PT-2006-2107 · Apache · Htpasswd

Name of the Vulnerable Software and Affected Versions: htpasswd versions 2.25b and earlier Description: The issue allows local users to gain privileges via shell metacharacters in a command line argument, which is used in a call to the system function. This could potentially be exploited in...

CVE-2006-1079

CVE-2006-1079 concerns the htpasswd utility used by Acme thttpd (notably 2.25b) where local users can escalate privileges through shell metacharacters passed as command-line arguments to system(). Several sourced entries indicate this vulnerability exists in htpasswd and note the issue may be exp...

CVE-2006-0777

Unspecified vulnerability in guestex.pl in Teca Scripts Guestex 1.0 allows remote attackers to execute arbitrary shell commands via the email parameter, possibly involving shell metacharacters...

CVE-2006-0777

Guestex (Guestex 1.0) contains a command injection in guestex.pl: the email parameter is not sanitized, allowing remote attackers to execute arbitrary shell commands. Exploit available; no patch reported in the sources. Impact per CVSS notes partial confidentiality, integrity, and availability lo...

CVE-2006-0777

Unspecified vulnerability in guestex.pl in Teca Scripts Guestex 1.0 allows remote attackers to execute arbitrary shell commands via the email parameter, possibly involving shell metacharacters...

security flaw

The delegate code in ImageMagick 6.2.4.5-0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename that is processed by the display command...

Code injection

myquiz.pl in Dale Ray MyQuiz 1.01 allows remote attackers to execute arbitrary commands via shell metacharacters in the URL, which are not properly handled as part of the PATHINFO environment variable...

CVE-2006-0628

myquiz.pl in Dale Ray MyQuiz 1.01 allows remote attackers to execute arbitrary commands via shell metacharacters in the URL, which are not properly handled as part of the PATHINFO environment variable...

CVE-2006-0628

myquiz.pl in Dale Ray MyQuiz 1.01 allows remote attackers to execute arbitrary commands via shell metacharacters in the URL, which are not properly handled as part of the PATHINFO environment variable...

Mandrake Linux Security Advisory : openssh (MDKSA-2006:034)

A flaw was discovered in the scp local-to-local copy implementation where filenames that contain shell metacharacters or spaces are expanded twice, which could lead to the execution of arbitrary commands if a local user could be tricked into a scp'ing a specially crafted filename. The provided...

Command injection

scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice...

DEBIAN-CVE-2006-0225

scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice...

CVE-2006-0225

scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice...

Arbitrary Code Execution

Overview Affected versions of this package are vulnerable to Arbitrary Code Execution scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice. Remediation There is no fixed version for openssh...

Ubuntu 4.10 / 5.04 : bzip2 vulnerability (USN-161-1)

USN-158-1 fixed a command injection vulnerability in the 'zgrep' utility. It was determined that the 'bzgrep' counterpart in the bzip2 package is vulnerable to the same flaw. bzgrep did not handle shell metacharacters like '|' and '&' properly when they occurred in input file names. This could be...

Ubuntu 4.10 / 5.04 : gzip vulnerability (USN-158-1)

zgrep did not handle shell metacharacters like '|' and '&' properly when they occurred in input file names. This could be exploited to execute arbitrary commands with user privileges if zgrep is run in an untrusted directory with specially crafted file names. Note that Tenable Network Security ha...

CVE-2005-4601

CVE-2005-4601 affects ImageMagick and was addressed by a Red Hat security advisory RHSA-2006:0178. The vulnerability arises from delegate code in ImageMagick 6.2.4.5-0.3 that allows remote attackers to execute arbitrary commands via shell metacharacters in a filename processed by the display comm...

CVE-2005-4601

The delegate code in ImageMagick 6.2.4.5-0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename that is processed by the display command...

CVE-2005-4601

The delegate code in ImageMagick 6.2.4.5-0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename that is processed by the display command...

CVE-2005-1924

The G/PGP GPG Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to execute arbitrary commands via shell metacharacters in 1 the fpr parameter to the deleteKey function in gpgkeyring.php, as called by a importkeyfile.php, b importkeytext.php, and c keyringmain.php; and 2 the...