CVE-2014-0359

Xangati XSR before 11 and XNR before 7 allows remote attackers to execute arbitrary commands via shell metacharacters in a guiinputtest.pl params parameter to servlet/Installer...

CVE-2014-0356

The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00BFQ.6C0 allows remote attackers to execute arbitrary code via shell metacharacters in input to the 1 detectWeather, 2 setlanguage, 3 SystemCommand, or 4 NTPSyncWithHost function in management.c, or a 5 SET COUNTRY, 6 SET WLAN SSID, ...

Design/Logic Flaw

The network interface configuration page netinterface in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter...

CVE-2013-6769

The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android allows attackers to gain privileges via shell metacharacters in the -c option to /system/xbin/su...

Design/Logic Flaw

The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android allows attackers to gain privileges via shell metacharacters in the -c option to /system/xbin/su...

Code injection

The Chainfire SuperSU package before 1.69 for Android allows attackers to gain privileges via the 1 backtick or 2 $ type of shell metacharacters in the -c option to /system/xbin/su...

CVE-2013-6769

The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android allows attackers to gain privileges via shell metacharacters in the -c option to /system/xbin/su...

CVE-2013-6775

The Chainfire SuperSU package before 1.69 for Android allows attackers to gain privileges via the 1 backtick or 2 $ type of shell metacharacters in the -c option to /system/xbin/su...

CVE-2013-6775

The CVE-2013-6775 entry describes a privilege escalation in Chainfire SuperSU for Android, affected before version 1.69. The root cause is that the -c argument to /system/xbin/su can be parsed through shell metacharacters (backtick or $( )), allowing an attacker-controlled command to be executed ...

SkyBlueCanvas CMS Remote Command Execution (CVE-2014-1683)

A remote code execution vulnerability has been reported in SkyBlueCanvas CMS. The vulnerability is due to the filebashMail function that allows remote attackers to execute arbitrary commands, when the pid parameter is 4. A remote attacker can exploit this vulnerability by execute arbitrary comman...

CVE-2011-5274

The drawAdminToolsPackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control DTC before 0.32.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the dtcpkgdirectory parameter in a doinstall action to dtc/...

CVE-2011-3195

shared/inc/sql/lists.php in Domain Technologie Control DTC before 0.34.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in mailing list tunable options...

CVE-2011-5274

The drawAdminToolsPackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control DTC before 0.32.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the dtcpkgdirectory parameter in a doinstall action to dtc/...

CVE-2011-3195

shared/inc/sql/lists.php in Domain Technologie Control DTC before 0.34.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in mailing list tunable options...

Design/Logic Flaw

The drawAdminToolsPackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control DTC before 0.32.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the dtcpkgdirectory parameter in a doinstall action to dtc/...

CVE-2011-5274

The CVE-2011-5274 issue affects Domain Technologie Control (DTC) before version 0.32.11, where the drawAdminTools_PackageInstaller function in shared/inc/forms/packager.php allows remote attackers to execute arbitrary commands via shell metacharacters in the dtcpkg_directory parameter during a do...

Code injection

Sophos Web Appliance before 3.7.8.2 allows 1 remote attackers to execute arbitrary commands via shell metacharacters in the client-ip parameter to the Block page, when using the userworkstation variable in a customized template, and remote authenticated users to execute arbitrary commands via she...

CVE-2013-2642

Vulnerability : CVE-2013-2642 affects Sophos Web Protection Appliance (pre-3.7.8.2). The issue enables OS command injection in multiple contexts: (1) OS commands via the Block page when a customized template uses the client-ip variable, (2) commands via the Diagnostic Tools URL parameter, and (3)...

Arabic Prawn Gem for Ruby lib/string_utf_support.rb User Input Handling Remote Command Injection

Arabic Prawn Gem for Ruby contains a flaw in the lib/stringutfsupport.rb file. The issue is due to the program failing to sanitize user input. This may allow a remote attacker to inject arbitrary commands. "lib/stringutfsupport.rb" in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to...

CVE-2013-6719

CVE-2013-6719 affects IBM Tealeaf CX Passive Capture Application (PCA) web console (PHP) builds 3611 and 3620. The vulnerability is a remote OS command injection in the testconn_host parameter of delivery.php, allowing an authenticated remote attacker to execute arbitrary commands on the host. IB...