CWE-77 · Command Injection (page 19)
Page 19 of 39 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-50388 | Critical | 9.8 | 2024-12-06 | An OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to exe… |
CVE-2024-53672 | Medium | 4.7 | 2024-12-03 | A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying ho… |
CVE-2024-51772 | Medium | 6.4 | 2024-12-03 | An authenticated RCE vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands o… |
CVE-2024-51771 | High | 7.2 | 2024-12-03 | A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote threat actor to conduct… |
CVE-2024-51114 | High | 8.8 | 2024-12-03 | An issue in Beijing Digital China Yunke Information Technology Co.Ltd v.7.2.6.120 allows a remote attacker to execute arbitrary code via the code/function/dpi/… |
CVE-2024-29404 | High | 7.8 | 2024-12-03 | An issue in Razer Synapse 3 v.3.9.131.20813 and Synapse 3 App v.20240213 allows a local attacker to execute arbitrary code via the export parameter of the Chro… |
CVE-2024-11013 | High | 7.2 | 2024-11-29 | Command Injection vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27, for Ver10.9 up to Ver10.9.14 and UNIVE… |
CVE-2024-38831 | High | 7.8 | 2024-11-26 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can insert malicious comman… |
CVE-2024-11659 | Medium | 4.7 | 2024-11-25 | A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118 and classified as critical. Affected by this issue is some unknown fun… |
CVE-2024-11658 | Medium | 4.7 | 2024-11-25 | A vulnerability has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118 and classified as critical. Affected by this vulnerability is an… |
CVE-2024-11657 | Medium | 4.7 | 2024-11-25 | A vulnerability, which was classified as critical, was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. Affected is an unknown function of… |
CVE-2024-11656 | Medium | 4.7 | 2024-11-25 | A vulnerability, which was classified as critical, has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This issue affects some unkno… |
CVE-2024-11655 | Medium | 4.7 | 2024-11-25 | A vulnerability classified as critical was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This vulnerability affects unknown code of the… |
CVE-2024-11654 | Medium | 4.7 | 2024-11-25 | A vulnerability classified as critical has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This affects an unknown part of the file… |
CVE-2024-11653 | Medium | 4.7 | 2024-11-25 | A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. It has been rated as critical. Affected by this issue is some unknown… |
CVE-2024-11652 | Medium | 4.7 | 2024-11-25 | A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. It has been declared as critical. Affected by this vulnerability is a… |
CVE-2024-11651 | Medium | 4.7 | 2024-11-25 | A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. It has been classified as critical. Affected is an unknown function o… |
CVE-2024-11665 | High | 8.8 | 2024-11-24 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in hardy-barth cph2_echarge_firmware allows OS Command Inject… |
CVE-2024-53899 | High | 7.8 | 2024-11-24 | virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly wh… |
CVE-2024-37782 | Critical | 9.8 | 2024-11-22 | An LDAP injection vulnerability in the login page of Gladinet CentreStack v13.12.9934.54690 allows attackers to access sensitive data or execute arbitrary comm… |
CVE-2024-48861 | High | 7.8 | 2024-11-22 | An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local network attackers… |
CVE-2024-48860 | Critical | 9.8 | 2024-11-22 | An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow remote attackers to exe… |
CVE-2024-38644 | High | 8.8 | 2024-11-22 | An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticated attackers t… |
CVE-2023-24467 | High | 8.8 | 2024-11-22 | Possible Command Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0000. |
CVE-2021-38117 | High | 8.8 | 2024-11-22 | Possible Command injection Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000. |
CVE-2021-38116 | High | 8.8 | 2024-11-22 | Possible Elevation of Privilege Vulnerability in iManager has been discovered in OpenText™ iManager. This impacts all versions before 3.2.5 |
CVE-2024-53333 | Medium | 6.3 | 2024-11-21 | TOTOLINK EX200 v4.0.3c.7646_B20201211 was found to contain a command insertion vulnerability in the setUssd function. This vulnerability allows an attacker to… |
CVE-2024-48288 | High | 8.0 | 2024-11-21 | TP-Link TL-IPC42C V4.0_20211227_1.0.16 is vulnerable to command injection due to the lack of malicious code verification on both the frontend and backend. |
CVE-2024-48286 | High | 8.0 | 2024-11-21 | Linksys E3000 1.0.06.002_US is vulnerable to command injection via the diag_ping_start function. |
CVE-2024-48747 | Medium | 6.8 | 2024-11-21 | An issue in alist-tvbox v1.7.1 allows a remote attacker to execute arbitrary code via the /atv-cli file. |
CVE-2024-11320 | Critical | 9.8 | 2024-11-21 | Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue affects Pandora FMS… |
CVE-2024-51151 | Critical | 9.8 | 2024-11-21 | D-Link DI-8200 16.07.26A1 is vulnerable to remote command execution in the msp_info_htm function via the flag parameter and cmd parameter. |
