CWE-77 · Command Injection (page 18)
Page 18 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10435 | Medium | 6.3 | 2024-10-28 | A vulnerability was found in didi Super-Jacoco 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /cov/triggerEnvCov. T… |
CVE-2024-10429 | High | 7.2 | 2024-10-27 | A vulnerability classified as critical has been found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. Affected is the function set_ipv6 of the file i… |
CVE-2024-10428 | High | 7.2 | 2024-10-27 | A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. It has been rated as critical. This issue affects the function set_ipv6 of… |
CVE-2024-48145 | Critical | 9.1 | 2024-10-24 | A prompt injection vulnerability in the chatbox of Netangular Technologies ChatNet AI Version v1.0 allows attackers to access and exfiltrate all previous and s… |
CVE-2024-48144 | Critical | 9.1 | 2024-10-24 | A prompt injection vulnerability in the chatbox of Fusion Chat Chat AI Assistant Ask Me Anything v1.2.4.0 allows attackers to access and exfiltrate all previou… |
CVE-2024-48142 | High | 7.5 | 2024-10-24 | A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica ChatGPT AI Assistant v2.4.0 allows attackers to access and exfiltrate all pr… |
CVE-2024-48141 | High | 7.5 | 2024-10-24 | A prompt injection vulnerability in the chatbox of Zhipu AI CodeGeeX v2.17.0 allows attackers to access and exfiltrate all previous and subsequent chat data be… |
CVE-2024-48140 | High | 7.5 | 2024-10-24 | A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica Your AI Copilot powered by ChatGPT4 v6.3.0 allows attackers to access and ex… |
CVE-2024-48139 | High | 7.5 | 2024-10-24 | A prompt injection vulnerability in the chatbox of Blackbox AI v1.3.95 allows attackers to access and exfiltrate all previous and subsequent chat data between… |
CVE-2024-48441 | High | 8.8 | 2024-10-24 | Wuhan Tianyu Information Industry Co., Ltd Tianyu CPE Router CommonCPExCPETS_v3.2.468.11.04_P4 was discovered to contain a command injection vulnerability via… |
CVE-2024-48440 | High | 8.8 | 2024-10-24 | Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 was discovered to contain a command injection vulnerabi… |
CVE-2024-48904 | Critical | 9.8 | 2024-10-22 | An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances. Please note: au… |
CVE-2024-9287 | High | 7.8 | 2024-10-22 | A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, all… |
CVE-2024-40089 | Critical | 9.1 | 2024-10-21 | A Command Injection vulnerability in Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, authenticated attackers to execute arbitrary code by injecting shell c… |
CVE-2024-35285 | Critical | 9.8 | 2024-10-21 | A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to i… |
CVE-2024-48659 | Critical | 9.8 | 2024-10-21 | An issue in DCME-320-L <=9.3.2.114 allows a remote attacker to execute arbitrary code via the log_u_umount.php component. |
CVE-2024-10193 | Medium | 4.7 | 2024-10-20 | A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028 and classified as critical. This issue affects the function ping_ddns of the… |
CVE-2024-9264 | Critical | 9.9 | 2024-10-18 | The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanit… |
CVE-2024-6333 | High | 7.2 | 2024-10-17 | Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products. |
CVE-2024-35520 | High | 8.4 | 2024-10-14 | Netgear R7000 1.0.11.136 is vulnerable to Command Injection in RMT_invite.cgi via device_name2 parameter. |
CVE-2024-35519 | High | 8.4 | 2024-10-14 | Netgear EX6120 v1.0.0.68, Netgear EX6100 v1.0.2.28, and Netgear EX3700 v1.0.0.96 are vulnerable to command injection in operating_mode.cgi via the ap_mode para… |
CVE-2024-35518 | High | 8.4 | 2024-10-14 | Netgear EX6120 v1.0.0.68 is vulnerable to Command Injection in genie_fix2.cgi via the wan_dns1_pri parameter. |
CVE-2024-48153 | Critical | 9.8 | 2024-10-14 | DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_subconfig funct… |
CVE-2024-35522 | High | 8.4 | 2024-10-11 | Netgear EX3700 ' AC750 WiFi Range Extender Essentials Edition before 1.0.0.98 contains an authenticated command injection in operating_mode.cgi via the ap_mode… |
CVE-2024-35517 | High | 8.4 | 2024-10-11 | Netgear XR1000 v1.0.0.64 is vulnerable to command injection in usb_remote_smb_conf.cgi via the share_name parameter. |
CVE-2024-44413 | High | 8.8 | 2024-10-11 | A vulnerability was discovered in DI_8200-16.07.26A1, which has been classified as critical. This issue affects the upgrade_filter_asp function in the upgrade_… |
CVE-2024-39563 | High | 7.3 | 2024-10-11 | A Command Injection vulnerability in Juniper Networks Junos Space allows an unauthenticated, network-based attacker sending a specially crafted request to exec… |
CVE-2024-9793 | Medium | 6.3 | 2024-10-10 | A vulnerability classified as critical was found in Tenda AC1206 up to 15.03.06.23. This vulnerability affects the function ate_iwpriv_set/ate_ifconfig_set of… |
CVE-2024-38817 | Medium | 6.7 | 2024-10-09 | VMware NSX contains a command injection vulnerability. A malicious actor with access to the NSX Edge CLI terminal may be able to craft malicious payloads to… |
