Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,929 results · page 35 of 39
May 2, 2005text.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.CVE-2005-1358 · Other software · Text.cgi · reported by MITREHigh 7.5
text.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
- Product
- Text.cgi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005OpenText FirstClass 8.0 client does not properly sanitize strings before passing them to the Windows ShellExecute API, which allows remote attackers to execute CVE-2005-1045 · Other software · Centrinity · reported by MITREHigh 7.5
OpenText FirstClass 8.0 client does not properly sanitize strings before passing them to the Windows ShellExecute API, which allows remote attackers to execute arbitrary commands via a UNC path in a bookmark.
- Product
- Centrinity Firstclass Desktop Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005index.cgi in E-Cart 2004 1.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) art and possibly (2) cat paraCVE-2005-1289 · Other software · E-cart · reported by MITREHigh 7.5
index.cgi in E-Cart 2004 1.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) art and possibly (2) cat parameters.
- Product
- E-cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005The forum.pl script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.CVE-2005-1354 · Other software · Forum.pl · reported by MITREHigh 7.5
The forum.pl script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
- Product
- Forum.pl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005The ad.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.CVE-2005-1351 · Other software · Leif M. Wright · reported by MITREHigh 7.5
The ad.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
- Product
- Ad.cgi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2005include.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.CVE-2005-1296 · Other software · Include.cgi · reported by MITREHigh 7.5
include.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
- Product
- Include.cgi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2005The inserter.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.CVE-2005-1299 · Other software · reported by MITREHigh 10
The inserter.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2005fish.c in midnight commander allows remote attackers to execute arbitrary programs via "insecure filename quoting," possibly using shell metacharacters.CVE-2004-1175 · Other software · Midnight Commander · reported by MITREHigh 7.5
fish.c in midnight commander allows remote attackers to execute arbitrary programs via "insecure filename quoting," possibly using shell metacharacters.
- Product
- Midnight Commander
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
Apr 14, 2005Certain Perl scripts in Konversation 0.15 allow remote attackers to execute arbitrary commands via shell metacharacters in (1) channel names or (2) song names tCVE-2005-0130 · Other software · Berlios · reported by MITREHigh 7.5
Certain Perl scripts in Konversation 0.15 allow remote attackers to execute arbitrary commands via shell metacharacters in (1) channel names or (2) song names that are not properly quoted when the user runs IRC scripts.
- Product
- Konversation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.grok.org.ukmarc.info
Mar 7, 2005includer.cgi in The Includer allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the URL or (2) the template parameter.CVE-2005-0689 · Other software · Jimmy · reported by MITREHigh 7.5
includer.cgi in The Includer allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the URL or (2) the template parameter.
- Product
- The Includer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2005xloadimage before 4.1-r2, and xli before 1.17, allows attackers to execute arbitrary commands via shell metacharacters in filenames for compressed images, whichCVE-2005-0638 · Other software · XLI · reported by MITREHigh 7.5
xloadimage before 4.1-r2, and xli before 1.17, allows attackers to execute arbitrary commands via shell metacharacters in filenames for compressed images, which are not properly quoted when calling the gunzip command.
- Product
- XLI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.gentoo.orgsecunia.com
Mar 1, 2005The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search string.CVE-2004-1037 · Other software · Twiki · reported by MITREHigh 10
The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search string.
- Product
- Twiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comdistro.conectiva.com.br
Feb 9, 2005awstats.pl in AWStats 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) "pluginmode", (2) "loadplugin", or (3) "noloCVE-2005-0362 · Other software · Awstats · reported by security@debian.orgMedium 4.6
awstats.pl in AWStats 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) "pluginmode", (2) "loadplugin", or (3) "noloadplugin" parameters.
- Product
- Awstats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgosvdb.org
Jan 21, 2005The EPSF pipe support in enscript 1.6.3 allows remote attackers or local users to execute arbitrary commands via shell metacharacters.CVE-2004-1184 · Other software · GNU · reported by MITREMedium 4.6
The EPSF pipe support in enscript 1.6.3 allows remote attackers or local users to execute arbitrary commands via shell metacharacters.
- Product
- Enscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comsecunia.com
Jan 18, 2005AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtatsCVE-2005-0116 · Other software · Awstats · reported by MITREHigh 7.5
AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtats.pl.
- Product
- Awstats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordawstats.sourceforge.netpacketstormsecurity.org
Jan 10, 2005phpMyAdmin 2.6.0-pl2, and other versions before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary commands via shell meCVE-2004-1147 · Websites & servers · Phpmyadmin · reported by MITREHigh 10
phpMyAdmin 2.6.0-pl2, and other versions before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary commands via shell metacharacters.
