PT-2014-3425

Name of the Vulnerable Software and Affected Versions Canto Curses versions prior to 0.9.0 Description The issue allows remote feed servers to execute arbitrary commands via shell metacharacters in a URL in a feed. This is due to a problem in the canto curses/guibase.py file. Recommendations For...

Updated python-imaging and python-pillow packages fix security vulnerability

Python Image Library PIL 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters, due to an incomplete fix for CVE-2014-1932 CVE-2014-3007...

CVE-2014-9001

reminders/index.php in Incredible PBX 11 2.0.6.5.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the 1 APPTMIN, 2 APPTHR, 3 APPTDA, 4 APPTMO, 5 APPTYR, or 6 APPTPHONE parameters...

CVE-2014-8387

cgi/utility.cgi in Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point allows remote authenticated users to execute arbitrary commands via shell metacharacters in the pinghost parameter to ping.cgi...

Code injection

cgi/utility.cgi in Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point allows remote authenticated users to execute arbitrary commands via shell metacharacters in the pinghost parameter to ping.cgi...

CVE-2014-8387

cgi/utility.cgi in Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point allows remote authenticated users to execute arbitrary commands via shell metacharacters in the pinghost parameter to ping.cgi...

Code injection

reminders/index.php in Incredible PBX 11 2.0.6.5.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the 1 APPTMIN, 2 APPTHR, 3 APPTDA, 4 APPTMO, 5 APPTYR, or 6 APPTPHONE parameters...

CVE-2014-8387

cgi/utility.cgi in Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point allows remote authenticated users to execute arbitrary commands via shell metacharacters in the pinghost parameter to ping.cgi...

CVE-2014-9001

reminders/index.php in Incredible PBX 11 2.0.6.5.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the 1 APPTMIN, 2 APPTHR, 3 APPTDA, 4 APPTMO, 5 APPTYR, or 6 APPTPHONE parameters...

CVE-2014-9001

CVE-2014-9001 affects Incredible PBX 11 2.0.6.5.0, where reminders/index.php permits remote authenticated users to execute arbitrary commands via shell metacharacters in six parameters (APPTMIN, APPTHR, APPTDA, APPTMO, APPTYR, APPTPHONE). The root cause is unsafely handled shell metacharacters in...

CVE-2014-9001: Improper Control of Generation of Code

reminders/index.php in Incredible PBX 11 2.0.6.5.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the 1 APPTMIN, 2 APPTHR, 3 APPTDA, 4 APPTMO, 5 APPTYR, or 6 APPTPHONE parameters...

PT-2014-8505

Name of the Vulnerable Software and Affected Versions Advantech EKI-6340 version 2.05 Description The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the pinghost parameter to "ping.cgi" API endpoint. Recommendations For Advantech EKI-6340 version...

PT-2014-8780

Name of the Vulnerable Software and Affected Versions Incredible PBX version 11 2.0.6.5.0 Description The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the APPTMIN, APPTHR, APPTDA, APPTMO, APPTYR, or APPTPHONE parameters in the reminders/index.p...

CVE-2014-8949

The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the i4wtrace parameter. NOTE: this can be leveraged with CVE-2014-8948 to allow remote attackers to execute code. NOTE: it is not clear...

CVE-2014-0233

Red Hat OpenShift Enterprise 2.0 and 2.1 and OpenShift Origin allow remote authenticated users to execute arbitrary commands via shell metacharacters in a directory name that is referenced by a cartridge using the file: URI scheme...

Design/Logic Flaw

Red Hat OpenShift Enterprise 2.0 and 2.1 and OpenShift Origin allow remote authenticated users to execute arbitrary commands via shell metacharacters in a directory name that is referenced by a cartridge using the file: URI scheme...

Code injection

The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the i4wtrace parameter. NOTE: this can be leveraged with CVE-2014-8948 to allow remote attackers to execute code. NOTE: it is not clear...

EUVD-2014-8776

The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the i4wtrace parameter. NOTE: this can be leveraged with CVE-2014-8948 to allow remote attackers to execute code. NOTE: it is not clear...

CVE-2014-8949

The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the i4wtrace parameter. NOTE: this can be leveraged with CVE-2014-8948 to allow remote attackers to execute code. NOTE: it is not clear...

CVE-2014-0233

Red Hat OpenShift Enterprise 2.0 and 2.1 and OpenShift Origin allow remote authenticated users to execute arbitrary commands via shell metacharacters in a directory name that is referenced by a cartridge using the file: URI scheme...