CVE-2008-7158

Numara FootPrints 7.5a through 7.5a1 and 8.0 through 8.0a allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 transcriptFile parameter to MRcgi/MRchat.pl or 2 LOADFILE parameter to MRcgi/MRABLoad2.pl. NOTE: some of these details are obtained from third party...

CVE-2008-7158

Numara FootPrints versions 7.5a–8.0a are affected by a remote command execution vulnerability due to unsanitized shell metacharacters in the transcriptFile parameter to MRcgi/MRchat.pl or the LOADFILE parameter to MRcgi/MRABLoad2.pl. The underlying issue enables arbitrary command execution with a...

lftp mirror --script does not escape names and targets of symbolic links

mirror --script in lftp before 3.5.9 does not properly quote shell metacharacters, which might allow remote user-assisted attackers to execute shell commands via a malicious script. NOTE: it is not clear whether this issue crosses security boundaries, since the script already supports commands su...

Low: Red Hat Security Advisory: lftp security and bug fix update

An updated lftp package that fixes one security issue and various bugs is now available for Red Hat Enterprise Linux 5. This update has been rated as having low security impact by the Red Hat Security Response Team. LFTP is a sophisticated file transfer program for the FTP and HTTP protocols. Lik...

RHEL 5 : lftp (RHSA-2009:1278)

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2009:1278 advisory. LFTP is a sophisticated file transfer program for the FTP and HTTP protocols. Like bash, it has job control and uses the readline library for input. ...

Mandrake Security Advisory MDVSA-2009:187 (nagios)

The remote host is missing an update to nagios announced via advisory MDVSA-2009:187. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

CVE-2009-2765

httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI...

CVE-2009-2765

The DD-WRT firmware (versions 24 sp1 and others before build 12533 ) is vulnerable to a remote command injection flaw in the httpd.c component of the management GUI. The root cause is a failure to adequately sanitize user-supplied input data, allowing unauthenticated attackers to execute arbitrar...

CVE-2009-2765: Improper Input Validation

httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI...

CVE-2009-1383

The getdirective function in mathtex.cgi in mathTeX, when downloaded before 20090713, allows remote attackers to execute arbitrary commands via shell metacharacters in the dpi tag...

CVE-2009-1383

The getdirective function in mathtex.cgi in mathTeX, when downloaded before 20090713, allows remote attackers to execute arbitrary commands via shell metacharacters in the dpi tag...

CVE-2009-1383

CVE-2009-1383 concerns mathTeX: the getdirective function in mathtex.cgi mishandles input in the dpi tag, allowing remote command execution via shell metacharacters before 20090713. Multiple sources (Veracode, Tenable NASL, NVD/OSVUbuntu/PRION) describe remote code execution risk for mathTeX, wit...

CVE-2009-1383

The getdirective function in mathtex.cgi in mathTeX, when downloaded before 20090713, allows remote attackers to execute arbitrary commands via shell metacharacters in the dpi tag...

CVE-2009-1383

The getdirective function in mathtex.cgi in mathTeX, when downloaded before 20090713, allows remote attackers to execute arbitrary commands via shell metacharacters in the dpi tag...

CVE-2009-1383: Improper Control of Generation of Code

The getdirective function in mathtex.cgi in mathTeX, when downloaded before 20090713, allows remote attackers to execute arbitrary commands via shell metacharacters in the dpi tag...

No title provided

statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 ping or 2 Traceroute parameters...

CVE-2009-2288

statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 ping or 2 Traceroute parameters...

CVE-2009-2288

statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 ping or 2 Traceroute parameters...

Code injection

statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 ping or 2 Traceroute parameters...

Immunity Canvas: NAGIOS_PING

Name| nagiosping ---|--- CVE| CVE-2009-2288 Exploit Pack| CANVAS Description| nagiosping Notes| CVE Name: CVE-2009-2288 VENDOR: http://www.nagios.org/ CVEUrl: https://vulners.com/cve/CVE-2009-2288 Notes: statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands vi...