DSA-1006-1 wzdftpd - missing input sanitising

Bulletin has no description...

Ubuntu 4.10 / 5.04 / 5.10 : imagemagick vulnerabilities (USN-246-1)

Florian Weimer discovered that the delegate code did not correctly handle file names which embed shell commands CVE-2005-4601. Daniel Kobras found a format string vulnerability in the SetImageInfo function CVE-2006-0082. By tricking a user into processing an image file with a specially crafted fi...

Code injection

Leif M. Wright's Blog 3.5 allows remote authenticated users with administrative privileges to execute arbitrary programs, including shell commands, by configuring the sendmail path to a malicious pathname...

Code injection

Unspecified vulnerability in guestex.pl in Teca Scripts Guestex 1.0 allows remote attackers to execute arbitrary shell commands via the email parameter, possibly involving shell metacharacters...

CVE-2006-0777

Unspecified vulnerability in guestex.pl in Teca Scripts Guestex 1.0 allows remote attackers to execute arbitrary shell commands via the email parameter, possibly involving shell metacharacters...

CVE-2006-0777

Guestex (Guestex 1.0) contains a command injection in guestex.pl: the email parameter is not sanitized, allowing remote attackers to execute arbitrary shell commands. Exploit available; no patch reported in the sources. Impact per CVSS notes partial confidentiality, integrity, and availability lo...

CVE-2006-0777

Unspecified vulnerability in guestex.pl in Teca Scripts Guestex 1.0 allows remote attackers to execute arbitrary shell commands via the email parameter, possibly involving shell metacharacters...

[SA18923] Leif M. Wright's Blog Multiple Vulnerabilities

TITLE: Leif M. Wright's Blog Multiple Vulnerabilities SECUNIA ADVISORY ID: SA18923 VERIFY ADVISORY: http://secunia.com/advisories/18923/ CRITICAL: Highly critical IMPACT: Security Bypass, Cross Site Scripting, Exposure of sensitive information, System access WHERE: From remote SOFTWARE: Leif M...

Ubuntu 4.10 / 5.04 : vim vulnerability (USN-154-1)

Georgi Guninski discovered that it was possible to construct Vim modelines that execute arbitrary shell commands by wrapping them in glob or expand function calls. If an attacker tricked an user to open a file with a specially crafted modeline, he could exploit this to execute arbitrary commands...

The Includer includer.cgi Arbitrary Command Execution

The remote host is running The Includer, a PHP script for emulating server-side includes. The version of The Includer installed on the remote host allows an attacker to execute arbitrary shell commands by including shell metacharacters as part of the URL. %NASLMINLEVEL 70300 C Tenable Network...

MediaWiki Language Option eval() Function Arbitrary PHP Code Execution

The version of MediaWiki running on the remote host is affected by a remote command execution vulnerability due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can execute arbitrary PHP and shell commands on the remote host, subject to the privileges of the we...

CVE-2005-3718

UTStarcom F1000 VOIP WIFI Phone s2.0 running VxWorks 5.5.1 with kernel WIND 2.6 does not allow users to disable access to 1 SNMP or 2 the rlogin port TCP 513, which allows remote attackers to exploit other vulnerabilities such as CVE-2005-3716, or execute arbitrary shell commands via rlogin, whic...

CVE-2005-3718

Affected product: UTStarcom F1000 VOIP WIFI Phone s2.0 running VxWorks 5.5.1 with kernel WIND 2.6. Vulnerability details: The device does not allow users to disable access to (1) SNMP or (2) rlogin on TCP 513, enabling remote attackers to trigger other vulnerabilities (e.g., CVE-2005-3716) or exe...

CVE-2005-3718

UTStarcom F1000 VOIP WIFI Phone s2.0 running VxWorks 5.5.1 with kernel WIND 2.6 does not allow users to disable access to 1 SNMP or 2 the rlogin port TCP 513, which allows remote attackers to exploit other vulnerabilities such as CVE-2005-3716, or execute arbitrary shell commands via rlogin, whic...

bizdb1-search.cgi located

One of the BizDB scripts, bizdb-search.cgi, passes a variable SPDX-FileCopyrightText: 2000 Roelof Temmingh Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SA17226] Linux Kernel Console Keyboard Mapping Shell Command Injection

TITLE: Linux Kernel Console Keyboard Mapping Shell Command Injection SECUNIA ADVISORY ID: SA17226 VERIFY ADVISORY: http://secunia.com/advisories/17226/ CRITICAL: Less critical IMPACT: Privilege escalation WHERE: Local system OPERATING SYSTEM: Linux Kernel 2.6.x http://secunia.com/product/2719/...

TWiki Remote Command Execution Vulnerability

This advisory alerts you of a potential security issue with your TWiki installation: The TWiki history function allows arbitrary shell command execution. The permanent place for this advisory is http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithRev . Please see updates and...

[SA16523] Netquery "host" Parameter Arbitrary Command Execution

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

FreeBSD : vim -- vulnerabilities in modeline handling: glob, expand (81f127a8-0038-11da-86bc-000e0c2e438a)

Georgi Guninski discovered a way to construct Vim modelines that execute arbitrary shell commands. The vulnerability can be exploited by including shell commands in modelines that call the glob or expand functions. An attacker could trick an user to read or edit a trojaned file with modelines...

USN-154-1: vim vulnerability

Georgi Guninski discovered that it was possible to construct Vim modelines that execute arbitrary shell commands by wrapping them in glob or expand function calls. If an attacker tricked an user to open a file with a specially crafted modeline, he could exploit this to execute arbitrary commands...