2302 matches found
CVE-2017-11566: Improper Neutralization of Special Elements used in an OS Command
AppUse 4.0 allows shell command injection via a proxy field...
F5 Networks BIG-IP : SSHD session.c vulnerability (K93532943)
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the 1 doauthenticated1 and 2 sessionx11req functions. CVE-2016-3115 C Tenable Network...
Fedora 26 : php-pear-PHP-CodeSniffer (2017-b85d51cc47)
Version 3.0.1 - This release contains a fix for a security advisory related to the improper handling of a shell command - A properly crafted filename would allow for arbitrary code execution when using the --filter=gitmodified command line option - All version 3 users are encouraged to upgrade to...
PT-2017-15376
Name of the Vulnerable Software and Affected Versions Junos OS versions 12.1X44 prior to 12.1X44-D60 Junos OS versions 12.1X46 prior to 12.1X46-D50 Junos OS versions 12.1X47 prior to 12.1X47-D35 Junos OS versions 12.3X48 prior to 12.3X48-D30 Junos OS versions 15.1X49 prior to 15.1X49-D30...
Foscam C1 Indoor HD Camera cgiproxy.fcgi dns2 address configuration command injection vulnerability
Foscam C1 Indoor HD Camera is a wireless HD IP camera from Foscam China. A security vulnerability exists in the web management interface in the Foscam C1 Indoor HD Camera using application firmware version 2.52.2.37. The vulnerability can be exploited to inject arbitrary shell characters by sendi...
PT-2017-2975
Name of the Vulnerable Software and Affected Versions Asterisk versions 11.x through 11.25.1 Asterisk versions 13.x through 13.17.0 Asterisk versions 14.x through 14.6.0 Certified Asterisk versions 11.x through 11.6-cert16 Certified Asterisk versions 13.x through 13.13-cert4 Description The issue...
Command injection
'/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attackers to execute any shell command as root via a crafted HTTP request. This vulnerability is already verified on VIVOTEK Network Camera...
CVE-2017-9828
'/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attackers to execute any shell command as root via a crafted HTTP request. This vulnerability is already verified on VIVOTEK Network Camera...
CVE-2017-9828
'/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attackers to execute any shell command as root via a crafted HTTP request. This vulnerability is already verified on VIVOTEK Network Camera...
CVE-2017-9828
CVE-2017-9828 affects VIVOTEK Network Cameras (notably IB8369/FD8164/FD816BA). The web service CGI /cgi-bin/admin/testserver.cgi is vulnerable to shell command injection, allowing remote execution of commands as root via a crafted HTTP request. An attack uses shell metacharacters in the senderema...
PT-2017-2639
Name of the Vulnerable Software and Affected Versions VIVOTEK Network Camera IB8369, FD8164, and FD816BA affected versions not specified Description The issue is related to insufficient input processing in the /cgi-bin/admin/testserver.cgi web service of the network camera's firmware. This allows...
CVE-2017-9828: Improper Neutralization of Special Elements used in an OS Command
'/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attackers to execute any shell command as root via a crafted HTTP request. This vulnerability is already verified on VIVOTEK Network Camera...
UBUNTU-CVE-2015-9059
picocom before 2.0 has a command injection vulnerability in the 'send and receive file' command because the command line is executed by /bin/sh unsafely...
Design/Logic Flaw
An issue was discovered on Mimosa Client Radios before 2.2.4 and Mimosa Backhaul Radios before 2.2.4. On the backend of the device's web interface, there are some diagnostic tests available that are not displayed on the webpage; these are only accessible by crafting a POST request with a program...
CVE-2017-9135
The CVE-2017-9135 entry concerns Mimosa Client Radios and Mimosa Backhaul Radios prior to version 2.2.4. The issue lies in a backend web‑interface diagnostic feature that is not shown on the web UI but accessible via a crafted POST request (e.g., curl). One such test does not properly sanitize us...
PT-2017-18717
Name of the Vulnerable Software and Affected Versions Mimosa Client Radios versions prior to 2.2.4 Mimosa Backhaul Radios versions prior to 2.2.4 Description An issue was discovered on the backend of the device's web interface, where some diagnostic tests are not displayed on the webpage but are...
Updated ghostscript packages fix security vulnerability
Various userparams in Ghostscript allow %pipe% in paths, allowing remote shell command execution CVE-2016-7976. The .libfile function in Ghostscript doesn't check PermitFileReading array, allowing remote file disclosure CVE-2016-7977. Reference leak in the .setdevice function in Ghostscript allow...
CVE-2017-7692: Improper Input Validation
SquirrelMail 1.4.22 and other versions before 201704270200-SVN allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote server. The problem is in the...
PT-2017-3225
Name of the Vulnerable Software and Affected Versions XRootD versions 4.6.0 and below Description The issue is related to the lack of input sanitization in LDAP requests, which can be exploited by a remote attacker to execute arbitrary code. This can result in remote code execution due to an...
