CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-78

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2013-1947 78 Exec Code 2013-04-25 2013-05-01
9.3
 None Remote Medium Not required Complete Complete Complete
kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) document.rb, (2) video.rb, or (3) video_image.rb.
2 CVE-2013-1933 78 Exec Code 2013-04-25 2013-05-01
9.3
 None Remote Medium Not required Complete Complete Complete
The extract_from_ocr function in lib/docsplit/text_extractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename.
3 CVE-2013-0928 78 Exec Code 2013-01-21 2013-01-22
9.3
 None Remote Medium Not required Complete Complete Complete
The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrary commands via a DCP "run command" operation.
4 CVE-2013-0804 78 DoS Exec Code 2013-02-23 2013-02-25
10.0
 None Remote Low Not required Complete Complete Complete
The client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference) via unspecified vectors.
5 CVE-2012-4361 78 2 Exec Code 2012-08-20 2012-08-21
7.7
 None Local Network Low Single system Complete Complete Complete
lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the second parameter.
6 CVE-2012-4177 78 1 Exec Code 2012-08-07 2013-04-01
10.0
 None Remote Low Not required Complete Complete Complete
The web browser plugin for Ubisoft Uplay PC before 2.0.4 allows remote attackers to execute arbitrary programs via the -orbit_exe_path command line argument.
7 CVE-2012-4011 78 Exec Code +Info 2012-09-08 2012-09-17
9.3
 None Remote Medium Not required Complete Complete Complete
The Cybozu KUNAI application before 2.0.6 for Android allows remote attackers to execute arbitrary Java methods, and obtain sensitive information or execute arbitrary commands, via a crafted web site.
8 CVE-2012-3366 78 Exec Code 2012-07-03 2012-09-13
9.0
 None Remote Low Single system Complete Complete Complete
The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server).
9 CVE-2012-3076 78 Exec Code 2012-07-12 2012-07-12
9.0
 None Remote Low Single system Complete Complete Complete
The administrative web interface on Cisco TelePresence Recording Server before 1.8.0 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Bug ID CSCth85804.
10 CVE-2012-3075 78 Exec Code 2012-07-12 2012-07-12
9.0
 None Remote Low Single system Complete Complete Complete
The administrative web interface on Cisco TelePresence Immersive Endpoint Devices before 1.7.4 allows remote authenticated users to execute arbitrary commands via a malformed request on TCP port 443, aka Bug ID CSCtn99724.
11 CVE-2012-3074 78 Exec Code 2012-07-12 2012-07-16
8.3
 None Local Network Low Not required Complete Complete Complete
An unspecified API on Cisco TelePresence Immersive Endpoint Devices before 1.9.1 allows remote attackers to execute arbitrary commands by leveraging certain adjacency and sending a malformed request on TCP port 61460, aka Bug ID CSCtz38382.
12 CVE-2012-3001 78 Exec Code 2012-10-22 2013-03-01
8.5
 None Remote Medium Single system Complete Complete Complete
Mutiny Standard before 4.5-1.12 allows remote attackers to execute arbitrary commands via the network-interface menu, related to a "command injection vulnerability."
13 CVE-2012-2986 78 Exec Code 2012-08-20 2012-08-21
7.7
 None Local Network Low Single system Complete Complete Complete
lhn/public/network/ping in HP SAN/iQ 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) first, (2) third, or (3) fourth parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4361.
14 CVE-2012-2976 78 Exec Code 2012-07-23 2013-02-02
10.0
 None Remote Low Not required Complete Complete Complete
The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to execute arbitrary shell commands via crafted input to application scripts, related to an "injection" issue.
15 CVE-2012-2953 78 Exec Code 2012-07-23 2013-02-02
10.0
 None Remote Low Not required Complete Complete Complete
The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to execute arbitrary commands via crafted input to application scripts.