CVE-2024-7840 | High | 7.8 | 2024-10-09 | In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a command injection attack is possible through improper neutralization of hyperlink elem… |
CVE-2024-39438 | Medium | 6.5 | 2024-10-09 | In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with Syste… |
CVE-2024-39437 | Medium | 6.5 | 2024-10-09 | In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with Syste… |
CVE-2024-39436 | Medium | 6.5 | 2024-10-09 | In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with Syste… |
CVE-2023-37154 | High | 8.4 | 2024-10-09 | check_by_ssh in Nagios nagios-plugins 2.4.5 allows arbitrary command execution via ProxyCommand, LocalCommand, and PermitLocalCommand with \${IFS}. This has be… |
CVE-2024-43601 | High | 7.8 | 2024-10-08 | Visual Studio Code for Linux Remote Code Execution Vulnerability |
CVE-2024-43591 | High | 8.7 | 2024-10-08 | Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability |
CVE-2024-43497 | High | 8.4 | 2024-10-08 | DeepSpeed Remote Code Execution Vulnerability |
CVE-2024-9380 | High | 7.2 | 2024-10-08 | An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges… |
CVE-2024-47562 | High | 8.8 | 2024-10-08 | A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly neutralize special elements i… |
CVE-2024-8983 | Medium | 4.8 | 2024-10-08 | Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-20492 | Medium | 6.0 | 2024-10-02 | A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the und… |
CVE-2024-20432 | Critical | 9.9 | 2024-10-02 | A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to p… |
CVE-2024-20365 | Medium | 6.5 | 2024-10-02 | A vulnerability in the Redfish API of Cisco UCS B-Series, Cisco UCS Managed C-Series, and Cisco UCS X-Series Servers could allow an authenticated, remote attac… |
CVE-2024-46084 | High | 8.0 | 2024-10-01 | Scriptcase 9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_unzip function. |
CVE-2024-44610 | Medium | 5.6 | 2024-10-01 | PCAN-Ethernet Gateway FD before 1.3.0 and PCAN-Ethernet Gateway before 2.11.0 are vulnerable to Command injection via shell metacharacters in a Software Update… |
CVE-2024-9145 | | 2024-10-01 | Wiz Code Visual Studio Code extension in versions 1.0.0 up to 1.5.3 and Wiz (legacy) Visual Studio Code extension in versions 0.13.0 up to 0.17.8 are vulnerabl… | |
CVE-2024-46256 | Critical | 9.8 | 2024-09-27 | A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add Let's Encrypt Certificate. |
CVE-2024-45989 | Medium | 4.0 | 2024-09-26 | Monica AI Assistant desktop application v2.3.0 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. A prompt injection allows an attack… |
CVE-2024-39577 | High | 7.1 | 2024-09-26 | Dell SmartFabric OS10 Software, versions 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contains an Improper Neutralization of Special Elements used in a Command ('Co… |
CVE-2024-8405 | Medium | 6.1 | 2024-09-26 | An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific flaw exists within th… |
CVE-2024-7679 | High | 7.8 | 2024-09-25 | In Progress Telerik UI for WinForms versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink… |
CVE-2024-7575 | High | 7.8 | 2024-09-25 | In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elem… |
CVE-2024-45066 | Critical | 10.0 | 2024-09-25 | A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE IP sub-menu can allow a remote attacker to inject arbitrary commands. |
CVE-2024-43693 | Critical | 10.0 | 2024-09-25 | A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE UTILITY sub-menu can allow a remote attacker to inject arbitrary commands. |
CVE-2024-42507 | Critical | 9.8 | 2024-09-25 | Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destin… |
CVE-2024-42506 | Critical | 9.8 | 2024-09-25 | Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destin… |
CVE-2024-42505 | Critical | 9.8 | 2024-09-25 | Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destin… |
CVE-2024-0005 | Critical | 9.1 | 2024-09-23 | A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP c… |
CVE-2024-45348 | Medium | 6.4 | 2024-09-23 | Xiaomi Router AX9000 has a post-authorization command injection vulnerability. This vulnerability is caused by the lack of validation of user input, and an att… |
CVE-2024-9076 | Medium | 4.7 | 2024-09-22 | A vulnerability was found in DedeCMS up to 5.7.115. It has been rated as critical. This issue affects some unknown processing of the file /dede/article_string_… |
CVE-2024-45682 | High | 8.8 | 2024-09-17 | There is a command injection vulnerability that may allow an attacker to inject malicious input on the device's operating system. |
CVE-2024-42025 | High | 7.8 | 2024-09-13 | A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and earlier) allows a mal… |
CVE-2024-46048 | Critical | 9.8 | 2024-09-13 | Tenda FH451 v1.0.0.9 has a command injection vulnerability in the formexeCommand function i |
CVE-2024-8640 | High | 8.5 | 2024-09-12 | An issue has been discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2… |
CVE-2024-45824 | Critical | 9.8 | 2024-09-12 | CVE-2024-45824 IMPACT A remote code vulnerability exists in the affected products. The vulnerability occurs when chained with Path Traversal, Command Inject… |
CVE-2024-44577 | High | 8.8 | 2024-09-11 | RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the time_date function. |
CVE-2024-44574 | High | 8.8 | 2024-09-11 | RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the sys_conf function. |
CVE-2024-44572 | High | 8.8 | 2024-09-11 | RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the sys_mgmt function. |
CVE-2024-44570 | High | 8.8 | 2024-09-11 | RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a code injection vulnerability via the getParams function in phpinf.php. |
CVE-2024-44466 | Critical | 9.8 | 2024-09-11 | COMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub_424CB4. Attackers can send POST request messages to /usr/bin/webmgnt and inject co… |
CVE-2024-38228 | High | 7.2 | 2024-09-10 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2024-38227 | High | 7.2 | 2024-09-10 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2023-36103 | Critical | 9.8 | 2024-09-10 | Command Injection vulnerability in goform/SetIPTVCfg interface of Tenda AC15 V15.03.05.20 allows remote attackers to run arbitrary commands via crafted POST re… |
CVE-2024-33508 | High | 7.3 | 2024-09-10 | An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in Fortinet FortiClientEMS 7.2.0 through 7.2.4, 7… |
CVE-2024-42427 | High | 7.6 | 2024-09-10 | Dell ThinOS versions 2402 and 2405, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthent… |
CVE-2024-44410 | Critical | 9.8 | 2024-09-09 | D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the upgrade_filter_asp function. |
CVE-2024-44335 | High | 8.8 | 2024-09-09 | D-Link DI-7003G v19.12.24A1, DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7… |
CVE-2024-44334 | High | 8.8 | 2024-09-09 | D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400G+V2 v24.04.18D1 ar… |
CVE-2024-36138 | High | 8.1 | 2024-09-07 | Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / ch… |
CVE-2024-44845 | High | 8.8 | 2024-09-06 | DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the value parameter in the filter_string function. |
CVE-2024-44844 | High | 8.8 | 2024-09-06 | DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the name parameter in the run_command function. |
CVE-2024-38641 | High | 7.8 | 2024-09-06 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local net… |
CVE-2024-21903 | Medium | 6.6 | 2024-09-06 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2023-47563 | High | 7.4 | 2024-09-06 | An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to execute com… |
CVE-2024-44402 | Critical | 9.8 | 2024-09-06 | D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via msp_info.htm. |
CVE-2024-44401 | Critical | 9.8 | 2024-09-06 | D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via sub47A60C function in the upgrade_filter.asp file |
CVE-2024-38486 | High | 7.5 | 2024-09-06 | Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x , contain(s) an Improper Neutralization of Special Elements used in a Comman… |
CVE-2024-44400 | Critical | 9.8 | 2024-09-04 | A vulnerability was discovered in DI_8400-16.07.26A1, which has been classified as critical. This issue affects the upgrade_filter_asp function in the upgrade_… |
CVE-2024-44383 | Medium | 6.8 | 2024-09-04 | WAYOS FBM-291W v19.09.11 is vulnerable to Command Execution via msp_info_htm. |
CVE-2024-44916 | High | 7.2 | 2024-08-30 | Vulnerability in admin_ip.php in Seacms v13.1, when action=set, allows attackers to control IP parameters that are written to the data/admin/ip.php file and co… |
CVE-2024-42905 | Critical | 9.8 | 2024-08-28 | Beijing Digital China Cloud Technology Co., Ltd. DCME-320 v.7.4.12.60 has a command execution vulnerability, which can be exploited to obtain device administra… |
CVE-2021-38120 | Medium | 5.1 | 2024-08-28 | A vulnerability identified in Advance Authentication that allows bash command Injection in administrative controlled functionality of backup due to improper ha… |
CVE-2024-8214 | Medium | 6.3 | 2024-08-27 | A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-… |
CVE-2024-8213 | Medium | 6.3 | 2024-08-27 | A vulnerability classified as critical has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325… |
CVE-2024-8212 | Medium | 6.3 | 2024-08-27 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326… |
CVE-2024-8211 | Medium | 6.3 | 2024-08-27 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326… |
CVE-2024-8210 | Medium | 6.3 | 2024-08-27 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326… |
CVE-2023-26315 | Medium | 6.5 | 2024-08-26 | The Xiaomi router AX9000 has a post-authentication command injection vulnerability. This vulnerability is caused by the lack of input filtering, allowing an at… |
CVE-2024-8073 | Critical | 9.8 | 2024-08-26 | Improper Input Validation vulnerability in Hillstone Networks Hillstone Networks Web Application Firewall on 5.5R6 allows Command Injection.This issue affects… |
CVE-2024-8134 | Medium | 6.3 | 2024-08-24 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326… |