CVE-2014-5521

plugins/useradmin/fingeruser.php in XRMS CRM, possibly 1.99.2, allows remote authenticated users to execute arbitrary code via shell metacharacters in the username parameter...

CVE-2014-5073

vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands via shell metacharacters in the fileDate parameter in a DOWN call...

CVE-2014-5073

CVE-2014-5073 affects VMTurbo Operations Manager (vmtadmin.cgi) prior to 4.6 build 28657. The vulnerability allows remote command execution via shell metacharacters in the fileDate parameter of a DOWN call, enabling arbitrary commands. Connected sources indicate public exploitation/public PoCs an...

Code injection

vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands via shell metacharacters in the fileDate parameter in a DOWN call...

CVE-2014-2593

Aruba Networks ClearPass Policy Manager 6.3.0.60730 contains a command injection flaw in its management console, where local users can execute arbitrary shell commands via metacharacters in arguments of valid commands (notably system status-rasession and network ping). This CVE (CVE-2014-2593) is...

Design/Logic Flaw

The management console in Aruba Networks ClearPass Policy Manager 6.3.0.60730 allows local users to execute arbitrary commands via shell metacharacters in certain arguments of a valid command, as demonstrated by the 1 system status-rasession and 2 network ping commands...

DEBIAN-CVE-2014-5261

The graph settings script graphsettings.php in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php...

Code injection

The graph settings script graphsettings.php in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php...

CVE-2014-5261

The graph settings script graphsettings.php in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php...

UBUNTU-CVE-2014-5261

The graph settings script graphsettings.php in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php...

Code injection

systest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the lpres parameter...

CVE-2014-3085

Affected product : IBM Global Console Manager switches (GCM16 and GCM32). Version impact : firmware versions prior to 1.20.20.23447 are affected. Vulnerability : CVE-2014-3085 — Improper handling in systest.php allows a remote authenticated attacker to execute arbitrary commands via shell metacha...

CVE-2014-3085

systest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the lpres parameter...

[DLA 31-1] reportbug security update

Package : reportbug Version : 4.12.6+deb6u1 CVE ID : CVE-2014-0479 Fix CVE-2014-0479: Arbitrary code execution in compareversions. A man-in-the-middle attacker could put shell metacharacters in the version number, causing execution of code of their choice...

CVE-2014-5090

admin/options/logs.php in Status2k allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the Location field in Add Logs in the Admin Panel...

Code injection

admin/options/logs.php in Status2k allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the Location field in Add Logs in the Admin Panel...

Debian DSA-2997-1 : reportbug - security update

Jakub Wilk discovered a remote command execution flaw in reportbug, a tool to report bugs in the Debian distribution. A man-in-the-middle attacker could put shell metacharacters in the version number allowing arbitrary code execution with the privileges of the user running reportbug. %NASLMINLEVE...

DSA-2997-1 reportbug - security update

Bulletin has no description...

Code injection

maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter...

CVE-2014-5023

Repository.php in Gitter, as used in Gitlist, allows remote attackers with commit privileges to execute arbitrary commands via shell metacharacters in a branch name, as demonstrated by a "git checkout -b" command...