CVE-2008-1331

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

cgi-data/FastJSData.cgi in OmniPCX Office with Internet Access services OXO210 before 210/091.001, OXO600 before 610/014.001, and other versions, allows remote attackers to execute arbitrary commands and "obtain OXO resources" via shell metacharacters in the id2 parameter.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/29798Third Party Advisory
http://www.securityfocus.com/archive/1/492383/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/28758Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1020082Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2008/1057Permissions Required
http://www1.alcatel-lucent.com/psirt/statements/2008001/OXOrexec.htmVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/41560Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/5662Third Party Advisory, VDB Entry
http://secunia.com/advisories/29798Third Party Advisory
http://www.securityfocus.com/archive/1/492383/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/28758Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1020082Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2008/1057Permissions Required
http://www1.alcatel-lucent.com/psirt/statements/2008001/OXOrexec.htmVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/41560Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/5662Third Party Advisory, VDB Entry

Timeline

Published: Apr 2, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-13328.8Unspecified vulnerability in Asterisk Open Source 1.2.x before 1.2.27, 1.4.x before 1.4.18.1 and 1.4.19-rc3; Business Edition A.x.x, B.x.x b CVE-2008-13335.8Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 might allow remote attackers to execute arbitrary code via logg CVE-2008-13347.5cgi/b on the BT Home Hub router allows remote attackers to bypass authentication, and read or modify administrative settings or make arbitra CVE-2008-13359.3The ipsec4_get_ulp function in the kernel in NetBSD 2.0 through 3.1 and NetBSD-current before 20071028, when the fast_ipsec subsystem is ena CVE-2008-13367.5SQL injection vulnerability in Koobi CMS 4.2.3 through 4.3.0 allows remote attackers to execute arbitrary SQL commands via the categ paramet CVE-2008-13375.0The instant message service in Timbuktu Pro 8.6.5 RC 229 and earlier for Windows allows remote attackers to cause (1) a denial of service (d CVE-2008-13387.8The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allows remote attackers to cause a denial of service (daemon cra CVE-2008-13407.1Virtual Machine Communication Interface (VMCI) in VMware Workstation 6.0.x before 6.0.3, VMware Player 2.0.x before 2.0.3, and VMware ACE 2.CVE-2008-13417.5SQL injection vulnerability in SearchResults.aspx in LaGarde StoreFront 6 before SP8 allows remote attackers to execute arbitrary SQL comman CVE-2008-13424.3Multiple cross-site scripting (XSS) vulnerabilities in the search feature in Polymita BPM-Suite and CollagePortal allow remote attackers to CVE-2008-13434.9Directory traversal vulnerability in (1) pkgadd and (2) pkgrm in SCO UnixWare 7.1.4 allows local users to gain privileges via unknown vector CVE-2008-13447.5Multiple SQL injection vulnerabilities in MyioSoft EasyCalendar 4.0tr and earlier allow remote attackers to execute arbitrary SQL commands v