- Product
- Phpmyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2005weblibs.pl in WebLibs 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the TextFile parameter.CVE-2004-1222 · Other software · Darryl Burgdorf · reported by MITREHigh 10
weblibs.pl in WebLibs 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the TextFile parameter.
- Product
- Weblibs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Jan 10, 2005The DownloadLoop function in main.c for greed 0.81p allows remote attackers to execute arbitrary code via a GRX file containing a filename with shell metacharacCVE-2004-1274 · Other software · Greed · reported by MITREHigh 10
The DownloadLoop function in main.c for greed 0.81p allows remote attackers to execute arbitrary code via a GRX file containing a filename with shell metacharacters.
- Product
- Greed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtigger.uic.eduexchange.xforce.ibmcloud.com
Jan 10, 2005The gui_popup_view_fly function in gui_tview_popup.c for junkie 0.3.1 allows remote malicious FTP servers to execute arbitrary commands via shell metacharactersCVE-2004-1280 · Other software · Junkie · reported by MITREHigh 10
The gui_popup_view_fly function in gui_tview_popup.c for junkie 0.3.1 allows remote malicious FTP servers to execute arbitrary commands via shell metacharacters in a filename.
- Product
- Junkie FTP Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtigger.uic.eduexchange.xforce.ibmcloud.com
Jan 10, 2005a2ps 4.13 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename.CVE-2004-1170 · Other software · GNU · reported by MITREHigh 10
a2ps 4.13 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename.
- Product
- A2ps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.combugs.debian.org
Dec 31, 2004athenareg.php in Athena Web Registration allows remote attackers to execute arbitrary commands via shell metacharacters in the pass parameter.CVE-2004-1782 · Other software · David Maciejak · reported by MITREHigh 7.5
athenareg.php in Athena Web Registration allows remote attackers to execute arbitrary commands via shell metacharacters in the pass parameter.
- Product
- Athena Web Registration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgsecurityfocus.com
Dec 31, 2004mntd_mount.c in mntd before 0.4.2 might allow local users to gain privileges via shell metacharacters in a remount option in the configuration file.CVE-2004-2610 · Other software · Stefan Bambach · reported by MITREMedium 4.6
mntd_mount.c in mntd before 0.4.2 might allow local users to gain privileges via shell metacharacters in a remount option in the configuration file. NOTE: It is not clear whether this is a vulnerability because there is not necessarily any common usage in which privilege boundaries are crossed. Typical usage would restrict write access to the configuration file.
- Product
- Mntd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprdownloads.sourceforge.netsecuritytracker.com
Dec 31, 2004The Buddy icon file for AOL Instant Messenger (AIM) 4.3 through 5.5 is created in a predictable location, which may allow remote attackers to use a shell: URI tCVE-2004-2373 · Other software · AOL · reported by MITREHigh 7.5
The Buddy icon file for AOL Instant Messenger (AIM) 4.3 through 5.5 is created in a predictable location, which may allow remote attackers to use a shell: URI to exploit other vulnerabilities that involve predictable locations.
- Product
- Instant Messenger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Dec 31, 2004Microsoft Internet Explorer 6.0.2600 on Windows XP allows remote attackers to cause a denial of service (browser crash) via a shell: URI with double backslashesCVE-2004-2307 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5
Microsoft Internet Explorer 6.0.2600 on Windows XP allows remote attackers to cause a denial of service (browser crash) via a shell: URI with double backslashes (\\) in an HTML tag such as IFRAME or A.
- Product
- Internet Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Dec 31, 2004Microsoft Windows Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code via an embedded script that uses Shell Helper objects and a shCVE-2004-2291 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
Microsoft Windows Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code via an embedded script that uses Shell Helper objects and a shortcut (link) to execute the target script.
- Product
- IE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Dec 31, 2004Microsoft Windows XP Explorer allows local users to execute arbitrary code via a system folder with a Desktop.ini file containing a .ShellClassInfo specifier wiCVE-2004-2289 · Computers, phones & browsers · Microsoft · reported by MITREHigh 10
Microsoft Windows XP Explorer allows local users to execute arbitrary code via a system folder with a Desktop.ini file containing a .ShellClassInfo specifier with a CLSID value that is associated with an executable file.
