CVE-2006-3126

c2faxrecv in capi4hylafax 01.02.03 allows remote attackers to execute arbitrary commands via null \0 and shell metacharacters in the TSI string, as demonstrated by a fax from an anonymous number...

CVE-2006-3126

CVE-2006-3126 affects capi4hylafax (c2faxrecv) where the receiver does not sanitize TSI strings, enabling remote attackers to execute arbitrary commands by injecting nulls (\0) and shell metacharacters in the TSI field from an anonymous fax. The advisory/references document the vulnerability as e...

CVE-2006-3126

Removed by vendor...

CVE-2006-4081

CVE-2006-4081 affects Barracuda Spam Firewall (BSF) versions 3.3.01.001–3.3.03.053 . The vulnerability in preview_email.cgi allows remote attackers to execute commands via shell metacharacters in the file parameter, yielding remote command execution with likely limited privileges. The exploit can...

CVE-2006-4081

previewemail.cgi in Barracuda Spam Firewall BSF 3.3.01.001 through 3.3.03.053 allows remote attackers to execute commands via shell metacharacters "|" pipe symbol in the file parameter. NOTE: the attack can be extended to arbitrary commands by the presence of CVE-2006-4000...

CVE-2006-3633

OSSP shiela 1.1.5 and earlier allows remote authenticated users to execute arbitrary commands on the CVS server via shell metacharacters in a filename that is committed...

CVE-2006-3633

CVE-2006-3633 concerns OSSP Shiela (1.1.5 and earlier), a CVS repository extension. The vulnerability allows remote authenticated users to execute arbitrary commands on the CVS server by crafting shell metacharacters into a filename during commit. This is the explicit impact: arbitrary code execu...

CVE-2006-3633

OSSP shiela 1.1.5 and earlier allows remote authenticated users to execute arbitrary commands on the CVS server via shell metacharacters in a filename that is committed...

local to local copy uses shell expansion twice

scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice...

Default configuration

AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the configdir parameter to awstats.pl to upload a configuration file whose name contains shell metacharacters, then access that file using the LogFile directive...

DEBIAN-CVE-2006-2644

AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the configdir parameter to awstats.pl to upload a configuration file whose name contains shell metacharacters, then access that file using the LogFile directive...

Authentication flaw

ping.php in Russcom.Ping allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter...

CVE-2006-2615

ping.php in Russcom.Ping allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter...

CVE-2006-2615

The CVE-2006-2615 entry concerns ping.php in Russcom.Ping, where the domain parameter is vulnerable to shell metacharacter input leading to remote command execution. The NVD entry indicates network-based, low-complexity exploitation with no authentication required and potential partial impacts to...

Code injection

Prodder before 0.5, and perlpodder before 0.5, allows remote attackers to execute arbitrary code via shell metacharacters in the URL of a podcast url attribute of an enclosure tag, or $encurl variable, which is executed when running wget...

CVE-2005-1752

CVE-2005-1752 affects the Gforge SCM component, specifically viewFile.php, where the file_name parameter can be manipulated to execute arbitrary shell commands. The issue exists in Gforge before version 4.0, enabling remote attackers to run commands with the shell via crafted input. The provided ...

CVE-2006-2237

The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter...

Code injection

The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter...

CVE-2006-2237

The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter...

CVE-2006-2237

The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter...