CWE-77 · Command Injection (page 21)
Page 21 of 39 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5914 | Critical | 9.8 | 2024-08-14 | A command injection issue in Palo Alto Networks Cortex XSOAR CommonScripts Pack allows an unauthenticated attacker to execute arbitrary commands within the con… |
CVE-2024-7715 | Medium | 6.3 | 2024-08-13 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-… |
CVE-2024-7700 | Medium | 6.5 | 2024-08-12 | A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page… |
CVE-2024-7616 | Medium | 5.5 | 2024-08-12 | A vulnerability was found in Edimax IC-6220DC and IC-5150W up to 3.06. It has been rated as critical. Affected by this issue is the function cgiFormString of t… |
CVE-2024-37023 | Critical | 9.1 | 2024-08-12 | Multiple OS command injection vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and pr… |
CVE-2024-22122 | Low | 3.0 | 2024-08-12 | Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zab… |
CVE-2024-21880 | High | 7.2 | 2024-08-12 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated enpoint in Enphase… |
CVE-2024-21879 | High | 8.8 | 2024-08-12 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticated enpoint in Enpha… |
CVE-2024-21878 | Critical | 9.8 | 2024-08-12 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Enphase IQ Gateway (formerly known as Envoy) allows OS Com… |
CVE-2024-3659 | High | 7.2 | 2024-08-08 | Firmware in KAON AR2140 routers, prior to versions 3.2.50 and 4.2.16, is vulnerable to a shell command injection via sending a crafted request to one of the en… |
CVE-2024-28739 | High | 7.2 | 2024-08-06 | An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter. |
CVE-2024-39226 | Critical | 9.8 | 2024-08-06 | GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E75… |
CVE-2024-7397 | | 2024-08-05 | Improper filering of special characters result in a command ('command injection') vulnerability in Korenix JetPort 5601v3.This issue affects JetPort 5601v3: th… | |
CVE-2024-7464 | Medium | 6.3 | 2024-08-05 | A vulnerability, which was classified as critical, has been found in TOTOLINK CP900 6.3c.566. This issue affects the function setTelnetCfg of the component Tel… |
CVE-2024-7443 | Medium | 6.3 | 2024-08-03 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Vivotek IB8367A VVTK-0100b. Affected is the function getenv of the fil… |
CVE-2024-7442 | Medium | 6.3 | 2024-08-03 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek SD9364 VVTK-0103f. It has been rated as critical. This issue affects the function getenv o… |
CVE-2024-7440 | Medium | 6.3 | 2024-08-03 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek CC8160 VVTK-0100d. It has been classified as critical. This affects the function getenv of… |
CVE-2024-7436 | Medium | 6.3 | 2024-08-03 | A vulnerability, which was classified as critical, has been found in D-Link DI-8100 16.07. This issue affects the function msp_info_htm of the file msp_info.ht… |
CVE-2024-42348 | Critical | 9.3 | 2024-08-02 | FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.2 can leak AD username and password when registering a computer. This… |
CVE-2024-7029 | High | 8.8 | 2024-08-02 | Commands can be injected over the network and executed without authentication. |
CVE-2022-4002 | High | 7.2 | 2024-07-31 | A command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted API request. |
CVE-2024-7215 | Medium | 6.3 | 2024-07-30 | A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832 and classified as critical. Affected by this issue is the function NTPSyncWithHost of the file /cgi-b… |
CVE-2024-7214 | Medium | 6.3 | 2024-07-30 | A vulnerability has been found in TOTOLINK LR350 9.3.5u.6369_B20220309 and classified as critical. Affected by this vulnerability is the function setWanCfg of… |
CVE-2023-40396 | High | 7.8 | 2024-07-29 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17. An app may be able to… |
CVE-2024-41637 | High | 8.3 | 2024-07-29 | RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also possesses Sudo privilege… |
CVE-2024-7181 | Medium | 6.3 | 2024-07-29 | A vulnerability classified as critical was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. This vulnerability affects the function setTelnetCfg of the file /c… |
CVE-2024-7177 | High | 8.8 | 2024-07-29 | A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. It has been classified as critical. Affected is the function setLanguageCfg of the file /c… |
CVE-2024-7174 | High | 8.8 | 2024-07-29 | A vulnerability, which was classified as critical, was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. This affects the function setdeviceName of the file /cg… |
CVE-2024-7160 | Medium | 6.3 | 2024-07-28 | A vulnerability classified as critical has been found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is the function setWanCfg of the file /cgi-bin/cstecgi… |
CVE-2024-7158 | Medium | 6.3 | 2024-07-28 | A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050_B20200504. It has been declared as critical. This vulnerability affects the function setTelnetCfg of… |
CVE-2024-41815 | High | 7.4 | 2024-07-26 | Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules ma… |
