GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
- FilipStudeny/-CVE-2014-6271-Shellshock-Remote-Command-Injection-
- 0bfxgh0st/cve-2014-6271
- sidd3009/PenTesting
- Gurguii/cgi-bin-shellshock
- anujbhan/shellshock-victim-host
- trhacknon/exploit-CVE-2014-6271
- trhacknon/CVE-2014-6271
- 0xkasra/CVE-2014-6271
- akr3ch/CVE-2014-6271
- b4keSn4ke/CVE-2014-6271
- abandonedship/ShellShock
- mochizuki875/CVE-2014-6271-Apache-Debian
- indiandragon/Shellshock-Vulnerability-Scan
- JohnRyk/ICMPShock3
- capture0x/XSHOCK
- cved-sources/cve-2014-6271
- MuirlandOracle/CVE-2014-6271-IPFire
- cyberharsh/Shellbash-CVE-2014-6271
- Dilith006/CVE-2014-6271
- rashmikadileeshara/CVE-2014-6271-Shellshock-
- somhm-solutions/Shell-Shock
- Sindayifu/CVE-2019-14287-CVE-2014-6271
- Any3ite/CVE-2014-6271
- wenyu1999/bash-shellshock
- Sindadziy/cve-2014-6271
- hmlio/vaas-cve-2014-6271
- shawntns/exploit-CVE-2014-6271
- r4z0r5/SwissArmyShellshocker
- Aruthw/CVE-2014-6271
- w4fz5uck5/ShockZaum-CVE-2014-6271
- kowshik-sundararajan/CVE-2014-6271
The IP Security feature in Microsoft Internet Information Services (IIS) 8.0 and 8.5 does not properly process wildcard allow and deny rules for domains within the "IP Address and Domain Restrictions" list, which makes it easier for remote attackers to bypass an intended rule set via an HTTP request, aka "IIS Security Feature Bypass Vulnerability."
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