CVE-2024-33439 | Critical | 9.1 | 2024-11-20 | An issue in Kasda LinkSmart Router KW5515 v1.7 and before allows an authenticated remote attacker to execute arbitrary OS commands via cgi parameters. |
CVE-2024-52739 | High | 8.0 | 2024-11-20 | D-LINK DI-8400 v16.07.26A1 was discovered to contain multiple remote command execution (RCE) vulnerabilities in the msp_info_htm function via the flag and cmd… |
CVE-2024-29292 | Critical | 9.1 | 2024-11-20 | Multiple OS Command Injection vulnerabilities affecting Kasda LinkSmart Router KW6512 <= v1.3 enable an authenticated remote attacker to execute arbitrary OS c… |
CVE-2024-51503 | High | 8.0 | 2024-11-19 | A security agent manual scan command injection vulnerability in the Trend Micro Deep Security 20 Agent could allow an attacker to escalate privileges and execu… |
CVE-2024-45505 | High | 8.8 | 2024-11-18 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache HertzBeat (incubating). This vulnerability can onl… |
CVE-2024-10443 | Critical | 9.8 | 2024-11-15 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synology BeePhotos before… |
CVE-2022-1884 | Critical | 9.8 | 2024-11-15 | A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper vali… |
CVE-2024-52308 | High | 8.0 | 2024-11-14 | The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh… |
CVE-2024-51027 | Medium | 6.5 | 2024-11-13 | Ruijie NBR800G gateway NBR_RGOS_11.1(6)B4P9 is vulnerable to command execution in /itbox_pi/networksafe.php via the province parameter. |
CVE-2024-50853 | High | 8.8 | 2024-11-13 | Tenda G3 v3.0 v15.11.0.20 was discovered to contain a command injection vulnerability via the formSetDebugCfg function. |
CVE-2024-50852 | High | 8.8 | 2024-11-13 | Tenda G3 v3.0 v15.11.0.20 was discovered to contain a command injection vulnerability via the formSetUSBPartitionUmount function. |
CVE-2024-28729 | Critical | 9.8 | 2024-11-12 | An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacker to execute arbitrary code via a crafted req… |
CVE-2024-28726 | High | 8.0 | 2024-11-12 | An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacker to execute arbitrary code via a crafted pay… |
CVE-2021-27702 | High | 7.3 | 2024-11-12 | Sercomm Router Etisalat Model S3- AC2100 is affected by Incorrect Access Control via the diagnostic utility in the router dashboard. |
CVE-2024-49042 | High | 7.2 | 2024-11-12 | Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability |
CVE-2024-43613 | High | 7.2 | 2024-11-12 | Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability |
CVE-2024-49026 | High | 7.8 | 2024-11-12 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2024-50572 | High | 7.2 | 2024-11-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2024-49560 | High | 7.8 | 2024-11-12 | Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) a command injection vulnerability. A low privileged attacker with… |
CVE-2024-49557 | High | 7.8 | 2024-11-12 | Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Improper Neutralization of Special Elements used in a Command… |
CVE-2024-25255 | Critical | 9.8 | 2024-11-11 | Sublime Text 4 was discovered to contain a command injection vulnerability via the New Build System module. NOTE: multiple third parties report that this is in… |
CVE-2024-51186 | High | 8.0 | 2024-11-11 | D-Link DIR-820L 1.05b03 was discovered to contain a remote code execution (RCE) vulnerability via the ping_addr parameter in the ping_v4 and ping_v6 functions. |
CVE-2024-11046 | Medium | 6.3 | 2024-11-10 | A vulnerability was found in D-Link DI-8003 16.07.16A1. It has been classified as critical. Affected is the function upgrade_filter_asp of the file /upgrade_fi… |
CVE-2024-50591 | High | 7.8 | 2024-11-08 | An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a command inject… |
CVE-2024-10966 | Medium | 6.3 | 2024-11-07 | A vulnerability, which was classified as critical, has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected by this issue is some unknown functionality… |
CVE-2024-51736 | Unrated | | 2024-11-06 | Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named `cmd.exe` is lo… |
CVE-2024-20418 | Critical | 10.0 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco Unified Industrial Wireless Software for Cisco Ultra-Reliable Wireless Backhaul (URWB) Access Po… |
CVE-2024-51115 | Critical | 9.8 | 2024-11-05 | DCME-320 v7.4.12.90 was discovered to contain a command injection vulnerability. |
CVE-2024-48746 | Critical | 9.8 | 2024-11-05 | An issue in Lens Visual integration with Power BI v.4.0.0.3 allows a remote attacker to execute arbitrary code via the Natural language processing component |
CVE-2024-47461 | High | 7.2 | 2024-11-05 | An authenticated command injection vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. A successful exploitation of this vulnerability… |
CVE-2024-47460 | Critical | 9.0 | 2024-11-05 | Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined… |
CVE-2024-42509 | Critical | 9.8 | 2024-11-05 | Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined… |
CVE-2024-9579 | High | 7.5 | 2024-11-05 | A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation… |
CVE-2024-52022 | High | 8.0 | 2024-11-05 | Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the compon… |
