CVE-2018-16593: Improper Neutralization of Special Elements used in an OS Command

The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices allows Shell Metacharacter Injection...

CVE-2019-10631

Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via multiple different requests...

Design/Logic Flaw

Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via multiple different requests...

CVE-2019-10631

CVE-2019-10631 describes a Shell Metacharacter Injection in the Zyxel NAS 326 package installer (versions 5.21 and earlier). An authenticated attacker can execute arbitrary code via multiple different requests. Affected product: Zyxel NAS 326 (Hopscotch). Root cause: shell metacharacter handling ...

CVE-2019-10631: Improper Neutralization of Special Elements used in an OS Command

Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via multiple different requests...

PT-2019-11950

Name of the Vulnerable Software and Affected Versions Zyxel NAS 326 versions 5.21 and below Description The issue allows an authenticated attacker to execute arbitrary code via multiple different requests due to Shell Metacharacter Injection in the package installer. Recommendations For Zyxel NAS...

Grandstream GXP16xx Shell Metacharacter Injection Vulnerability

The Grandstream GXP16xx VoIP is a 16XX series IP phone from Grandstream. A shell metacharacter injection vulnerability exists in the SSH configuration interface of the Grandstream GXP16xx 1.0.4.128, which can be exploited by an attacker to execute arbitrary system commands and obtain a root shell...

CVE-2018-17565

Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commands and gain a root shell...

CVE-2018-17565

The CVE-2018-17565 entry concerns a Shell Metacharacter Injection vulnerability in the SSH configuration interface of Grandstream GXP16xx VoIP phones (firmware 1.0.4.128). The vulnerability allows an attacker to execute arbitrary system commands and obtain a root shell. Public documents identify ...

PT-2019-9506

Name of the Vulnerable Software and Affected Versions Grandstream GXP16xx VoIP version 1.0.4.128 Description The issue allows attackers to execute arbitrary system commands and gain a root shell due to Shell Metacharacter Injection in the SSH configuration interface. Recommendations For Grandstre...

CVE-2018-17565: Improper Neutralization of Special Elements used in an OS Command

Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commands and gain a root shell...

Design/Logic Flaw

Shell Metacharacter Injection in www/modules/save.php in FruityWifi aka PatatasFritas/PatataWifi through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted modname parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid...

CVE-2018-19168

Shell Metacharacter Injection in www/modules/save.php in FruityWifi aka PatatasFritas/PatataWifi through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted modname parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid...

CVE-2018-19168

Shell Metacharacter Injection in www/modules/save.php in FruityWifi aka PatatasFritas/PatataWifi through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted modname parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid...

CVE-2018-19168: Improper Neutralization of Special Elements used in an OS Command

Shell Metacharacter Injection in www/modules/save.php in FruityWifi aka PatatasFritas/PatataWifi through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted modname parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid...

CVE-2018-19168

FruityWifi (PatatasFritas/PatataWifi)

CVE-2018-19168

Shell Metacharacter Injection in www/modules/save.php in FruityWifi aka PatatasFritas/PatataWifi through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted modname parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid...

PT-2018-13980

Name of the Vulnerable Software and Affected Versions FruityWifi version 2.1 Description The issue allows remote attackers to execute arbitrary commands. This can be achieved by injecting shell metacharacters into specific parameters in two API endpoints: "/www/script/config iface.php" and...

CVE-2017-1000203

ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution...

Remote code execution

ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution...