Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

CVEs (7,137)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2008-7125 1Ariadne Cms 1Ariadne Cms Apr 23, 2026 Aug 31, 2009 N/A· v4 N/A· v3 9.0 HIGH· v2 pphoto in Ariadne before 2.6 allows remote authenticated users with certain privileges to execute arbitrary shell commands via vectors related to PINP programs and the annotate command. NOTE: some of these details are o...Show more pphoto in Ariadne before 2.6 allows remote authenticated users with certain privileges to execute arbitrary shell commands via vectors related to PINP programs and the annotate command. NOTE: some of these details are obtained from third party information.Show less
CVE-2009-2288 1Nagios 1Nagios Apr 23, 2026 Jul 1, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters.
CVE-2009-2011 1Dxstudio 1Dx Studio Player Apr 23, 2026 Jun 16, 2009 N/A· v4 N/A· v3 9.3 HIGH· v2 Worldweaver DX Studio Player 3.0.29.0, 3.0.22.0, 3.0.12.0, and probably other versions before 3.0.29.1, when used as a plug-in for Firefox, does not restrict access to the shell.execute JavaScript API method, which allow...Show more Worldweaver DX Studio Player 3.0.29.0, 3.0.22.0, 3.0.12.0, and probably other versions before 3.0.29.1, when used as a plug-in for Firefox, does not restrict access to the shell.execute JavaScript API method, which allows remote attackers to execute arbitrary commands via a .dxstudio file that invokes this method.Show less
CVE-2008-2475 1Ebay 1Enhanced Picture Uploader Activex Control Apr 23, 2026 Jun 9, 2009 N/A· v4 N/A· v3 9.3 HIGH· v2 eBay Enhanced Picture Uploader ActiveX control (EPUWALcontrol.dll) before 1.0.27 allows remote attackers to execute arbitrary commands via the PictureUrls property.
CVE-2009-1916 1Gscripts 1Dns Tools Apr 23, 2026 Jun 4, 2009 N/A· v4 N/A· v3 10.0 HIGH· v2 dig.php in GScripts.net DNS Tools allows remote attackers to execute arbitrary commands via shell metacharacters in the ns parameter.
CVE-2009-1792 1Stonetrip 2S3dplayer Standalone S3dplayer Web Apr 23, 2026 May 29, 2009 N/A· v4 N/A· v3 9.3 HIGH· v2 The system.openURL function in StoneTrip Ston3D StandalonePlayer (aka S3DPlayer StandAlone) 1.6.2.4 and 1.7.0.1 and WebPlayer (aka S3DPlayer Web) 1.6.0.0 allows remote attackers to execute arbitrary commands via shell me...Show more The system.openURL function in StoneTrip Ston3D StandalonePlayer (aka S3DPlayer StandAlone) 1.6.2.4 and 1.7.0.1 and WebPlayer (aka S3DPlayer Web) 1.6.0.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the first argument (the sURL argument).Show less
CVE-2008-6669 1Dirk Bartley 1Nweb2fax Apr 23, 2026 Apr 8, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 viewrq.php in nweb2fax 0.2.7 and earlier allows remote attackers to execute arbitrary code via shell metacharacters in the var_filename parameter in a (1) tif or (2) pdf format action.
CVE-2008-6554 1Aztech 1Adsl2/2+4 Port Router Apr 23, 2026 Mar 30, 2009 N/A· v4 N/A· v3 10.0 HIGH· v2 cgi-bin/script in Aztech ADSL2/2+ 4-port router 3.7.0 build 070426 allows remote attackers to execute arbitrary commands via shell metacharacters in the query string.
CVE-2009-0854 1Dash 1Dash Apr 23, 2026 Mar 11, 2009 N/A· v4 N/A· v3 6.9 MEDIUM· v2 Untrusted search path vulnerability in dash 0.5.4, when used as a login shell, allows local users to execute arbitrary code via a Trojan horse .profile file in the current working directory.
