CVE-2022-23935

CVE-2022-23935 The Exiftool software program, in versions prior to 12.38, has a security vulnerability that can be exploited through a specially crafted filename. This vulnerability allows for command injection, where an attacker can execute arbitrary commands on the system by appending a pipe...

CVE-2012-2982

CVE-2012-2982 Description file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as demonstrated by a | pipe character. Installation 1. git clone https://github.com/CpyRe/CVE-2012-2982.git 2. pip3 install -...

CVE-2026-62982

A flaw was found in Glances, an open-source system monitoring tool. The sanitizemustachedict function in glances/actions.py did not properly sanitize nested list and dictionary strings, specifically process command-line values. This allowed pipe characters to bypass the sanitization process and b...

SUSE CVE-2026-62982

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

CVE-2026-62982

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

CVE-2026-55578 Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shellexec. After the fix for GHSA-9643-6xjp-vx57 which...

CVE-2026-46739

A flaw was found in perl-Net-Statsd. This vulnerability allows an attacker to inject additional statsd metrics due to insufficient validation of metric names and values. Specifically, the software does not properly check for newlines, colons, or pipes in metric names, nor does it ensure that valu...

The vulnerability of the JRPC application interface of the FortiSandbox threat detection and mitigation system allows a perpetrator to execute arbitrary code.

The vulnerability of the JRPC application interface of the FortiSandbox threat detection and mitigation system is related to the failure to eliminate special elements “|” when processing the jid parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending...

EUVD-2020-0305

Malware in sbrugna...

In older versions of Sendmail, an attacker could use a pipe character to execute root commands.

...

Discourse Security Breach

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. A security vulnerability exists in Discourse prior to version 3.1.3, which stems from the fact that if a user's full name uses "|" and the user is quoted, updating the user's...

rake: OS Command Injection via egrep in Rake::FileList

There is an OS command injection vulnerability in Ruby Rake 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |...

UBUNTU-CVE-2021-31799

In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename...

OESA-2021-1150 rubygem-mini_magick security update

A ruby wrapper for ImageMagick command line. Using MiniMagick the ruby processes memory remains small it spawns ImageMagick's command line program mogrify which takes up some memory as well, but is much smaller compared to RMagick. Security Fixes: In lib/minimagick/image.rb in MiniMagick before...

GHSA-JPPV-GW3R-W3Q8 OS Command Injection in Rake

There is an OS command injection vulnerability in Ruby Rake before 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |...

CVE-2020-8130

There is an OS command injection vulnerability in Ruby Rake 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |...

CVE-2020-8130

There is an OS command injection vulnerability in Ruby Rake 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |...

Command injection

There is an OS command injection vulnerability in Ruby Rake 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |...

CVE-2020-8130

There is an OS command injection vulnerability in Ruby Rake 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |...

CVE-2020-8130: Improper Neutralization of Special Elements used in an OS Command

There is an OS command injection vulnerability in Ruby Rake 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |...