CWE-77 · Command Injection (page 19)
Page 19 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8133 | Medium | 6.3 | 2024-08-24 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326… |
CVE-2024-8132 | Medium | 6.3 | 2024-08-24 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326… |
CVE-2024-8131 | Medium | 6.3 | 2024-08-24 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326… |
CVE-2024-8130 | Medium | 6.3 | 2024-08-24 | A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR… |
CVE-2024-8129 | Medium | 6.3 | 2024-08-24 | A vulnerability, which was classified as critical, was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, D… |
CVE-2024-8128 | Medium | 6.3 | 2024-08-24 | A vulnerability, which was classified as critical, has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-3… |
CVE-2024-8127 | Medium | 6.3 | 2024-08-24 | A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-… |
CVE-2024-44382 | Critical | 9.8 | 2024-08-23 | D-Link DI_8004W 16.07.26A1 contains a command execution vulnerability in the jhttpd upgrade_filter_asp function. |
CVE-2024-44381 | Critical | 9.8 | 2024-08-23 | D-Link DI_8004W 16.07.26A1 contains a command execution vulnerability in jhttpd msp_info_htm function. |
CVE-2024-42636 | High | 7.2 | 2024-08-23 | DedeCMS V5.7.115 has a command execution vulnerability via file_manage_view.php?fmdo=newfile&activepath. |
CVE-2024-7110 | Medium | 6.4 | 2024-08-22 | An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execu… |
CVE-2024-43027 | High | 8.0 | 2024-08-21 | DrayTek Vigor 3900 before v1.5.1.5_Beta, DrayTek Vigor 2960 before v1.5.1.5_Beta and DrayTek Vigor 300B before v1.5.1.5_Beta were discovered to contain a comma… |
CVE-2024-7922 | Medium | 6.3 | 2024-08-19 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326… |
CVE-2024-7907 | Medium | 6.3 | 2024-08-18 | A vulnerability, which was classified as critical, has been found in TOTOLINK X6000R 9.4.0cu.852_20230719. This issue affects the function setSyslogCfg of the… |
CVE-2024-7897 | Medium | 6.3 | 2024-08-17 | A vulnerability classified as critical has been found in Tosei Online Store Management System ネット店舗管理システム 4.02/4.03/4.04. This affects an unknown part of the f… |
CVE-2024-7896 | Medium | 6.3 | 2024-08-17 | A vulnerability was found in Tosei Online Store Management System ネット店舗管理システム 4.02/4.03/4.04. It has been rated as critical. Affected by this issue is some unk… |
CVE-2024-42947 | Critical | 9.8 | 2024-08-15 | An issue in the handler function in /goform/telnet of Tenda FH1201 v1.2.0.14 (408) allows attackers to execute arbitrary commands via a crafted HTTP request. |
CVE-2024-7833 | Medium | 6.3 | 2024-08-15 | A vulnerability was found in D-Link DI-8100 16.07. It has been classified as critical. This affects the function upgrade_filter_asp of the file upgrade_filter… |
CVE-2024-42360 | Critical | 9.8 | 2024-08-14 | SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user interface for personal or group use. Several HTTP endpoints did not properly sani… |
CVE-2024-5914 | Critical | 9.8 | 2024-08-14 | A command injection issue in Palo Alto Networks Cortex XSOAR CommonScripts Pack allows an unauthenticated attacker to execute arbitrary commands within the con… |
CVE-2024-7715 | Medium | 6.3 | 2024-08-13 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-… |
CVE-2024-7700 | Medium | 6.5 | 2024-08-12 | A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page… |
CVE-2024-7616 | Medium | 5.5 | 2024-08-12 | A vulnerability was found in Edimax IC-6220DC and IC-5150W up to 3.06. It has been rated as critical. Affected by this issue is the function cgiFormString of t… |
CVE-2024-37023 | Critical | 9.1 | 2024-08-12 | Multiple OS command injection vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and pr… |
CVE-2024-22122 | Low | 3.0 | 2024-08-12 | Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zab… |
CVE-2024-21880 | High | 7.2 | 2024-08-12 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated enpoint in Enphase… |
CVE-2024-21879 | High | 8.8 | 2024-08-12 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticated enpoint in Enpha… |
CVE-2024-21878 | Critical | 9.8 | 2024-08-12 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Enphase IQ Gateway (formerly known as Envoy) allows OS Com… |
CVE-2024-3659 | High | 7.2 | 2024-08-08 | Firmware in KAON AR2140 routers, prior to versions 3.2.50 and 4.2.16, is vulnerable to a shell command injection via sending a crafted request to one of the en… |
CVE-2024-28739 | High | 7.2 | 2024-08-06 | An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter. |
CVE-2024-39226 | Critical | 9.8 | 2024-08-06 | GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E75… |
CVE-2024-7397 | | 2024-08-05 | Improper filering of special characters result in a command ('command injection') vulnerability in Korenix JetPort 5601v3.This issue affects JetPort 5601v3: th… | |
CVE-2024-7464 | Medium | 6.3 | 2024-08-05 | A vulnerability, which was classified as critical, has been found in TOTOLINK CP900 6.3c.566. This issue affects the function setTelnetCfg of the component Tel… |
