013-6775

The Chainfire SuperSU package before 1.69 for Android allows attackers to gain privileges via the 1 backtick or 2 $ type of shell metacharacters in the -c option to /system/xbin/su...

CVE-2013-6775

The CVE-2013-6775 entry describes a privilege escalation in Chainfire SuperSU for Android, affected before version 1.69. The root cause is that the -c argument to /system/xbin/su can be parsed through shell metacharacters (backtick or $( )), allowing an attacker-controlled command to be executed ...

SkyBlueCanvas CMS Remote Command Execution (CVE-2014-1683)

A remote code execution vulnerability has been reported in SkyBlueCanvas CMS. The vulnerability is due to the filebashMail function that allows remote attackers to execute arbitrary commands, when the pid parameter is 4. A remote attacker can exploit this vulnerability by execute arbitrary comman...

CVE-2011-5274

The drawAdminToolsPackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control DTC before 0.32.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the dtcpkgdirectory parameter in a doinstall action to dtc/...

CVE-2011-3195

shared/inc/sql/lists.php in Domain Technologie Control DTC before 0.34.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in mailing list tunable options...

CVE-2011-3195

shared/inc/sql/lists.php in Domain Technologie Control DTC before 0.34.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in mailing list tunable options...

CVE-2011-5274

The drawAdminToolsPackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control DTC before 0.32.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the dtcpkgdirectory parameter in a doinstall action to dtc/...

Design/Logic Flaw

The drawAdminToolsPackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control DTC before 0.32.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the dtcpkgdirectory parameter in a doinstall action to dtc/...

CVE-2011-5274

The CVE-2011-5274 issue affects Domain Technologie Control (DTC) before version 0.32.11, where the drawAdminTools_PackageInstaller function in shared/inc/forms/packager.php allows remote attackers to execute arbitrary commands via shell metacharacters in the dtcpkg_directory parameter during a do...

Code injection

Sophos Web Appliance before 3.7.8.2 allows 1 remote attackers to execute arbitrary commands via shell metacharacters in the client-ip parameter to the Block page, when using the userworkstation variable in a customized template, and remote authenticated users to execute arbitrary commands via she...

CVE-2013-2642

Vulnerability : CVE-2013-2642 affects Sophos Web Protection Appliance (pre-3.7.8.2). The issue enables OS command injection in multiple contexts: (1) OS commands via the Block page when a customized template uses the client-ip variable, (2) commands via the Diagnostic Tools URL parameter, and (3)...

Arabic Prawn Gem for Ruby lib/string_utf_support.rb User Input Handling Remote Command Injection

Arabic Prawn Gem for Ruby contains a flaw in the lib/stringutfsupport.rb file. The issue is due to the program failing to sanitize user input. This may allow a remote attacker to inject arbitrary commands. "lib/stringutfsupport.rb" in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to...

CVE-2013-6719

CVE-2013-6719 affects IBM Tealeaf CX Passive Capture Application (PCA) web console (PHP) builds 3611 and 3620. The vulnerability is a remote OS command injection in the testconn_host parameter of delivery.php, allowing an authenticated remote attacker to execute arbitrary commands on the host. IB...

GLSA-201402-27 : pidgin-knotify: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-201402-27 pidgin-knotify: Arbitrary code execution pidgin-knotify does not properly sanitize shell metacharacters from received messages. Impact : A remote attacker could send a specially crafted instant message, possibly resultin...

pidgin-knotify: Arbitrary code execution

Background pidgin-knotify is a Pidgin plug-in to display message notifications in KDE. Description pidgin-knotify does not properly sanitize shell metacharacters from received messages. Impact A remote attacker could send a specially crafted instant message, possibly resulting in execution of...

MediaWiki Thumb.php Remote Command Execution Exploit

Exploit for multiple platform in category remote exploits require 'msf/core' class Metasploit3 'MediaWiki Thumb.php Remote Command Execution', 'Description' = %q MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5 and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows...

MediaWiki - 'Thumb.php' Remote Command Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'MediaWiki Thumb.php Remote Command Execution', 'Description' = %q MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5 and 1.19.x...

CVE-2013-3365

TRENDnet TEW-812DRU router allows remote authenticated users to execute arbitrary commands via shell metacharacters in the 1 wan network prefix to internet/ipv6.asp; 2 remote port to adm/management.asp; 3 pptp username, 4 pptp password, 5 ip, 6 gateway, 7 l2tp username, or 8 l2tp password to...

Design/Logic Flaw

TRENDnet TEW-812DRU router allows remote authenticated users to execute arbitrary commands via shell metacharacters in the 1 wan network prefix to internet/ipv6.asp; 2 remote port to adm/management.asp; 3 pptp username, 4 pptp password, 5 ip, 6 gateway, 7 l2tp username, or 8 l2tp password to...

CVE-2013-3365

TRENDnet TEW-812DRU router is affected by CSRF-related command injection vulnerabilities (CVE-2013-3365 and related CVE-2013-3098). Exploitation can allow an attacker with prior authentication to perform actions such as changing admin credentials, enabling remote management or port forwarding, or...