16 CVE-2012-2607 78 2012-07-16 2012-07-17
7.5
 None Remote Low Not required Partial Partial Partial
The Johnson Controls CK721-A controller with firmware before SSM4388_03.1.0.14_BB allows remote attackers to perform arbitrary actions via crafted packets to TCP port 41014 (aka the download port).
17 CVE-2012-2516 78 Exec Code 2012-07-04 2012-07-17
9.3
 None Remote Medium Not required Complete Complete Complete
An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA iFIX 5.0 and 5.1; Proficy Pulse 1.0; Proficy Batch Execution 5.6; SI7 I/O Driver 7.20 through 7.42; and other products, allows remote attackers to execute arbitrary commands via crafted input, related to a "command injection vulnerability."
18 CVE-2012-1795 78 Exec Code 2012-03-20 2012-04-13
7.5
 None Remote Low Not required Partial Partial Partial
webglimpse.cgi in Webglimpse before 2.20.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter, as exploited in the wild in March 2012.
19 CVE-2011-4502 78 Exec Code 2011-11-22 2013-01-24
10.0
 None Remote Low Not required Complete Complete Complete
The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to execute arbitrary commands via shell metacharacters.
20 CVE-2011-4002 78 Exec Code 2011-11-29 2011-12-14
7.5
 None Remote Low Not required Partial Partial Partial
HP no Mawashimono Nikki 6.6 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."
21 CVE-2011-2148 78 Exec Code 2011-05-20 2011-09-06
10.0
 None Remote Low Not required Complete Complete Complete
Admin/frmSite.aspx in the SmarterTools SmarterStats 6.0 web server allows remote attackers to execute arbitrary commands via vectors involving a leading and trailing & (ampersand) character, and (1) an STTTState cookie, (2) the ctl00%24MPH%24txtAdminNewPassword_SettingText parameter, (3) the ctl00%24MPH%24txtSmarterLogDirectory parameter, (4) the ctl00%24MPH%24ucSiteSeoSearchEngineSettings%24chklistEngines_SettingCheckBox%2414 parameter, (5) the ctl00%24MPH%24ucSiteSeoSettings%24txtSeoMaxKeywords_SettingText parameter, or (6) the ctl00_MPH_grdLogLocations_HiddenLSR parameter, related to an "OS command injection" issue.
22 CVE-2011-1904 78 Exec Code 2011-05-05 2011-05-31
7.5
 None Remote Low Not required Partial Partial Partial
An unspecified function in the web interface in Proofpoint Messaging Security Gateway 6.2.0.263:6.2.0.237 and earlier in Proofpoint Protection Server 5.5.3, 5.5.4, 5.5.5, 6.0.2, 6.1.1, and 6.2.0 allows remote attackers to execute arbitrary commands via unknown vectors, related to a "command injection" issue.
23 CVE-2011-1513 78 Sql 2011-11-04 2012-03-12
7.5
 None Remote Low Not required Partial Partial Partial
Static code injection vulnerability in install_.php in e107 CMS 0.7.24 and probably earlier versions, when the installation script is not removed, allows remote attackers to inject arbitrary PHP code into e107_config.php via a crafted MySQL server name.
24 CVE-2011-0456 78 Exec Code 2011-03-11 2011-08-26
7.5
 None Remote Low Not required Partial Partial Partial
webscript.pl in Open Ticket Request System (OTRS) 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."
25 CVE-2011-0382 78 Exec Code 2011-02-25 2011-04-08
10.0
 None Remote Low Not required Complete Complete Complete
The CGI subsystem on Cisco TelePresence Recording Server devices with software 1.6.x before 1.6.2 allows remote attackers to execute arbitrary commands via a request to TCP port 443, related to a "command injection vulnerability," aka Bug ID CSCtf97221.
26 CVE-2011-0381 78 Exec Code 2011-02-25 2011-03-30
10.0
 None Remote Low Not required Complete Complete Complete
Cisco TelePresence Manager 1.2.x through 1.6.x allows remote attackers to perform unspecified actions and consequently execute arbitrary code via a crafted request to the Java RMI interface, related to a "command injection vulnerability," aka Bug ID CSCtf97085.
