Dell iDRAC Products IPMI Arbitrary Command Injection Vulnerability

The remote host is running a version of iDRAC that ships with a version of IPMI that does not sufficiently randomize session ID values. An unauthenticated, remote attacker can exploit this to inject arbitrary commands into a privileged session. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

[oCERT-2014-005] LPAR2RRD input sanitization errors

2014-005 LPAR2RRD input sanitization errors Description: LPAR2RRD is a performance monitoring and capacity planning software for IBM Power Systems. LPAR2RRD generates historical, future trends and nearly "real-time" CPU utilization graphs of LPAR's and shared CPU usage. Insufficient input...

Multiple Vendors STARTTLS Implementation Plaintext Arbitrary Command Injection Vulnerability

Multiple vendors SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.103935";...

PineApp Mail-SeCure test_li_connection.php Command Injection

Added: 08/08/2013 BID: 61477 OSVDB: 95782 Background PineApp Mail-SeCure is an e-mail security appliance which provides perimeter security protection to stop threats prior to their penetration of the customer's network, as well as post-perimeter anti-spam content inspection. Problem PineApp...

EMC AlphaStor Device Manager 0x75 Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC AlphaStor for EMC Networker. Authentication is not required to exploit this vulnerability. The specific flaw exists within Device Manager rrobotd.exe which listens by default on port 3000. When...

Oracle Secure Backup Administration Server login.php uname Parameter Arbitrary Command Injection

The version of Oracle Secure Backup Administration Server running on the remote host fails to adequately sanitize user-supplied input to the 'uname' parameter of 'login.php'. The system performs some sanitization which limits exploitation of this issue, but code execution is still possible. A...

AjaXplorer checkInstall.php Arbitrary Command Injection

The version of AjaXplorer running on the remote web server has a command injection vulnerability. Input passed to the 'destServer' parameter of 'checkInstall.php' is used in a call to popen without being properly sanitized. A remote, unauthenticated attacker could exploit this to execute arbitrar...

Debian: Security Advisory (DSA-1821-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Secure Backup Administration Server login.php Arbitrary Command Injection

The remote version of Oracle Secure Backup Administration Server fails to sanitize user-supplied input to various parameters used in the 'login.php' script before using it. By sending specially crafted arguments an attacker can exploit it to execute code on the remote host with the web server...

XOOPS Multiple Scripts mydirname Parameter Arbitrary Command Injection

The version of XOOPS installed on the remote host fails to filter user-supplied input to the 'mydirname' parameter of the 'onupdate.php', 'notification.php', and 'oninstall.php' scripts under the application's 'xoopslib/modules/protector' directory before passing it to PHP 'eval' functions...

CVE-2008-3335: Improper Control of Generation of Code

Unspecified vulnerability in PunBB before 1.2.19 allows remote attackers to inject arbitrary SMTP commands via unknown vectors...

UBB.threads doeditconfig Arbitrary Command Injection

The version of UBB.threads installed on the remote host fails to sanitize input to the 'thispath' and 'config' parameters of the 'admin/doeditconfig.php' script before using them to update the application's configuration file. Provided PHP's 'registerglobals' setting is enabled, an unauthenticate...

TWiki %INCLUDE Parameter Arbitrary Command Injection

According to its banner, the installed version of TWiki allows an attacker to manipulate input to the 'rev' parameter in order to execute arbitrary shell commands on the remote host subject to the privileges of the web server user id. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

FreeStyle Wiki Arbitrary Command Injection Vulnerability

Secunia Advisory: SA16612 Release Date: 2005-08-30 Critical: Moderately critical Impact: System access Where: From remote Solution Status: Vendor Patch Software: FreeStyle Wiki 3.x Select a product and view a complete list of all Patched/Unpatched Secunia advisories affecting it. Description: A...