CVE-2024-38288 | High | 7.2 | 2024-07-25 | A command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allows authenticated attackers with administ… |
CVE-2024-41136 | Medium | 6.8 | 2024-07-24 | An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation… |
CVE-2024-41135 | High | 7.2 | 2024-07-24 | A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary… |
CVE-2024-41134 | High | 7.2 | 2024-07-24 | A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary… |
CVE-2024-41133 | High | 7.2 | 2024-07-24 | A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary… |
CVE-2024-41319 | Critical | 9.8 | 2024-07-23 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the cmd parameter in the webcmd function. |
CVE-2024-41320 | High | 8.8 | 2024-07-22 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the get_apcli_conn_info function. |
CVE-2024-41318 | Critical | 9.8 | 2024-07-22 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode functio… |
CVE-2024-41316 | Critical | 9.8 | 2024-07-22 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps function. |
CVE-2024-39963 | High | 8.0 | 2024-07-19 | AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22.03.01.46 and AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX12 V1.0 V22.03.01.46 were discovered to contain an authe… |
CVE-2024-29737 | Medium | 4.7 | 2024-07-17 | In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert comma… |
CVE-2023-52291 | Medium | 4.7 | 2024-07-17 | In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert comma… |
CVE-2024-38492 | | 2024-07-15 | This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a specially crafted PAM upgra… | |
CVE-2024-30213 | High | 8.8 | 2024-07-12 | StoneFly Storage Concentrator (SC and SCVM) before 8.0.4.26 allows remote authenticated users to achieve Command Injection via a Ping URL, leading to remote co… |
CVE-2024-40110 | Critical | 9.8 | 2024-07-12 | Sourcecodester Poultry Farm Management System v1.0 contains an Unauthenticated Remote Code Execution (RCE) vulnerability via the productimage parameter at /far… |
CVE-2024-39914 | Critical | 9.8 | 2024-07-12 | FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a comm… |
CVE-2024-39571 | High | 8.8 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications are vulnerable to command injection due to… |
CVE-2024-39570 | High | 8.8 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications are vulnerable to command injection due to… |
CVE-2024-39569 | Medium | 6.6 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of affected applications is vulnerable to com… |
CVE-2024-39568 | High | 7.8 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of affected applications is vulnerable to com… |
CVE-2024-39567 | High | 7.8 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of affected applications is vulnerable to com… |
CVE-2024-4944 | High | 7.8 | 2024-07-09 | A local privilege escalation vlnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with eleva… |
CVE-2024-25639 | Medium | 5.9 | 2024-07-08 | Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's response and user input… |
CVE-2024-39028 | Critical | 9.8 | 2024-07-05 | An issue was discovered in SeaCMS <=12.9 which allows remote attackers to execute arbitrary code via admin_ping.php. |
CVE-2024-36983 | High | 8.0 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an authenticated user coul… |
CVE-2024-36073 | High | 7.2 | 2024-06-27 | Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the shadowing component of th… |
CVE-2024-4578 | High | 8.4 | 2024-06-27 | This Advisory describes an issue that impacts Arista Wireless Access Points. Any entity with the ability to authenticate via SSH to an affected AP as the “conf… |
CVE-2024-39373 | High | 7.2 | 2024-06-27 | TELSAT marKoni FM Transmitters are vulnerable to a command injection vulnerability through the manipulation of settings and could allow an attacker to gain una… |
CVE-2024-4884 | Critical | 9.8 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The Apm.UI.Areas.APM.Contro… |
CVE-2024-4883 | Critical | 9.8 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This vulnerability allows an unauthenticated… |
CVE-2024-6257 | High | 8.4 | 2024-06-25 | HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary… |
CVE-2024-4639 | High | 7.1 | 2024-06-25 | OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in IPSec configuration. An a… |
CVE-2024-4638 | High | 7.1 | 2024-06-25 | OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in the web key upload functi… |
CVE-2024-38903 | Medium | 4.1 | 2024-06-24 | H3C Magic R230 V100R002's udpserver opens port 9034, allowing attackers to execute arbitrary commands. |
CVE-2024-38896 | Medium | 5.3 | 2024-06-24 | WAVLINK WN551K1 found a command injection vulnerability through the start_hour parameter of /cgi-bin/nightled.cgi. |
CVE-2024-38894 | Medium | 5.3 | 2024-06-24 | WAVLINK WN551K1 found a command injection vulnerability through the IP parameter of /cgi-bin/touchlist_sync.cgi. |
CVE-2024-37091 | Critical | 9.9 | 2024-06-24 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in StylemixThemes Consulting Elementor Widgets, StylemixTheme… |
CVE-2024-24551 | High | 8.8 | 2024-06-24 | A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code through the Image API. This vulnerability ar… |
