Design/Logic Flaw

Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. On CloudBridge the former name of NetScaler SD-WAN devices, the cookie name was CAKEPHP rather than CGISESSID...

CVE-2017-6320

A remote command injection vulnerability exists in the Barracuda Load Balancer product line confirmed on v5.4.0.004 2015-11-26 and v6.0.1.006 2016-08-19; fixed in 6.1.0.003 2017-01-17 in which an authenticated user can execute arbitrary shell commands and gain root privileges. The vulnerability...

CVE-2017-6707

A vulnerability in the CLI command-parsing code of the Cisco StarOS operating system for Cisco ASR 5000 Series 11.0 through 21.0, 5500 Series, and 5700 Series devices and Cisco Virtualized Packet Core VPC Software could allow an authenticated, local attacker to break from the StarOS CLI of an...

CVE-2017-2828

An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during account creation resulting in...

Sophos Web Appliance < 4.3.1 Multiple Remote Command Injection Vulnerabilities

According to its self-reported version number, the Sophos Web Appliance software running on the remote host is prior to 4.3.1. It is, therefore, affected by multiple vulnerabilities : - A remote command injection vulnerability exists in the web administration interface in the...

Arbitrary shell execution

Security Advisory - This release contains a fix for a security advisory related to the improper handling of a shell command - A properly crafted filename would allow for arbitrary code execution when using the --filter=gitmodified command line option - All version 3 users are encouraged to upgrad...

CVE-2017-7692

SquirrelMail 1.4.22 and other versions before 201704270200-SVN allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote server. The problem is in the...

SquirrelMail -- post-authentication remote code execution

SquirrelMail developers report: SquirrelMail 1.4.22 and other versions before 201704270200-SVN allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote...

CVE-2014-3927

mrlg-lib.php in mrlg4php before 1.0.8 allows remote attackers to execute arbitrary shell code...

Code injection

mrlg-lib.php in mrlg4php before 1.0.8 allows remote attackers to execute arbitrary shell code...

Arbitrary shell execution

Security Advisory This release contains a fix for a security advisory related to the improper handling of shell commands Uses of shellexec and exec were not escaping filenames and configuration settings in most cases A properly crafted filename or configuration option would allow for arbitrary co...

Wordpress dance studio 1.0.0 Themes - Arbitrary Shell Upload Vulnerbility

Exploit for php platform in category web applications Exploit Title : Wordpress Themes dance-studio - Arbitrary Shell Upload vulnerbility Author : xBADGIRL21 Google Dork: inurl:/wp-content/themes/dance-studio Date: 12-11-2017 Vendor Homepage: http://themes.cmsmasters.net/?theme=dance-studio by...

Design/Logic Flaw

A vulnerability in CLI command processing in the Cisco Firepower 4100 Series Next-Generation Firewall and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to inject arbitrary shell commands that are executed by the device. More Information: CSCvb61343. Known...

CVE-2017-3806

A vulnerability in CLI command processing in the Cisco Firepower 4100 Series Next-Generation Firewall and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to inject arbitrary shell commands that are executed by the device. More Information: CSCvb61343. Known...

ECommerce Multi-Vendor Software - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Vulnerability:Profile Arbitrary Shell Upload Google Dork: ECommerce-TIBSECART Date:11.01.2017 Vendor Homepage: http://www.tibsolutions.com/tibs-ecart/ Script Name: ECommerce-TIBSECART Script Buy Now: http://www.tibsolutions.com/tibs-ecart/...

Penny Auction Script - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Vulnerability:Profile Arbitrary Shell Upload Google Dork: Penny Auction Script Date:11.01.2017 Vendor Homepage: http://www.tibsolutions.com/tibs-eauction/ Script Name: Penny Auction Script Script Buy Now:...

Airbnb Clone Script - Arbitrary File Upload

Airbnb Clone Script - Arbitrary File Upload Vulnerability:Profile Arbitrary Shell Upload Google Dork: Airbnb Clone Script Date:11.01.2017 Vendor Homepage: http://www.tibsolutions.com/airbnb-clone/ Script Name: Airbnb Clone Script Script Buy Now:...

ECommerce-Multi-Vendor Software - Arbitrary File Upload

ECommerce-Multi-Vendor Software - Arbitrary File Upload Vulnerability:Profile Arbitrary Shell Upload Google Dork: ECommerce-Multi-Vendor Software Date:11.01.2017 Vendor Homepage: http://www.tibsolutions.com/multi-vendor/ Script Name: ECommerce-Multi-Vendor Software Script Buy Now:...

Shell Injection

rack-perftoolsprofiler is vulnerable to shell injection attacks. A malicious user can inject and execute arbitrary shell code when passing arguments to the profiler...

Less.js Untrusted File Compilation / Code Execution

Advisory: Less.js: Compilation of Untrusted LESS Files May Lead to Code Execution through the JavaScript Less Compiler RedTeam Pentesting discovered behaviour in the Less.js compiler, which allows execution of arbitrary code if an untrusted LESS file is compiled. Details ======= Product: Less...