514 matches found
CVE-2012-6298
CA IdentityMinder (r12.0 through CR16, r12.5 before SP15, and r12.6 GA) contains an unspecified vulnerability that could allow a remote attacker to execute arbitrary commands or modify data via unknown vectors. The issue is documented in the CA Security Notice CA20121220-01 and is addressed by pa...
CVE-2012-5955
Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server WAS for z/OS allows remote attackers to execute arbitrary commands via unknown vectors...
CVE-2012-4971
Multiple SQL injection vulnerabilities in Layton Helpbox 4.4.0 allow remote attackers to execute arbitrary SQL commands via the 1 reqclass parameter to editrequestenduser.asp; the 2 sysrequestid parameter to editrequestuser.asp; the 3 sysrequestid parameter to enduseractions.asp; the 4 sysrequest...
CVE-2012-5973
CA XCOM Data Transport r11.0 and r11.5 on UNIX and Linux allows remote attackers to execute arbitrary commands via a crafted request...
CA ARCserve Backup Authentication service invalid virtual function call
Added: 11/09/2012 CVE: CVE-2012-2971 BID: 56116 OSVDB: 86416 Background CA ARCserve Backup formerly BrightStor ARCserve Backup is a backup and recovery solution. Problem An invalid virtual function call in the authentication service allows remote attackers to execute arbitrary commands. Resolutio...
CVE-2012-2242
scripts/dget.pl in devscripts before 2.10.73 allows remote attackers to execute arbitrary commands via a crafted 1 .dsc or 2 .changes file, related to "arguments to external commands" that are not properly escaped, a different vulnerability than CVE-2012-2240...
CVE-2012-2982
file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as demonstrated by a | pipe character...
CVE-2010-5096
Multiple SQL injection vulnerabilities in MyBB aka MyBulletinBoard before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the keywords parameter in a 1 dosearch action to search.php or 2 dostuff action to private.php. NOTE: the vendor disputes this issue, saying "Although this...
CVE-2012-3399
Config/diff.php in Basilic 1.5.14 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter...
CVE-2012-2516
An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module aka the HTML Help component, as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA iFIX 5.0 and 5.1; Proficy Pulse 1.0; Proficy Batch Execution 5.6; SI7 I/O Driver 7.20 through 7.42; and other...
Sql injection
Multiple SQL injection vulnerabilities in GR Board aka grboard 1.8.6.5 Community Edition allow remote attackers to execute arbitrary SQL commands via the 1 tableType or 2 blindTarget parameter to view.php, 3 the delTargets0 parameter to viewmemo.php, or 4 the isReported parameter to writeok.php...
CVE-2012-1166
The default keybindings for wwm in LTSP Display Manager ldm 2.2.x before 2.2.7 allow remote attackers to execute arbitrary commands via the KPRETURN keybinding, which launches a terminal window...
Sql injection
Multiple SQL injection vulnerabilities in Support Incident Tracker aka SiT! before 3.64 allow remote attackers to execute arbitrary SQL commands via the 1 exc parameter to reportmarketing.php, 2 selected parameter to tasks.php, 3 sites parameter to billableincidents.php, or 4 searchstring paramet...
Double free
Double free vulnerability in the prepareexec function in src/exec.c in Logsurfer 1.5b and earlier, and Logsurfer+ 1.7 and earlier, allows remote attackers to execute arbitrary commands via crafted strings in a log file...
CVE-2012-0392
The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method...
CVE-2011-5031
Multiple SQL injection vulnerabilities in servlet/capexweb.parentvalidatepassword in cApexWEB 1.1 allow remote attackers to execute arbitrary SQL commands via the 1 dfuserid and 2 dfpassword parameters. NOTE: some of these details are obtained from third party information...
CVE-2011-4201
remotesupport.cgi in the Tadasoft Restorepoint 3.2 evaluation image allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 pid1 or 2 pid2 parameter in a stopremotesupport action...
Sql injection
Multiple SQL injection vulnerabilities in 1 cd-mapping-db.c and 2 cd-device-db.c in colord before 0.1.15 allow local users to execute arbitrary SQL commands via vectors related to color devices and a device id, b property, or c profile id...