- Product
- Windows XP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecunia.com
Dec 31, 2004The read_list_from_file function in vacation.pl for OpenWebmail before 2.32 20040629 allows remote attackers to execute arbitrary commands via shell metacharactCVE-2004-2284 · Other software · Open Webmail · reported by MITREHigh 10
The read_list_from_file function in vacation.pl for OpenWebmail before 2.32 20040629 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename argument.
- Product
- Open Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwebmail.orgsecunia.com
Dec 31, 2004i-mall.cgi in I-Mall Commerce allows remote attackers to execute arbitrary commands via shell metacharacters via the p parameter.CVE-2004-2275 · Other software · I-mall Commerce · reported by MITREHigh 10
i-mall.cgi in I-Mall Commerce allows remote attackers to execute arbitrary commands via shell metacharacters via the p parameter.
- Product
- I-mall.cgi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2004Unknown vulnerability in WeHelpBUS 0.1 allows remote attackers to execute arbitrary shell commands via the query string.CVE-2004-2183 · Other software · Wehelpbus · reported by MITREHigh 7.5
Unknown vulnerability in WeHelpBUS 0.1 allows remote attackers to execute arbitrary shell commands via the query string.
- Product
- Wehelpbus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netsecurityfocus.com
Dec 31, 2004display.cgi in Aborior Encore WebForum allows remote to execute arbitrary commands via shell metacharacters in the file variable.CVE-2004-1888 · Other software · Aborior · reported by MITREHigh 7.5
display.cgi in Aborior Encore WebForum allows remote to execute arbitrary commands via shell metacharacters in the file variable.
- Product
- Encore Web Forum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2004The web mail functionality in Usermin 1.x and Webmin 1.x allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail message.CVE-2004-1468 · Other software · Usermin · reported by MITREHigh 7.5
The web mail functionality in Usermin 1.x and Webmin 1.x allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail message.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2004filediff in CVStrac allows remote attackers to execute arbitrary commands via shell metacharacters in rcsinfo.CVE-2004-1456 · Other software · Cvstrac · reported by MITREHigh 7.5
filediff in CVStrac allows remote attackers to execute arbitrary commands via shell metacharacters in rcsinfo.
- Product
- Cvstrac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2004phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via (1) unexpected characters in the session ID such as shell metacharCVE-2004-1385 · Websites & servers · Phpgroupware · reported by MITREMedium 5
phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via (1) unexpected characters in the session ID such as shell metacharacters, (2) an invalid appname parameter to preferences.php or (3) an invalid menuaction parameter to index.php, which reveals the web server path in an error message.
- Product
- Phpgroupware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2004compose.cgi in Mailreader.com 2.3.30 and 2.3.31, when using Sendmail as the Mail Transfer Agent, allows remote attackers to execute arbitrary commands via shellCVE-2002-1582 · Other software · Mailreader.com · reported by MITREHigh 10
compose.cgi in Mailreader.com 2.3.30 and 2.3.31, when using Sendmail as the Mail Transfer Agent, allows remote attackers to execute arbitrary commands via shell metacharacters in the RealEmail configuration variable, which is used to call Sendmail in network.cgi.
- Product
- Mailreader.com
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2004Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename CVE-2004-0572 · Computers, phones & browsers · Microsoft · reported by MITREHigh 10
Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe.
- Product
- Grpconv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comkb.cert.org
Oct 20, 2004The smiley theme functionality in Gaim before 0.82 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of the tar filCVE-2004-0784 · Other software · ROB Flynn · reported by MITREHigh 7.5
The smiley theme functionality in Gaim before 0.82 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of the tar file that is dragged to the smiley selector.
- Product
- Gaim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgaim.sourceforge.netfedoranews.org
Sep 28, 2004LHA 1.14 and earlier allows attackers to execute arbitrary commands via a directory with shell metacharacters in its name.CVE-2004-0745 · Other software · Tsugio Okamoto · reported by MITREHigh 10
LHA 1.14 and earlier allows attackers to execute arbitrary commands via a directory with shell metacharacters in its name.
- Product
- LHA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2004PHP before 4.3.7 on Win32 platforms does not properly filter all shell metacharacters, which allows local or remote attackers to execute arbitrary code, overwriCVE-2004-0542 · Websites & servers · PHP · reported by MITREHigh 10
PHP before 4.3.7 on Win32 platforms does not properly filter all shell metacharacters, which allows local or remote attackers to execute arbitrary code, overwrite files, and access internal environment variables via (1) the "%", "|", or ">" characters to the escapeshellcmd function, or (2) the "%" character to the escapeshellarg function.