CVE-2024-7443 | Medium | 6.3 | 2024-08-03 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Vivotek IB8367A VVTK-0100b. Affected is the function getenv of the fil… |
CVE-2024-7442 | Medium | 6.3 | 2024-08-03 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek SD9364 VVTK-0103f. It has been rated as critical. This issue affects the function getenv o… |
CVE-2024-7440 | Medium | 6.3 | 2024-08-03 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek CC8160 VVTK-0100d. It has been classified as critical. This affects the function getenv of… |
CVE-2024-7436 | Medium | 6.3 | 2024-08-03 | A vulnerability, which was classified as critical, has been found in D-Link DI-8100 16.07. This issue affects the function msp_info_htm of the file msp_info.ht… |
CVE-2024-42348 | Critical | 9.3 | 2024-08-02 | FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.2 can leak AD username and password when registering a computer. This… |
CVE-2024-7029 | High | 8.8 | 2024-08-02 | Commands can be injected over the network and executed without authentication. |
CVE-2022-4002 | High | 7.2 | 2024-07-31 | A command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted API request. |
CVE-2024-7215 | Medium | 6.3 | 2024-07-30 | A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832 and classified as critical. Affected by this issue is the function NTPSyncWithHost of the file /cgi-b… |
CVE-2024-7214 | Medium | 6.3 | 2024-07-30 | A vulnerability has been found in TOTOLINK LR350 9.3.5u.6369_B20220309 and classified as critical. Affected by this vulnerability is the function setWanCfg of… |
CVE-2023-40396 | High | 7.8 | 2024-07-29 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17. An app may be able to… |
CVE-2024-41637 | High | 8.3 | 2024-07-29 | RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also possesses Sudo privilege… |
CVE-2024-7181 | Medium | 6.3 | 2024-07-29 | A vulnerability classified as critical was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. This vulnerability affects the function setTelnetCfg of the file /c… |
CVE-2024-7177 | High | 8.8 | 2024-07-29 | A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. It has been classified as critical. Affected is the function setLanguageCfg of the file /c… |
CVE-2024-7174 | High | 8.8 | 2024-07-29 | A vulnerability, which was classified as critical, was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. This affects the function setdeviceName of the file /cg… |
CVE-2024-7160 | Medium | 6.3 | 2024-07-28 | A vulnerability classified as critical has been found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is the function setWanCfg of the file /cgi-bin/cstecgi… |
CVE-2024-7158 | Medium | 6.3 | 2024-07-28 | A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050_B20200504. It has been declared as critical. This vulnerability affects the function setTelnetCfg of… |
CVE-2024-41815 | High | 7.4 | 2024-07-26 | Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules ma… |
CVE-2024-38288 | High | 7.2 | 2024-07-25 | A command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allows authenticated attackers with administ… |
CVE-2024-41136 | Medium | 6.8 | 2024-07-24 | An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation… |
CVE-2024-41135 | High | 7.2 | 2024-07-24 | A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary… |
CVE-2024-41134 | High | 7.2 | 2024-07-24 | A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary… |
CVE-2024-41133 | High | 7.2 | 2024-07-24 | A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary… |
CVE-2024-41319 | Critical | 9.8 | 2024-07-23 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the cmd parameter in the webcmd function. |
CVE-2024-41320 | High | 8.8 | 2024-07-22 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the get_apcli_conn_info function. |
CVE-2024-41318 | Critical | 9.8 | 2024-07-22 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode functio… |
CVE-2024-41316 | Critical | 9.8 | 2024-07-22 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps function. |
CVE-2024-39963 | High | 8.0 | 2024-07-19 | AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22.03.01.46 and AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX12 V1.0 V22.03.01.46 were discovered to contain an authe… |
CVE-2024-29737 | Medium | 4.7 | 2024-07-17 | In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert comma… |
CVE-2023-52291 | Medium | 4.7 | 2024-07-17 | In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert comma… |
CVE-2024-38492 | | 2024-07-15 | This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a specially crafted PAM upgra… | |
CVE-2024-30213 | High | 8.8 | 2024-07-12 | StoneFly Storage Concentrator (SC and SCVM) before 8.0.4.26 allows remote authenticated users to achieve Command Injection via a Ping URL, leading to remote co… |
CVE-2024-40110 | Critical | 9.8 | 2024-07-12 | Sourcecodester Poultry Farm Management System v1.0 contains an Unauthenticated Remote Code Execution (RCE) vulnerability via the productimage parameter at /far… |