27 CVE-2011-0378 78 Exec Code 2011-02-25 2011-03-30
8.3
 None Local Network Low Not required Complete Complete Complete
The XML-RPC implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote attackers to execute arbitrary commands via a TCP request, related to a "command injection vulnerability," aka Bug ID CSCtb52587.
28 CVE-2011-0375 78 Exec Code 2011-02-25 2011-03-30
9.0
 None Remote Low Single system Complete Complete Complete
The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.6.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCth24671.
29 CVE-2011-0374 78 Exec Code 2011-02-25 2011-03-30
9.0
 None Remote Low Single system Complete Complete Complete
The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCtb31659.
30 CVE-2011-0373 78 Exec Code 2011-02-25 2011-03-30
9.0
 None Remote Low Single system Complete Complete Complete
The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCtb31685.
31 CVE-2011-0372 78 Exec Code 2011-02-25 2011-03-30
10.0
 None Remote Low Not required Complete Complete Complete
The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote attackers to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCtb31640.
32 CVE-2011-0271 78 Exec Code 2011-01-13 2011-01-20
10.0
 None Remote Low Not required Complete Complete Complete
The CGI scripts in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 do not properly validate an unspecified parameter, which allows remote attackers to execute arbitrary commands by using a command string for this parameter's value, related to a "command injection vulnerability."
33 CVE-2010-4278 78 1 Exec Code 2010-12-02 2010-12-10
9.0
 None Remote Low Single system Complete Complete Complete
operation/agentes/networkmap.php in Pandora FMS before 3.1.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the layout parameter in an operation/agentes/networkmap action to index.php.
34 CVE-2010-3757 78 Exec Code 2010-10-05 2010-10-06
10.0
 None Remote Low Not required Complete Complete Complete
Format string vulnerability in the _Eventlog function in FastBackServer.exe in the Server in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 allows remote attackers to execute arbitrary code via format string specifiers located after a | (pipe) character in a string. NOTE: this might overlap CVE-2010-3059.
35 CVE-2010-3754 78 Exec Code 2010-10-05 2010-10-06
10.0
 None Remote Low Not required Complete Complete Complete
The FXCLI_OraBR_Exec_Command function in FastBackServer.exe in the Server in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 uses values of packet fields to determine the content and length of data copied to memory, which allows remote attackers to execute arbitrary code via a crafted packet. NOTE: this might overlap CVE-2010-3059.
36 CVE-2010-3753 78 Exec Code 2010-10-05 2010-12-07
6.5
 None Remote Low Single system Partial Partial Partial
programs/pluto/xauth.c in the client in Openswan 2.6.26 through 2.6.28 allows remote authenticated gateways to execute arbitrary commands via shell metacharacters in the cisco_banner (aka server_banner) field, a different vulnerability than CVE-2010-3308.
37 CVE-2010-3752 78 Exec Code 2010-10-05 2010-12-07
6.5
 None Remote Low Single system Partial Partial Partial
programs/pluto/xauth.c in the client in Openswan 2.6.25 through 2.6.28 allows remote authenticated gateways to execute arbitrary commands via shell metacharacters in (1) cisco_dns_info or (2) cisco_domain_info data in a packet, a different vulnerability than CVE-2010-3302.
38 CVE-2010-3039 78 Exec Code 2010-11-09 2010-11-18
6.8
 None Local Low Single system Complete Complete Complete
/usr/local/cm/bin/pktCap_protectData in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6, 7, and 8 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in a request to the administrative interface, aka Bug IDs CSCti52041 and CSCti74930.
39 CVE-2010-2445 78 Exec Code 2010-07-08 2010-11-06
10.0
 None Remote Low Not required Complete Complete Complete
freeciv 2.2 before 2.2.1 and 2.3 before 2.3.0 allows attackers to read arbitrary files or execute arbitrary commands via a scenario that contains Lua functionality, related to the (1) os, (2) io, (3) package, (4) dofile, (5) loadfile, (6) loadlib, (7) module, and (8) require modules or functions.
