CVE-2012-5534

The hookprocess function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a command from a plugin, related to "shell expansion."...

CVE-2012-5863 Sinapsi eSolar OS Command Injection

These Sinapsi devices do not check for special elements in commands sent to the system. By accessing certain pages with administrative privileges that do not require authentication within the device, attackers can execute arbitrary, unexpected, or dangerous commands directly onto the operating...

CVE-2012-5347

TinyWebGallery 1.8.3 allows remote attackers to execute arbitrary code via shell metacharacters in the command parameter to 1 inc/filefunctions.inc or 2 info.php...

Command injection

TinyWebGallery 1.8.3 allows remote attackers to execute arbitrary code via shell metacharacters in the command parameter to 1 inc/filefunctions.inc or 2 info.php...

CVE-2012-5347

TinyWebGallery 1.8.3 allows remote attackers to execute arbitrary code via shell metacharacters in the command parameter to 1 inc/filefunctions.inc or 2 info.php...

CVE-2012-5347

The CVE-2012-5347 entry concerns TinyWebGallery 1.8.3, where remote attackers can execute arbitrary code by supplying shell metacharacters in the command parameter to (1) inc/filefunctions.inc or (2) info.php. The vulnerability constitutes a command-injection flaw that can be triggered over the n...

CVE-2011-4639

CVE-2011-4639 concerns SpamTitan WebTitan prior to version 3.60, where the (1) Traceroute and (2) Ping implementations in tools.php are vulnerable. The underlying issue allows remote authenticated users to execute arbitrary commands through shell metacharacters in an argument, demonstrated by an ...

Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : devscripts vulnerabilities (USN-1593-1)

Raphael Geissert discovered that the debdiff.pl tool incorrectly handled shell metacharacters. If a user or automated system were tricked into processing a specially crafted filename, a remote attacker could possibly execute arbitrary code. CVE-2012-0212 Raphael Geissert discovered that the...

Code injection

dev/less.php in Family Connections CMS FCMS 2.5.0 - 2.7.1, when registerglobals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv1 parameter...

DEBIAN-CVE-2012-2085

The execcommand function in common/helpers.py in Gajim before 0.15 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in an href attribute...

CVE-2012-2085

The execcommand function in common/helpers.py in Gajim before 0.15 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in an href attribute...

CVE-2012-2085

The execcommand function in common/helpers.py in Gajim before 0.15 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in an href attribute...

Design/Logic Flaw

The execcommand function in common/helpers.py in Gajim before 0.15 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in an href attribute...

CVE-2012-2085

The execcommand function in common/helpers.py in Gajim before 0.15 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in an href attribute...

Code injection

lhn/public/network/ping in HP SAN/iQ 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the 1 first, 2 third, or 3 fourth parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4361...

Code injection

lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the second parameter...

CVE-2012-2986

Affected software/variant: HP SAN/iQ Virtual SAN Appliance (9.5 released prior) with the lhn/public/network/ping component. Vulnerability details: Remote authenticated users can execute arbitrary commands via shell metacharacters in specific parameters (the first, third, or fourth parameter as ci...

CVE-2012-4361

CVE-2012-4361 concerns HP SAN/iQ’s Virtual SAN Appliance, where the component at lhn/public/network/ping allows remote authenticated users to execute arbitrary shell commands by injecting metacharacters in the second parameter. The vulnerability affects HP SAN/iQ versions up to and including 9.4/...

Code injection

The Amazon Lab126 com.lab126.system sendEvent implementation on the Kindle Touch before 5.1.2 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a string, as demonstrated by using lipc-set-prop to set an LIPC property, a different vulnerability than...

CVE-2012-4249

The vulnerability CVE-2012-4249 affects Amazon Kindle Touch prior to 5.1.2, specifically the com.lab126.system sendEvent implementation. The issue allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a string, demonstrated by lipc-set-prop to set an LIPC pr...