CVE-2014-1610: Improper Input Validation

MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in 1 the page parameter to includes/media/DjVu.php; 2 the w parameter aka width field to...

PT-2014-4255

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.19.x through 1.19.10 MediaWiki versions 1.21.x through 1.21.4 MediaWiki versions 1.22.x through 1.22.1 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in certain...

Code injection

The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 name, 2 email, 3 subject, or 4 message parameter to...

CVE-2014-1683

The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 name, 2 email, 3 subject, or 4 message parameter to...

CVE-2014-1683

Vulnerability overview: CVE-2014-1683 affects SkyBlueCanvas CMS and its BashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php. When pid equals 4, remote attackers can inject commands via shell metacharacters in the name, email, subject, or message parameters to index.php...

PT-2014-4291

Name of the Vulnerable Software and Affected Versions SkyBlueCanvas CMS versions prior to 1.1 r248-04 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the name, email, subject, or message parameter to "index.php" when the pid parameter is 4...

CVE-2014-1683: Use of Externally-Controlled Format String

The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 name, 2 email, 3 subject, or 4 message parameter to...

CVE-2013-5667

The Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to execute arbitrary commands via a getuserid action with shell metacharacters in the username parameter...

Design/Logic Flaw

The Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to execute arbitrary commands via a getuserid action with shell metacharacters in the username parameter...

PT-2014-2942

Name of the Vulnerable Software and Affected Versions Thecus NAS server N8800 version 5.03.01 Description The issue allows remote attackers to execute arbitrary commands. This is achieved through a get userid action that contains shell metacharacters in the username parameter. Recommendations For...

CVE-2013-6881

CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 sector size or 2 skip count fields for the forensic imaging task...

Design/Logic Flaw

CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 sector size or 2 skip count fields for the forensic imaging task...

CVE-2013-6881

CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 sector size or 2 skip count fields for the forensic imaging task...

CVE-2013-6881: Improper Neutralization of Special Elements used in an OS Command

CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 sector size or 2 skip count fields for the forensic imaging task...

PT-2014-3212

Name of the Vulnerable Software and Affected Versions CRU Ditto Forensic FieldStation versions prior to 2013Oct15a Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 sector size or 2 skip count fields for the forensic imaging task...

CVE-2012-0261: Improper Control of Generation of Code

license.php in system-portal before 1.6.2 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the timestamp parameter for an install action...

PT-2013-1488

Name of the Vulnerable Software and Affected Versions op5 Monitor versions prior to 2.0.3 op5 Appliance versions prior to 5.5.3 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the password parameter. This can be exploited in the...

PT-2013-1487

Name of the Vulnerable Software and Affected Versions op5 Monitor versions prior to 1.6.2 op5 Appliance versions prior to 5.5.3 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the timestamp parameter for an install action in the license.php...

CVE-2012-0262: Improper Control of Generation of Code

op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the password parameter...

Design/Logic Flaw

The message function in lib/webbynode/notify.rb in the Webbynode gem 1.0.5.3 and earlier for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a growlnotify message...