5699 matches found
CVE-2014-8603: Improper Input Validation
cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code via shell metacharacters in the 1 file name when creating a backup or vectors related to the 2 $CONFIGtarpath, 3 $exclude, 4 $CONFIG'tarcompress', 5...
CVE-2014-9727
AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter to cgi-bin/webcm...
Design/Logic Flaw
AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter to cgi-bin/webcm...
CVE-2014-9727
AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter to cgi-bin/webcm...
CVE-2014-9727: Improper Neutralization of Special Elements used in an OS Command
AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter to cgi-bin/webcm...
PT-2015-4366 · Avm · Avm Fritz!Box
Name of the Vulnerable Software and Affected Versions: AVM Fritz!Box affected versions not specified Description: The issue allows remote attackers to execute arbitrary commands. This is achieved by using shell metacharacters in the var:lang parameter to the "cgi-bin/webcm" API endpoint...
CVE-2014-9727
AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter to cgi-bin/webcm. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...
[ MDVSA-2015:099 ] python-pillow
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:099 http://www.mandriva.com/en/support/security/ Package : python-pillow Date : March 28, 2015 Affected: Business Server 2.0 Problem Description: Updated python-imaging packages fix security vulnerabilities:...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the filename JSON member in...
CVE-2015-2838
Cross-site request forgery CSRF vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the filename JSON member in...
CVE-2015-2838
CVE-2015-2838 affects Citrix NetScaler Nitro API prior to 10.5 build 52.3nc. The vulnerability arises from CSRF that lets an attacker craft requests via the file_name JSON field in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix, enabling shell metacharacters to execute commands as nsroot. This...
setroubleshoot Arbitrary Command Execution Vulnerability
setroubleshoot is a set of SELinux operating system troubleshooting tools. The tool consists of a framework and analysis plug-ins. A security vulnerability exists in the 'getrpmnvrbyfilepathtemporary' function in the util.py file in versions prior to setroubleshoot 3.2.22. A remote attacker can...
CVE-2015-1815
The getrpmnvrbyfilepathtemporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file name...
Design/Logic Flaw
The getrpmnvrbyfilepathtemporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file name...
CVE-2015-1815
The getrpmnvrbyfilepathtemporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file name...
CVE-2015-1815
The getrpmnvrbyfilepathtemporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file name...
CVE-2015-1815
The getrpmnvrbyfilepathtemporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file name...
CVE-2015-2746
The network diagnostics tool CommandLineServlet in the Appliance Manager command line utility CLU in Websense TRITON 7.8.3 and V-Series appliances before 7.8.4 Hotfix 02 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the "second" parameter of a command...
Command injection
The network diagnostics tool CommandLineServlet in the Appliance Manager command line utility CLU in Websense TRITON 7.8.3 and V-Series appliances before 7.8.4 Hotfix 02 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the "second" parameter of a command...
PT-2015-5864
Name of the Vulnerable Software and Affected Versions Websense TRITON versions 7.8.3 through 7.8.3 before Hotfix 02 Websense V-Series appliances versions 7.8.3 through 7.8.3 before Hotfix 02 Description The issue concerns the network diagnostics tool CommandLineServlet in the Appliance Manager...