Design/Logic Flaw

The saveObject function in moadmin.php in phpMoAdmin 1.1.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the object parameter...

CVE-2015-2208

The saveObject function in moadmin.php in phpMoAdmin 1.1.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the object parameter...

CVE-2015-2208: Improper Neutralization of Special Elements used in a Command

The saveObject function in moadmin.php in phpMoAdmin 1.1.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the object parameter...

CVE-2015-2265

The removebadchars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the 1 model or 2 PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707...

PT-2015-4877

Name of the Vulnerable Software and Affected Versions osc versions prior to 0.151.0 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a service file. Recommendations For versions prior to 0.151.0, update to version 0.151.0 or later to resolve...

UBUNTU-CVE-2015-2265

The removebadchars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the 1 model or 2 PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707...

Joyent Node.js dns-sync module arbitrary command execution vulnerability

Joyent Node.js is a set of Joyent's web application platform built on top of Google's V8 JavaScript engine. dns-sync is one of the libraries that allows synchronized resolution of hostnames. A security vulnerability exists in the node.js dns-sync module. An attacker can exploit the vulnerability ...

Cacti < 0.8.8c Multiple Vulnerabilities

According to its self-reported version number, the Cacti application running on the remote web server is prior to version 0.8.8c. It is, therefore, potentially affected by the following vulnerabilities : - Multiple XSS vulnerabilities exist in the 'step' parameter to 'install/index.php' and the...

Arbitrary Command Execution Through Shell Metacharacters In API Arguments

The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function. This vulnerability is a duplicate of CVE-2017-16100...

PT-2015-5691

Name of the Vulnerable Software and Affected Versions cups-filters versions prior to 1.0.66 Description The issue allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the model or PDL, due to an incomplete fix for a previous issue. Recommendations For...

Code injection

The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function...

CVE-2014-9682

The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function...

CVE-2014-9682: Improper Neutralization of Special Elements used in a Command

The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function...

PT-2015-4351

Name of the Vulnerable Software and Affected Versions dns-sync module versions prior to 0.1.1 Description The issue allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function. This can be exploited by passing malicio...

CVE-2014-8630

Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a two-argument Perl open call, as demonstrated by...

CVE-2014-8630

Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a two-argument Perl open call, as demonstrated by...

CVE-2014-8630

Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a two-argument Perl open call, as demonstrated by...

USN-2471-1: GParted vulnerability

Wolfgang Ettlinger discovered that GParted incorrectly filtered shell metacharacters when running external commands. A local attacker could use this issue with a crafted filesystem label to run arbitrary commands as the administrator...

Ubuntu 14.04 LTS : mime-support vulnerability (USN-2453-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2453-1 advisory. Timothy D. Morgan discovered that the run-mailcap tool incorrectly filtered certain shell metacharacters in filenames. If a user or automated system were tricked...

USN-2453-1 mime-support vulnerability

Timothy D. Morgan discovered that the run-mailcap tool incorrectly filtered certain shell metacharacters in filenames. If a user or automated system were tricked into opening a file with a specially-crafted filename, a remote attacker could possibly execute arbitrary code...