CVE-2018-19168

FruityWifi (PatatasFritas/PatataWifi)

CVE-2018-19168

Shell Metacharacter Injection in www/modules/save.php in FruityWifi aka PatatasFritas/PatataWifi through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted modname parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid...

CVE-2017-1000203

ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution...

CVE-2017-1000203

ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution...

Remote code execution

ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution...

CVE-2017-1000203

ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution...

CVE-2017-1000203

CVE-2017-1000203 concerns ROOT (the data analysis framework) versions 6.9.03 and earlier. The rootd daemon is vulnerable to an authenticated shell metacharacter injection, enabling remote code execution. Documents from multiple vendors/advisories consistently describe this vulnerability and its i...

CVE-2017-1000203

ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution...

GHSA-78J3-7WPM-QHVP Shell Metacharacter Injection in kelredd-pruview

kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to document.rb, video.rb, or videoimage.rb...

Shell Metacharacter Injection in kelredd-pruview

kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to document.rb, video.rb, or videoimage.rb...

CVE-2017-11322

The chrootholeclient executable in UCOPIA Wireless Appliance before 5.1.8 allows remote attackers to gain root privileges via a dollar sign $ metacharacter in the argument to chrootholeclient...

CVE-2017-11322

The chrootholeclient executable in UCOPIA Wireless Appliance before 5.1.8 allows remote attackers to gain root privileges via a dollar sign $ metacharacter in the argument to chrootholeclient...

CVE-2017-11322

The CVE-2017-11322 issue affects UCOPIA Wireless Appliance prior to 5.1.8, where the chroothole_client executable accepts parameters that can be exploited with a dollar sign ($) metacharacter to achieve root privileges. The vulnerability is tied to the chroothole_client argument handling, enablin...

CVE-2017-9328

Shell metacharacter injection vulnerability in /usr/www/include/ajax/GetTest.php in TerraMaster TOS before 3.0.34 leads to remote code execution as root...

CVE-2017-9328

CVE-2017-9328 affects TerraMaster TOS prior to 3.0.34. The vulnerability is a shell metacharacter injection in /usr/www/include/ajax/GetTest.php that enables remote code execution as root. Affected product: TerraMaster TOS (Linux-based). Root RCE is possible via crafted input through GetTest.php....

CVE-2017-9328

Shell metacharacter injection vulnerability in /usr/www/include/ajax/GetTest.php in TerraMaster TOS before 3.0.34 leads to remote code execution as root...

Authentication flaw

The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " double quote character and a command substitution metacharacter...

CVE-2017-5932

CVE-2017-5932 is a Bash local privilege escalation exploiting the path autocompletion feature. A crafted filename that begins with a double quote and includes a command substitution metacharacter can allow a local user to execute arbitrary code with elevated privileges. The vulnerability affects ...

CVE-2017-5932

The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " double quote character and a command substitution metacharacter...

git-fastclone Shell Metacharacter Injection Arbitrary Command Execution

git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to "cd " and "git clone " commands in the library...