CVE-2009-0848 1Opensuse 1Opensuse Apr 23, 2026 Mar 11, 2009 N/A· v4 N/A· v3 4.4 MEDIUM· v2 Untrusted search path vulnerability in GTK2 in OpenSUSE 11.0 and 11.1 allows local users to execute arbitrary code via a Trojan horse GTK module in an unspecified "relative search path."
CVE-2008-6235 1Vim 1Vim Apr 23, 2026 Feb 21, 2009 N/A· v4 N/A· v3 9.3 HIGH· v2 The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrw_curdir variable, as...Show more The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrw_curdir variable, as demonstrated using the netrw.v4 and netrw.v5 test cases.Show less
CVE-2008-3076 1Vim 1Vim Apr 23, 2026 Feb 21, 2009 N/A· v4 N/A· v3 9.3 HIGH· v2 The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc comman...Show more The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.Show less
CVE-2008-3074 1Vim 2Tar.vim Vim Apr 23, 2026 Feb 21, 2009 N/A· v4 N/A· v3 9.3 HIGH· v2 The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a tar archive and po...Show more The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a tar archive and possibly (2) the filename of the first file in a tar archive, which is not properly handled by the VIM TAR plugin (tar.vim) v.10 through v.22, as demonstrated by the shellescape, tarplugin.v2, tarplugin, and tarplugin.updated test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3075. NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.Show less
CVE-2008-5516 2Git Git Scm 2Git Git Apr 23, 2026 Jan 20, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 The web interface in git (gitweb) 1.5.x before 1.5.5 allows remote attackers to execute arbitrary commands via shell metacharacters related to git_search.
CVE-2008-5718 1Netatalk 1Netatalk Apr 23, 2026 Dec 26, 2008 N/A· v4 N/A· v3 9.3 HIGH· v2 The papd daemon in Netatalk before 2.0.4-beta2, when using certain variables in a pipe command for the print file, allows remote attackers to execute arbitrary commands via shell metacharacters in a print request, as dem...Show more The papd daemon in Netatalk before 2.0.4-beta2, when using certain variables in a pipe command for the print file, allows remote attackers to execute arbitrary commands via shell metacharacters in a print request, as demonstrated using a crafted Title.Show less
CVE-2008-4304 1Phpcollab 1Phpcollab Apr 23, 2026 Dec 23, 2008 N/A· v4 N/A· v3 10.0 HIGH· v2 general/login.php in phpCollab 2.5 rc3 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified input related to the SSL_CLIENT_CERT environment variable. NOTE: in some en...Show more general/login.php in phpCollab 2.5 rc3 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified input related to the SSL_CLIENT_CERT environment variable. NOTE: in some environments, SSL_CLIENT_CERT always has a base64-encoded string value, which may impose constraints on injection for typical shells.Show less
CVE-2008-4636 1Suse 1Yast2 Backup Apr 23, 2026 Nov 27, 2008 N/A· v4 N/A· v3 7.2 HIGH· v2 yast2-backup 2.14.2 through 2.16.6 on SUSE Linux and Novell Linux allows local users to gain privileges via shell metacharacters in filenames used by the backup process.
CVE-2008-4796 4Debian NagiosSnoopy Project+1 more 4Debian Linux NagiosSnoopy+1 more Apr 23, 2026 Oct 30, 2008 N/A· v4 N/A· v3 10.0 HIGH· v2 The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost, and possibly other products, allows remot...Show more The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost, and possibly other products, allows remote attackers to execute arbitrary commands via shell metacharacters in https URLs.Show less
CVE-2008-2575 2Fedoraproject Jcoppens 2Cbrpager Fedora Apr 23, 2026 Jun 6, 2008 N/A· v4 N/A· v3 6.8 MEDIUM· v2 cbrPager before 0.9.17 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a (1) ZIP (aka .cbz) or (2) RAR (aka .cbr) archive filename.
CVE-2008-1115 1Sun 1Solaris Apr 23, 2026 Mar 3, 2008 N/A· v4 N/A· v3 4.9 MEDIUM· v2 Unspecified vulnerability in Sun Solaris 8 directory functions allows local users to cause a denial of service (panic) via an unspecified sequence of system calls or commands.

Previous 1...353 354 355356357 Next