CVE-2014-1927: Improper Input Validation

The shellquote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$" command-substitution sequences, a different vulnerability than CVE-2014-1928...

CVE-2014-1928: Improper Input Validation

The shellquote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "" backslash characters to form multi-command sequences, a different...

PT-2014-4366

The shell quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$" command-substitution sequences, a different vulnerability than CVE-2014-192...

CVE-2014-3829

displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 fixed in Centreon web 2.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 sessionid or 2 templateid parameter, related to the commandline variable...

Design/Logic Flaw

displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 fixed in Centreon web 2.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 sessionid or 2 templateid parameter, related to the commandline variable...

CVE-2014-3829: Improper Control of Generation of Code

displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 fixed in Centreon web 2.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 sessionid or 2 templateid parameter, related to the commandline variable...

PT-2014-5532

Name of the Vulnerable Software and Affected Versions Centreon versions 2.5.1 through 2.5.2 Centreon Enterprise Server version 2.2 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the session id or template id parameter, related to the comman...

WordPress DBManager Plugin <= 2.7.1 - Multiple Vulnerabilities

There are multiple vulnerabilities in this plugin, that allow remote authenticated users to execute arbitrary commands via shell metacharacters in the $backup'filepath' or $backup'mysqldumppath' variable. Solution Update the plugin...

CVE-2014-4868

The management console on the Brocade Vyatta 5400 vRouter 6.4Rx, 6.6Rx, and 6.7R1 allows remote authenticated users to execute arbitrary Linux commands via shell metacharacters in a console command...

PT-2014-6178

Name of the Vulnerable Software and Affected Versions Brocade Vyatta 5400 vRouter versions 6.4Rx through 6.7R1 Description The management console allows remote authenticated users to execute arbitrary Linux commands via shell metacharacters in a console command. Recommendations For Brocade Vyatta...

Code injection

backup.php in PHPCompta/NOALYSS before 6.7.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the d parameter...

PT-2014-7205

Name of the Vulnerable Software and Affected Versions PHPCompta/NOALYSS versions prior to 6.7.2 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the d parameter of the backup.php file. Recommendations For versions prior to 6.7.2, update to...

CVE-2014-6389: Improper Control of Generation of Code

backup.php in PHPCompta/NOALYSS before 6.7.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the d parameter...

CVE-2014-5519

The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the editcontent parameter to index.php/HeIp. NOTE: some of these details are obtained from third party information...

PT-2014-6505

Name of the Vulnerable Software and Affected Versions PhpWiki version 1.5.0 Description The issue allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the editcontent parameter to "index.php/HeIp". Recommendations For PhpWiki version 1.5.0, avoid using...

CVE-2014-5519: Improper Control of Generation of Code

The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the editcontent parameter to index.php/HeIp. NOTE: some of these details are obtained from third party information...

CVE-2014-5521

plugins/useradmin/fingeruser.php in XRMS CRM, possibly 1.99.2, allows remote authenticated users to execute arbitrary code via shell metacharacters in the username parameter...

CVE-2014-5521

XRMS CRM (plugin path plugins/useradmin/fingeruser.php) is affected by CVE-2014-5521. The vulnerability allows remote authenticated users to execute arbitrary code through shell metacharacters in the username parameter, due to insufficient input validation in fingeruser.php (likely in XRMS CRM 1....

CVE-2014-5521

plugins/useradmin/fingeruser.php in XRMS CRM, possibly 1.99.2, allows remote authenticated users to execute arbitrary code via shell metacharacters in the username parameter...

CVE-2014-5521: Improper Neutralization of Special Elements used in an SQL Command

plugins/useradmin/fingeruser.php in XRMS CRM, possibly 1.99.2, allows remote authenticated users to execute arbitrary code via shell metacharacters in the username parameter...