5651 matches found
CAPI4Hylafax fax receiver: Execution of arbitrary code
Background CAPI4Hylafax makes it possible to send and receive faxes via CAPI and AVM Fritz!Cards. Description Lionel Elie Mamane discovered an error in c2faxrecv, which doesn't properly sanitize TSI strings when handling incoming calls. Impact A remote attacker can send null \0 and shell...
local to local copy uses shell expansion twice
scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice...
CVE-2006-5099: Undefined Security Weakness
lib/exec/fetch.php in DokuWiki before 2006-03-09e, when confimconvert is configured to use ImageMagick, allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 w and 2 h parameters, which are not filtered when invoking convert...
CVE-2006-3126
c2faxrecv in capi4hylafax 01.02.03 allows remote attackers to execute arbitrary commands via null \0 and shell metacharacters in the TSI string, as demonstrated by a fax from an anonymous number...
CVE-2006-3126
c2faxrecv in capi4hylafax 01.02.03 allows remote attackers to execute arbitrary commands via null \0 and shell metacharacters in the TSI string, as demonstrated by a fax from an anonymous number...
CVE-2006-3126
CVE-2006-3126 affects capi4hylafax (c2faxrecv) where the receiver does not sanitize TSI strings, enabling remote attackers to execute arbitrary commands by injecting nulls (\0) and shell metacharacters in the TSI field from an anonymous fax. The advisory/references document the vulnerability as e...
CVE-2006-3126
Removed by vendor...
CVE-2006-4081
previewemail.cgi in Barracuda Spam Firewall BSF 3.3.01.001 through 3.3.03.053 allows remote attackers to execute commands via shell metacharacters "|" pipe symbol in the file parameter. NOTE: the attack can be extended to arbitrary commands by the presence of CVE-2006-4000...
CVE-2006-4081
CVE-2006-4081 affects Barracuda Spam Firewall (BSF) versions 3.3.01.001–3.3.03.053 . The vulnerability in preview_email.cgi allows remote attackers to execute commands via shell metacharacters in the file parameter, yielding remote command execution with likely limited privileges. The exploit can...
CVE-2006-4081: Undefined Security Weakness
previewemail.cgi in Barracuda Spam Firewall BSF 3.3.01.001 through 3.3.03.053 allows remote attackers to execute commands via shell metacharacters "|" pipe symbol in the file parameter. NOTE: the attack can be extended to arbitrary commands by the presence of CVE-2006-4000...
CVE-2006-3633
OSSP shiela 1.1.5 and earlier allows remote authenticated users to execute arbitrary commands on the CVS server via shell metacharacters in a filename that is committed...
CVE-2006-3633
OSSP shiela 1.1.5 and earlier allows remote authenticated users to execute arbitrary commands on the CVS server via shell metacharacters in a filename that is committed...
CVE-2006-3633
CVE-2006-3633 concerns OSSP Shiela (1.1.5 and earlier), a CVS repository extension. The vulnerability allows remote authenticated users to execute arbitrary commands on the CVS server by crafting shell metacharacters into a filename during commit. This is the explicit impact: arbitrary code execu...
CVE-2006-3633: Improper Input Validation
OSSP shiela 1.1.5 and earlier allows remote authenticated users to execute arbitrary commands on the CVS server via shell metacharacters in a filename that is committed...
local to local copy uses shell expansion twice
scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice...
DEBIAN-CVE-2006-2644
AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the configdir parameter to awstats.pl to upload a configuration file whose name contains shell metacharacters, then access that file using the LogFile directive...
Default configuration
AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the configdir parameter to awstats.pl to upload a configuration file whose name contains shell metacharacters, then access that file using the LogFile directive...
CVE-2006-2644: Undefined Security Weakness
AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the configdir parameter to awstats.pl to upload a configuration file whose name contains shell metacharacters, then access that file using the LogFile directive...