CVE-2018-20969

doedscript in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the same commit as for CVE-2019-13638, but the ! syntax is specific to ed, and is unrelated to a shell metacharacter...

CVE-2018-16593

The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices allows Shell Metacharacter Injection...

CVE-2018-16593

The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices allows Shell Metacharacter Injection...

CVE-2018-16593

The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices allows Shell Metacharacter Injection...

CVE-2018-16593

CVE-2018-16593 affects Sony Bravia TV Photo Sharing Plus (up to version 8.587). The flaw is a shell metacharacter injection in the Photo Sharing Plus component, enabling arbitrary commands execution with root privileges if a device is on the same network. Exploitation is described as local/adjace...

Design/Logic Flaw

Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via multiple different requests...

CVE-2019-10631

Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via multiple different requests...

CVE-2019-10631

CVE-2019-10631 describes a Shell Metacharacter Injection in the Zyxel NAS 326 package installer (versions 5.21 and earlier). An authenticated attacker can execute arbitrary code via multiple different requests. Affected product: Zyxel NAS 326 (Hopscotch). Root cause: shell metacharacter handling ...

Grandstream GXP16xx Shell Metacharacter Injection Vulnerability

The Grandstream GXP16xx VoIP is a 16XX series IP phone from Grandstream. A shell metacharacter injection vulnerability exists in the SSH configuration interface of the Grandstream GXP16xx 1.0.4.128, which can be exploited by an attacker to execute arbitrary system commands and obtain a root shell...

CVE-2018-17565

Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commands and gain a root shell...

CVE-2018-17565

The CVE-2018-17565 entry concerns a Shell Metacharacter Injection vulnerability in the SSH configuration interface of Grandstream GXP16xx VoIP phones (firmware 1.0.4.128). The vulnerability allows an attacker to execute arbitrary system commands and obtain a root shell. Public documents identify ...

CVE-2018-19168

Shell Metacharacter Injection in www/modules/save.php in FruityWifi aka PatatasFritas/PatataWifi through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted modname parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid...

Design/Logic Flaw

Shell Metacharacter Injection in www/modules/save.php in FruityWifi aka PatatasFritas/PatataWifi through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted modname parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid...

CVE-2018-19168

Shell Metacharacter Injection in www/modules/save.php in FruityWifi aka PatatasFritas/PatataWifi through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted modname parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid...

CVE-2017-1000203

ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution...

Remote code execution

ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution...

CVE-2017-1000203

ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution...

CVE-2017-1000203

CVE-2017-1000203 concerns ROOT (the data analysis framework) versions 6.9.03 and earlier. The rootd daemon is vulnerable to an authenticated shell metacharacter injection, enabling remote code execution. Documents from multiple vendors/advisories consistently describe this vulnerability and its i...

GHSA-78J3-7WPM-QHVP Shell Metacharacter Injection in kelredd-pruview

kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to document.rb, video.rb, or videoimage.rb...

Shell Metacharacter Injection in kelredd-pruview

kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to document.rb, video.rb, or videoimage.rb...