Design/Logic Flaw

confdatetime in Secudos DOMOS 5.8 allows remote attackers to execute arbitrary commands as root via shell metacharacters in the zone field obtained from the web interface...

CVE-2020-14293

confdatetime in Secudos DOMOS 5.8 allows remote attackers to execute arbitrary commands as root via shell metacharacters in the zone field obtained from the web interface...

GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.

...

VulnCheck KEV: CVE-2008-4873

board.cgi in Sepal SPBOARD 4.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter during a downfile action...

TP-Link Cloud Cameras NCXXX Bonjour Command Injection

TP-Link cloud cameras NCXXX series NC200, NC210, NC220, NC230, NC250, NC260, NC450 are vulnerable to an authenticated command injection. In all devices except NC210, despite a check on the name length in swSystemSetProductAliasCheck, no other checks are in place in order to prevent shell...

Command injection

tz.pl on XoruX LPAR2RRD and STOR2RRD 2.70 virtual appliances allows cmd=set&tz=OS command injection via shell metacharacters in a timezone...

CVE-2020-24032

CVE-2020-24032 affects XoruX LPAR2RRD and STOR2RRD 2.70 virtual appliances via the tz.pl script: it permits command injection through shell metacharacters in the timezone (cmd=set&tz=OS). The Red Hat/PRION/PR security records corroborate the same vulnerability. No exploitation status is provided ...

CVE-2020-11733

An issue was discovered on Spirent TestCenter and Avalanche appliance admin interface firmware. An attacker, who already has access to an SSH restricted shell, can achieve root access via shell metacharacters. The attacker can then, for example, read sensitive files such as appliance admin...

CVE-2020-17368

Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may lead to command injection...

DEBIAN-CVE-2020-17368

Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may lead to command injection...

Command injection

Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may lead to command injection...

CVE-2020-17368

CVE-2020-17368 affects Firejail prior to 0.9.64. It arises when using --output or --output-stderr, where shell metacharacters are mishandled and the command line arguments are concatenated into a single string passed to a shell, enabling potential command injection. Public disclosures in Debian L...

Pi-Hole Elevation of Privilege Vulnerability

Pi-hole is a multi-platform, network-wide ad-blocking tool with support for... ,.., Pi-Hole suffers from a security vulnerability. The vulnerability can be exploited by an attacker to access with root privileges with the help of shell metacharacters...

CVE-2020-12620

Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection shell metacharacters after an IP address...

Command injection

An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to execute the pihole core script as root without a password, which could allow an attacker to obtain root access via shell metacharacters to this script's setdns command...

CVE-2020-14162

An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to execute the pihole core script as root without a password, which could allow an attacker to obtain root access via shell metacharacters to this script's setdns command...

CVE-2020-14162

CVE-2020-14162 concerns Pi-Hole up to version 5.0, where the local www-data user has passwordless sudo to run the pihole core script as root via its setdns command. This enables potential root access through shell metacharacters in setdns. The vulnerability is described consistently across multip...

Tenda AC15 Remote Code Execution Vulnerability

Tenda AC15 AC1900 is a wireless router from Tenda, a Chinese company. A security vulnerability exists in the goform/AdvSetLanip endpoint in the Tenda AC15 AC1900 version 15.03.05.19. The vulnerability can be exploited by a remote attacker to execute arbitrary system commands via shell...

CVE-2020-15477

The WebControl in RaspberryTortoise through 2012-10-28 is vulnerable to remote code execution via shell metacharacters in a URI. The file nodejs/raspberryTortoise.js has no validation on the parameter incomingString before passing it to the childprocess.exec function...

Remote code execution

The WebControl in RaspberryTortoise through 2012-10-28 is vulnerable to remote code execution via shell metacharacters in a URI. The file nodejs/raspberryTortoise.js has no validation on the parameter incomingString before passing it to the childprocess.exec function...