Filtered by CWE-78
Filtered by vendor Subscriptions
Total 5432 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-36926 1 Zoom 1 Rooms 2025-04-09 8.8 High
Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.
CVE-2022-43971 1 Linksys 2 Wumc710, Wumc710 Firmware 2025-04-09 7.2 High
An arbitrary code exection vulnerability exists in Linksys WUMC710 Wireless-AC Universal Media Connector with firmware <= 1.0.02 (build3). The do_setNTP function within the httpd binary uses unvalidated user input in the construction of a system command. An authenticated attacker with administrator privileges can leverage this vulnerability over the network via a malicious GET or POST request to /setNTP.cgi to execute arbitrary commands on the underlying Linux operating system as root.
CVE-2022-43973 1 Linksys 2 Wrt54gl, Wrt54gl Firmware 2025-04-09 7.2 High
An arbitrary code execution vulnerability exisits in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. The Check_TSSI function within the httpd binary uses unvalidated user input in the construction of a system command. An authenticated attacker with administrator privileges can leverage this vulnerability over the network via a malicious POST request to /apply.cgi to execute arbitrary commands on the underlying Linux operating system as root.
CVE-2024-34205 1 Totolink 2 Cp450, Cp450 Firmware 2025-04-09 7.3 High
TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the download_firmware function.
CVE-2024-34210 1 Totolink 3 Cp450, Cp450 Firmware, Outdoor Cpe Cp450 2025-04-09 7.3 High
TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the CloudACMunualUpdate function via the FileName parameter.
CVE-2022-25890 1 Wifey Project 1 Wifey 2025-04-09 7.4 High
All versions of the package wifey are vulnerable to Command Injection via the connect() function due to improper input sanitization.
CVE-2008-4636 3 Novell, Opensuse, Suse 7 Linux Desktop, Open Enterprise Server, Opensuse and 4 more 2025-04-09 N/A
yast2-backup 2.14.2 through 2.16.6 on SUSE Linux and Novell Linux allows local users to gain privileges via shell metacharacters in filenames used by the backup process.
CVE-2008-6669 1 Dirk Bartley 1 Nweb2fax 2025-04-09 N/A
viewrq.php in nweb2fax 0.2.7 and earlier allows remote attackers to execute arbitrary code via shell metacharacters in the var_filename parameter in a (1) tif or (2) pdf format action.
CVE-2008-5516 3 Git, Git-scm, Rpath 3 Git, Git, Linux 2025-04-09 N/A
The web interface in git (gitweb) 1.5.x before 1.5.5 allows remote attackers to execute arbitrary commands via shell metacharacters related to git_search.
CVE-2009-2011 2 Dxstudio, Mozilla 2 Dx Studio Player, Firefox 2025-04-09 N/A
Worldweaver DX Studio Player 3.0.29.0, 3.0.22.0, 3.0.12.0, and probably other versions before 3.0.29.1, when used as a plug-in for Firefox, does not restrict access to the shell.execute JavaScript API method, which allows remote attackers to execute arbitrary commands via a .dxstudio file that invokes this method.
CVE-2008-0892 1 Redhat 2 Directory Server, Fedora Directory Server 2025-04-09 N/A
The replication monitor CGI script (repl-monitor-cgi.pl) in Red Hat Administration Server, as used by Red Hat Directory Server 8.0 EL4 and EL5, allows remote attackers to execute arbitrary commands.
CVE-2009-1916 1 Gscripts 1 Dns Tools 2025-04-09 N/A
dig.php in GScripts.net DNS Tools allows remote attackers to execute arbitrary commands via shell metacharacters in the ns parameter.
CVE-2009-0854 1 Dash 1 Dash 2025-04-09 N/A
Untrusted search path vulnerability in dash 0.5.4, when used as a login shell, allows local users to execute arbitrary code via a Trojan horse .profile file in the current working directory.
CVE-2009-0848 1 Opensuse 1 Opensuse 2025-04-09 N/A
Untrusted search path vulnerability in GTK2 in OpenSUSE 11.0 and 11.1 allows local users to execute arbitrary code via a Trojan horse GTK module in an unspecified "relative search path."
CVE-2007-5653 1 Php 1 Php 2025-04-09 N/A
The Component Object Model (COM) functions in PHP 5.x on Windows do not follow safe_mode and disable_functions restrictions, which allows context-dependent attackers to bypass intended limitations, as demonstrated by executing objects with the kill bit set in the corresponding ActiveX control Compatibility Flags, executing programs via a function in compatUI.dll, invoking wscript.shell via wscript.exe, invoking Scripting.FileSystemObject via wshom.ocx, and adding users via a function in shgina.dll, related to the com_load_typelib function.
CVE-2007-4560 1 Clam Anti-virus 1 Clamav 2025-04-09 N/A
clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitrary commands via shell metacharacters that are used in a certain popen call, involving the "recipient field of sendmail."
CVE-2007-5322 1 Microsoft 1 Visual Foxpro 2025-04-09 N/A
Insecure method vulnerability in the FPOLE.OCX 6.0.8450.0 ActiveX control in Microsoft Visual FoxPro 6.0 allows remote attackers to execute arbitrary programs by specifying them as an argument to the FoxDoCmd function.
CVE-2009-1381 1 Squirrelmail 3 Imap General.php, Squirrelmail, Squirrelmail1.4.19-1 2025-04-09 N/A
The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.
CVE-2008-6235 2 Redhat, Vim 2 Enterprise Linux, Vim 2025-04-09 N/A
The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrw_curdir variable, as demonstrated using the netrw.v4 and netrw.v5 test cases.
CVE-2008-5718 1 Netatalk 1 Netatalk 2025-04-09 N/A
The papd daemon in Netatalk before 2.0.4-beta2, when using certain variables in a pipe command for the print file, allows remote attackers to execute arbitrary commands via shell metacharacters in a print request, as demonstrated using a crafted Title.