CVE-2024-24550 | High | 8.1 | 2024-06-24 | A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through the File API which… |
CVE-2024-6269 | Medium | 4.7 | 2024-06-23 | A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. This vulnerability affects the function get_ip.addr_details of the file /view/v… |
CVE-2014-5470 | Critical | 9.8 | 2024-06-21 | Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for part of the input data passed to an eval… |
CVE-2024-37642 | Critical | 9.1 | 2024-06-14 | TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a command injection vulnerability via the ipv4_ping, ipv6_ping parameter at /formSystemCheck . |
CVE-2024-35242 | High | 8.8 | 2024-06-10 | Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg reposito… |
CVE-2024-35241 | High | 8.8 | 2024-06-10 | Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages i… |
CVE-2024-37570 | High | 8.8 | 2024-06-09 | On Mitel 6869i 4.5.0.41 devices, the Manual Firmware Update (upgrade.html) page does not perform sanitization on the username and path parameters (sent by an a… |
CVE-2024-37569 | High | 8.8 | 2024-06-09 | An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnerability exists in the hostname parameter… |
CVE-2024-37385 | Critical | 9.8 | 2024-06-07 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists bec… |
CVE-2024-30368 | High | 8.8 | 2024-06-06 | A10 Thunder ADC CsrRequestView Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2024-36604 | Critical | 9.8 | 2024-06-04 | Tenda O3V2 v1.0.0.12(3880) was discovered to contain a Blind Command Injection via stpEn parameter in the SetStp function. This vulnerability allows attackers… |
CVE-2024-34792 | Critical | 9.1 | 2024-06-04 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in dexta Dextaz Ping allows Command Injection.This issue affe… |
CVE-2024-36783 | Critical | 9.8 | 2024-06-03 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection via the host_time parameter in the NTPSyncWithHost function. |
CVE-2024-35401 | Medium | 5.9 | 2024-05-28 | TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile functio… |
CVE-2024-34852 | Medium | 6.3 | 2024-05-28 | F-logic DataCube3 v1.0 is affected by command injection due to improper string filtering at the command execution point in the ./admin/transceiver_schedule.php… |
CVE-2024-35397 | High | 8.8 | 2024-05-28 | TOTOLINK CP900L v4.1.5cu.798_B20221228 weas discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter… |
CVE-2024-5035 | | 2024-05-27 | The affected device expose a network service called "rftest" that is vulnerable to unauthenticated command injection on ports TCP/8888, TCP/8889, and TCP/8890… | |
CVE-2024-5355 | Medium | 6.3 | 2024-05-26 | A vulnerability, which was classified as critical, has been found in anji-plus AJ-Report up to 1.4.1. This issue affects the function IGroovyHandler. The manip… |
CVE-2024-35374 | Critical | 9.8 | 2024-05-24 | Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, allowing remote attackers to execute arbitrary c… |
CVE-2024-35340 | High | 8.6 | 2024-05-24 | Tenda FH1206 V1.2.0.8(8155) was discovered to contain a command injection vulnerability via the cmdinput parameter at ip/goform/formexeCommand. |
CVE-2024-4267 | Critical | 9.8 | 2024-05-22 | A remote code execution (RCE) vulnerability exists in the parisneo/lollms-webui, specifically within the 'open_file' module, version 9.5. The vulnerability ari… |
CVE-2024-5196 | Medium | 4.7 | 2024-05-22 | A vulnerability classified as critical has been found in Arris VAP2500 08.50. This affects an unknown part of the file /tools_command.php. The manipulation of… |
CVE-2024-5195 | Medium | 4.7 | 2024-05-22 | A vulnerability was found in Arris VAP2500 08.50. It has been rated as critical. Affected by this issue is some unknown functionality of the file /diag_s.php… |
CVE-2024-5194 | Medium | 4.7 | 2024-05-22 | A vulnerability was found in Arris VAP2500 08.50. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ass… |
CVE-2024-5023 | | 2024-05-16 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Netflix ConsoleMe allows Command Injection.This issue affe… | |
CVE-2024-1417 | High | 7.8 | 2024-05-16 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in WatchGuard AuthPoint Password Manager on MacOS allows an a… |
CVE-2024-20326 | High | 7.8 | 2024-05-16 | A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to rea… |
CVE-2024-4999 | | 2024-05-16 | A vulnerability in the web-based management interface of multiple Ligowave devices could allow an authenticated remote attacker to execute arbitrary commands w… | |
CVE-2024-4078 | Critical | 9.8 | 2024-05-16 | A vulnerability in the parisneo/lollms, specifically in the `/unInstall_binding` endpoint, allows for arbitrary code execution due to insufficient sanitization… |
CVE-2024-2366 | Critical | 9.0 | 2024-05-16 | A remote code execution vulnerability exists in the parisneo/lollms-webui application, specifically within the reinstall_binding functionality in lollms_core/l… |
CVE-2024-3483 | High | 7.8 | 2024-05-15 | Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger command injection and insecure deserialization issues… |