Filtered by CWE-77
Filtered by vendor Subscriptions
Total 2154 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2014-4677 1 Gpgtools 1 Libmacgpg 2024-11-21 N/A
The installPackage function in the installerHelper subcomponent in Libmacgpg in GPG Suite before 2015.06 allows local users to execute arbitrary commands with root privileges via shell metacharacters in the xmlPath argument.
CVE-2014-4336 1 Linuxfoundation 1 Cups-filters 2024-11-21 N/A
The generate_local_queue function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the host name. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.
CVE-2014-3741 1 Node-printer Project 1 Node-printer 2024-11-21 N/A
The printDirect function in lib/printer.js in the node-printer module 0.0.1 and earlier for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in the lpr command.
CVE-2014-3593 2 Redhat, Scientificlinux 2 Enterprise Linux, Luci 2024-11-21 N/A
Eval injection vulnerability in luci 0.26.0 allows remote authenticated users with certain permissions to execute arbitrary Python code via a crafted cluster configuration.
CVE-2014-3556 1 F5 1 Nginx 2024-11-21 N/A
The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and 1.7.x before 1.7.4 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
CVE-2014-3524 2 Apache, Libreoffice 2 Openoffice, Libreoffice 2024-11-21 N/A
Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafted Calc spreadsheet.
CVE-2014-3114 1 Ezpz-one-click-backup Project 1 Ezpz-one-click-backup 2024-11-21 N/A
The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to execute arbitrary commands via the cmd parameter to functions/ezpz-archive-cmd.php.
CVE-2014-1905 1 Videowhisper 1 Videowhisper Live Streaming Integration 2024-11-21 N/A
Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, and then accessing the file via a direct request to a wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/ pathname, as demonstrated by a .php.jpg filename.
CVE-2014-1834 1 Echor Project 1 Echor 2024-11-21 N/A
The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to inject arbitrary code by adding a semi-colon in their username or password.
CVE-2014-1203 1 Eyou 1 Eyou 2024-11-21 9.8 Critical
The get_login_ip_config_file function in Eyou Mail System before 3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to admin/domain/ip_login_set/d_ip_login_get.php.
CVE-2014-10075 1 Karo Project 1 Karo 2024-11-21 N/A
The karo gem 2.3.8 for Ruby allows Remote command injection via the host field.
CVE-2013-7471 1 Dlink 10 Dir-300, Dir-300 Firmware, Dir-600 and 7 more 2024-11-21 9.8 Critical
An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, DIR-300 rev. B, and DIR-865 devices. There is Command Injection via shell metacharacters in the NewInternalClient, NewExternalPort, or NewInternalPort element of a SOAP POST request.
CVE-2013-7418 1 Ipcop 1 Ipcop 2024-11-21 N/A
cgi-bin/iptablesgui.cgi in IPCop (aka IPCop Firewall) before 2.1.5 allows remote authenticated users to execute arbitrary code via shell metacharacters in the TABLE parameter. NOTE: this can be exploited remotely by leveraging a separate cross-site scripting (XSS) vulnerability.
CVE-2013-7416 1 Canto 1 Canto Curses 2024-11-21 N/A
canto_curses/guibase.py in Canto Curses before 0.9.0 allows remote feed servers to execute arbitrary commands via shell metacharacters in a URL in a feed.
CVE-2013-7377 1 Codem-transcode Project 1 Codem-transcode 2024-11-21 N/A
The codem-transcode module before 0.5.0 for Node.js, when ffprobe is enabled, allows remote attackers to execute arbitrary commands via a POST request to /probe.
CVE-2013-6924 1 Seagate 2 Blackarmor Nas 220, Blackarmor Nas 220 Firmware 2024-11-21 N/A
Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to execute arbitrary commands via shell metacharacters in the ip parameter to backupmgt/getAlias.php.
CVE-2013-4663 1 Redmine 1 Redmine Git Hosting Plugin 2024-11-21 N/A
git_http_controller.rb in the redmine_git_hosting plugin for Redmine allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the service parameter to info/refs, related to the get_info_refs function or (2) the reqfile argument to the file_exists function.
CVE-2013-2810 1 Emerson 6 Dl 8000 Remote Terminal Unit, Dl 8000 Remote Terminal Unit Firmware, Roc 800 Remote Terminal Unit and 3 more 2024-11-21 N/A
Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier allows remote attackers to execute arbitrary commands via a TCP replay attack.
CVE-2013-2516 1 Fileutils Project 1 Fileutils 2024-11-21 N/A
Vulnerability in FileUtils v0.7, Ruby Gem Fileutils <= v0.7 Command Injection vulnerability in user supplied url variable that is passed to the shell.
CVE-2013-2513 1 Milboj 1 Flash Tool 2024-11-21 9.8 Critical
The flash_tool gem through 0.6.0 for Ruby allows command execution via shell metacharacters in the name of a downloaded file.