CVE-2024-39914 | Critical | 9.8 | 2024-07-12 | FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a comm… |
CVE-2024-39571 | High | 8.8 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications are vulnerable to command injection due to… |
CVE-2024-39570 | High | 8.8 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications are vulnerable to command injection due to… |
CVE-2024-39569 | Medium | 6.6 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of affected applications is vulnerable to com… |
CVE-2024-39568 | High | 7.8 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of affected applications is vulnerable to com… |
CVE-2024-39567 | High | 7.8 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of affected applications is vulnerable to com… |
CVE-2024-4944 | High | 7.8 | 2024-07-09 | A local privilege escalation vlnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with eleva… |
CVE-2024-25639 | Medium | 5.9 | 2024-07-08 | Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's response and user input… |
CVE-2024-39028 | Critical | 9.8 | 2024-07-05 | An issue was discovered in SeaCMS <=12.9 which allows remote attackers to execute arbitrary code via admin_ping.php. |
CVE-2024-36983 | High | 8.0 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an authenticated user coul… |
CVE-2024-36073 | High | 7.2 | 2024-06-27 | Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the shadowing component of th… |
CVE-2024-4578 | High | 8.4 | 2024-06-27 | This Advisory describes an issue that impacts Arista Wireless Access Points. Any entity with the ability to authenticate via SSH to an affected AP as the “conf… |
CVE-2024-39373 | High | 7.2 | 2024-06-27 | TELSAT marKoni FM Transmitters are vulnerable to a command injection vulnerability through the manipulation of settings and could allow an attacker to gain una… |
CVE-2024-4884 | Critical | 9.8 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The Apm.UI.Areas.APM.Contro… |
CVE-2024-4883 | Critical | 9.8 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This vulnerability allows an unauthenticated… |
CVE-2024-6257 | High | 8.4 | 2024-06-25 | HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary… |
CVE-2024-4639 | High | 7.1 | 2024-06-25 | OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in IPSec configuration. An a… |
CVE-2024-4638 | High | 7.1 | 2024-06-25 | OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in the web key upload functi… |
CVE-2024-38903 | Medium | 4.1 | 2024-06-24 | H3C Magic R230 V100R002's udpserver opens port 9034, allowing attackers to execute arbitrary commands. |
CVE-2024-38896 | Medium | 5.3 | 2024-06-24 | WAVLINK WN551K1 found a command injection vulnerability through the start_hour parameter of /cgi-bin/nightled.cgi. |
CVE-2024-38894 | Medium | 5.3 | 2024-06-24 | WAVLINK WN551K1 found a command injection vulnerability through the IP parameter of /cgi-bin/touchlist_sync.cgi. |
CVE-2024-37091 | Critical | 9.9 | 2024-06-24 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in StylemixThemes Consulting Elementor Widgets, StylemixTheme… |
CVE-2024-24551 | High | 8.8 | 2024-06-24 | A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code through the Image API. This vulnerability ar… |
CVE-2024-24550 | High | 8.1 | 2024-06-24 | A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through the File API which… |
CVE-2024-6269 | Medium | 4.7 | 2024-06-23 | A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. This vulnerability affects the function get_ip.addr_details of the file /view/v… |
CVE-2014-5470 | Critical | 9.8 | 2024-06-21 | Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for part of the input data passed to an eval… |
CVE-2024-37642 | Critical | 9.1 | 2024-06-14 | TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a command injection vulnerability via the ipv4_ping, ipv6_ping parameter at /formSystemCheck . |
CVE-2024-35242 | High | 8.8 | 2024-06-10 | Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg reposito… |
CVE-2024-35241 | High | 8.8 | 2024-06-10 | Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages i… |
CVE-2024-37570 | High | 8.8 | 2024-06-09 | On Mitel 6869i 4.5.0.41 devices, the Manual Firmware Update (upgrade.html) page does not perform sanitization on the username and path parameters (sent by an a… |
CVE-2024-37569 | High | 8.8 | 2024-06-09 | An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnerability exists in the hostname parameter… |
CVE-2024-37385 | Critical | 9.8 | 2024-06-07 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists bec… |
CVE-2024-30368 | High | 8.8 | 2024-06-06 | A10 Thunder ADC CsrRequestView Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2024-36604 | Critical | 9.8 | 2024-06-04 | Tenda O3V2 v1.0.0.12(3880) was discovered to contain a Blind Command Injection via stpEn parameter in the SetStp function. This vulnerability allows attackers… |
CVE-2024-34792 | Critical | 9.1 | 2024-06-04 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in dexta Dextaz Ping allows Command Injection.This issue affe… |