- Product
- PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2004page.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the url parameter.CVE-2004-1710 · Other software · Andrew Kilpatrick · reported by MITREHigh 7.5
page.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the url parameter.
- Product
- Page CGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2004Web_Store.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter.CVE-2004-0734 · Other software · Extropia · reported by MITREHigh 7.5
Web_Store.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter.
- Product
- Extropia Webstore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Jul 27, 2004The ShellExample.cgi script in 4D WebSTAR 5.3.2 and earlier allows remote attackers to list arbitrary directories via a URL with the desired path and a "*" (astCVE-2004-0696 · Other software · 4d · reported by MITREMedium 5
The ShellExample.cgi script in 4D WebSTAR 5.3.2 and earlier allows remote attackers to list arbitrary directories via a URL with the desired path and a "*" (asterisk) character.
- Product
- Webstar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2004The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arCVE-2004-0420 · Computers, phones & browsers · Microsoft · reported by MITREHigh 10
The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.
- Product
- IE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comkb.cert.org
May 4, 2004The patch to the checklogin function in omail.pl for omail webmail 0.98.5 is incomplete, which allows remote attackers to execute arbitrary commands via shell mCVE-2004-1993 · Other software · Omail · reported by MITREHigh 10
The patch to the checklogin function in omail.pl for omail webmail 0.98.5 is incomplete, which allows remote attackers to execute arbitrary commands via shell metacharacters such as "`" (backticks) in the password.
- Product
- Omail Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2004The Secure Shell (SSH) Daemon (SSHD) in Sun Solaris 9 does not properly log IP addresses when SSHD is configured with the ListenAddress as 0.0.0.0, which makes CVE-2004-1357 · Other software · SUN · reported by MITREMedium 5
The Secure Shell (SSH) Daemon (SSHD) in Sun Solaris 9 does not properly log IP addresses when SSHD is configured with the ListenAddress as 0.0.0.0, which makes it easier for remote attackers to hide the source of their activities.
- Product
- Solaris
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsunsolve.sun.com
Mar 30, 2004The "%f" feature in the VirusEvent directive in Clam AntiVirus daemon (clamd) before 0.70 allows local users to execute arbitrary commands via shell metacharactCVE-2004-1876 · Other software · Clam Anti-virus · reported by MITREMedium 4.6
The "%f" feature in the VirusEvent directive in Clam AntiVirus daemon (clamd) before 0.70 allows local users to execute arbitrary commands via shell metacharacters in a file name.
- Product
- Clamav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2004The login page for cPanel 9.1.0, and possibly other versions, allows remote attackers to execute arbitrary code via shell metacharacters in the user parameter.CVE-2004-1770 · Websites & servers · Cpanel · reported by MITREHigh 10
The login page for cPanel 9.1.0, and possibly other versions, allows remote attackers to execute arbitrary code via shell metacharacters in the user parameter.
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2004The mksmbpasswd shell script (mksmbpasswd.sh) in Samba 3.0.0 and 3.0.1, when creating an account but marking it as disabled, may overwrite the user password witCVE-2004-0082 · Other software · Samba · reported by MITREHigh 7.5
The mksmbpasswd shell script (mksmbpasswd.sh) in Samba 3.0.0 and 3.0.1, when creating an account but marking it as disabled, may overwrite the user password with an uninitialized buffer, which could enable the account with a more easily guessable password.
- Product
- Samba
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2004Confirm 0.62 and earlier could allow remote attackers to execute arbitrary code via an e-mail header that contains shell metacharacters such as ", `, |, ;, or $CVE-2004-0324 · Other software · Confirm · reported by MITREHigh 7.5
Confirm 0.62 and earlier could allow remote attackers to execute arbitrary code via an e-mail header that contains shell metacharacters such as ", `, |, ;, or $.
- Product
- Confirm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Jan 20, 2004The parseAddress code in (1) SquirrelMail 1.4.0 and (2) GPG Plugin 1.1 allows remote attackers to execute commands via shell metacharacters in the "To:" field.CVE-2003-0990 · Other software · reported by MITREHigh 7.5
The parseAddress code in (1) SquirrelMail 1.4.0 and (2) GPG Plugin 1.1 allows remote attackers to execute commands via shell metacharacters in the "To:" field.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2003H-Sphere WebShell 2.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) mode and (2) zipfile parameters in a URL requestCVE-2003-1248 · Other software · Positive Software · reported by MITREHigh 7.5
H-Sphere WebShell 2.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) mode and (2) zipfile parameters in a URL request.
- Product
- H-sphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.