CVE-2024-10035 | Critical | 9.8 | 2024-11-04 | Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in a Command ('Command Injection'), Improper Neutra… |
CVE-2024-10697 | Medium | 6.3 | 2024-11-02 | A vulnerability has been found in Tenda AC6 15.03.05.19 and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file… |
CVE-2024-51260 | Critical | 9.8 | 2024-10-31 | DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the acme_process functi… |
CVE-2024-51255 | Critical | 9.8 | 2024-10-31 | DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ruequest_certificat… |
CVE-2024-51259 | Critical | 9.8 | 2024-10-31 | DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the setup_cacertificate… |
CVE-2024-51254 | High | 8.8 | 2024-10-31 | DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the sign_cacertificate… |
CVE-2024-48214 | High | 8.4 | 2024-10-30 | KERUI HD 3MP 1080P Tuya Camera 1.0.4 has a command injection vulnerability in the module that connects to the local network via a QR code. This vulnerability a… |
CVE-2024-51258 | High | 8.8 | 2024-10-30 | DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doSSLTunnel functio… |
CVE-2024-51301 | High | 8.8 | 2024-10-30 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the packet_monitor functi… |
CVE-2024-51300 | High | 8.8 | 2024-10-30 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_rrd function. |
CVE-2024-51299 | High | 8.8 | 2024-10-30 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the dumpSyslog function. |
CVE-2024-51296 | High | 8.8 | 2024-10-30 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the pingtrace function. |
CVE-2024-51257 | High | 8.8 | 2024-10-30 | DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate funct… |
CVE-2024-51304 | High | 8.8 | 2024-10-30 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ldap_search_dn functi… |
CVE-2024-41153 | High | 7.2 | 2024-10-29 | Command injection vulnerability in the Edge Computing UI for the TRO600 series radios that allows for the execution of arbitrary system commands. If exploited… |
CVE-2024-10435 | Medium | 6.3 | 2024-10-28 | A vulnerability was found in didi Super-Jacoco 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /cov/triggerEnvCov. T… |
CVE-2024-10429 | High | 7.2 | 2024-10-27 | A vulnerability classified as critical has been found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. Affected is the function set_ipv6 of the file i… |
CVE-2024-10428 | High | 7.2 | 2024-10-27 | A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. It has been rated as critical. This issue affects the function set_ipv6 of… |
CVE-2024-48145 | Critical | 9.1 | 2024-10-24 | A prompt injection vulnerability in the chatbox of Netangular Technologies ChatNet AI Version v1.0 allows attackers to access and exfiltrate all previous and s… |
CVE-2024-48144 | Critical | 9.1 | 2024-10-24 | A prompt injection vulnerability in the chatbox of Fusion Chat Chat AI Assistant Ask Me Anything v1.2.4.0 allows attackers to access and exfiltrate all previou… |
CVE-2024-48142 | High | 7.5 | 2024-10-24 | A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica ChatGPT AI Assistant v2.4.0 allows attackers to access and exfiltrate all pr… |
CVE-2024-48141 | High | 7.5 | 2024-10-24 | A prompt injection vulnerability in the chatbox of Zhipu AI CodeGeeX v2.17.0 allows attackers to access and exfiltrate all previous and subsequent chat data be… |
CVE-2024-48140 | High | 7.5 | 2024-10-24 | A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica Your AI Copilot powered by ChatGPT4 v6.3.0 allows attackers to access and ex… |
CVE-2024-48139 | High | 7.5 | 2024-10-24 | A prompt injection vulnerability in the chatbox of Blackbox AI v1.3.95 allows attackers to access and exfiltrate all previous and subsequent chat data between… |
CVE-2024-48441 | High | 8.8 | 2024-10-24 | Wuhan Tianyu Information Industry Co., Ltd Tianyu CPE Router CommonCPExCPETS_v3.2.468.11.04_P4 was discovered to contain a command injection vulnerability via… |
CVE-2024-48440 | High | 8.8 | 2024-10-24 | Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 was discovered to contain a command injection vulnerabi… |
CVE-2024-48904 | Critical | 9.8 | 2024-10-22 | An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances. Please note: au… |
CVE-2024-9287 | High | 7.8 | 2024-10-22 | A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, all… |
CVE-2024-40089 | Critical | 9.1 | 2024-10-21 | A Command Injection vulnerability in Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, authenticated attackers to execute arbitrary code by injecting shell c… |
CVE-2024-35285 | Critical | 9.8 | 2024-10-21 | A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to i… |
CVE-2024-48659 | Critical | 9.8 | 2024-10-21 | An issue in DCME-320-L <=9.3.2.114 allows a remote attacker to execute arbitrary code via the log_u_umount.php component. |
CVE-2024-10193 | Medium | 4.7 | 2024-10-20 | A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028 and classified as critical. This issue affects the function ping_ddns of the… |
CVE-2024-9264 | Critical | 9.9 | 2024-10-18 | The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanit… |
CVE-2024-6333 | High | 7.2 | 2024-10-17 | Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products. |