40 CVE-2010-1885 78 1 Exec Code Bypass 2010-06-15 2010-09-17
9.3
 None Remote Medium Not required Complete Complete Complete
The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server 2003 does not properly handle malformed escape sequences, which allows remote attackers to bypass the trusted documents whitelist (fromHCP option) and execute arbitrary commands via a crafted hcp:// URL, aka "Help Center URL Validation Vulnerability."
41 CVE-2010-1423 78 Exec Code 2010-04-15 2012-08-13
9.3
 None Remote Medium Not required Complete Complete Complete
Argument injection vulnerability in the URI handler in (a) Java NPAPI plugin and (b) Java Deployment Toolkit in Java 6 Update 10, 19, and other versions, when running on Windows and possibly on Linux, allows remote attackers to execute arbitrary code via the (1) -J or (2) -XXaltjvm argument to javaws.exe, which is processed by the launch method. NOTE: some of these details are obtained from third party information.
42 CVE-2010-1132 78 1 Exec Code 2010-03-27 2011-02-01
9.3
 None Remote Medium Not required Complete Complete Complete
The mlfi_envrcpt function in spamass-milter.cpp in SpamAssassin Milter Plugin 0.3.1, when using the expand option, allows remote attackers to execute arbitrary system commands via shell metacharacters in the RCPT TO field of an email message.
43 CVE-2010-0934 78 Exec Code 2010-03-05 2010-03-08
7.1
 Admin Remote High Single system Complete Complete Complete
The triggers functionality in Perforce Server 2008.1 allows remote authenticated users with super privileges to execute arbitrary operating-system commands by using a "p4 client" command in conjunction with the form-in trigger script.
44 CVE-2010-0418 78 Exec Code 2010-03-10 2010-03-31
10.0
 None Remote Low Not required Complete Complete Complete
The web interface in chumby one before 1.0.4 and chumby classic before 1.7.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a request.
45 CVE-2009-4644 78 Exec Code Bypass 2010-02-19 2010-03-05
9.0
 None Remote Low Single system Complete Complete Complete
Accellion Secure File Transfer Appliance before 8_0_105 allows remote authenticated administrators to bypass the restricted shell and execute arbitrary commands via shell metacharacters to the ping command, as demonstrated by modifying the cli program.
46 CVE-2009-4498 78 Exec Code 2009-12-31 2010-05-25
6.8
 None Remote Medium Not required Partial Partial Partial
The node_process_command function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request.
47 CVE-2009-4025 78 Exec Code 2009-11-29 2009-12-19
10.0
 None Remote Low Not required Complete Complete Complete
Argument injection vulnerability in the traceroute function in Traceroute.php in the Net_Traceroute package before 0.21.2 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter. NOTE: some of these details are obtained from third party information.
48 CVE-2009-3233 78 Exec Code 2009-09-17 2009-09-17
7.2
 None Local Low Not required Complete Complete Complete
changetrack 4.3 allows local users to execute arbitrary commands via CRLF sequences and shell metacharacters in a filename in a directory that is checked by changetrack.
49 CVE-2009-2288 78 Exec Code 2009-07-01 2010-04-03
7.5
 None Remote Low Not required Partial Partial Partial
statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters.
50 CVE-2009-2011 78 1 Exec Code 2009-06-16 2009-06-22
9.3
 None Remote Medium Not required Complete Complete Complete
Worldweaver DX Studio Player 3.0.29.0, 3.0.22.0, 3.0.12.0, and probably other versions before 3.0.29.1, when used as a plug-in for Firefox, does not restrict access to the shell.execute JavaScript API method, which allows remote attackers to execute arbitrary commands via a .dxstudio file that invokes this method.
Total number of vulnerabilities : 75   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.