CWE-77 · Command Injection (page 22)
Page 22 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-49237 | Critical | 9.8 | 2024-01-09 | An issue was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Command injection can occur because the system function is used by davinci to unpack lang… |
CVE-2024-21663 | Critical | 9.9 | 2024-01-09 | Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord-Recon is vulnerabl… |
CVE-2024-0291 | Medium | 6.3 | 2024-01-08 | A vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130. It has been rated as critical. This issue affects the function UploadFirmwareFile of the… |
CVE-2023-47560 | High | 7.4 | 2024-01-05 | An OS command injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to execute commands… |
CVE-2023-51812 | Critical | 9.8 | 2024-01-04 | Tenda AX3 v16.03.12.11 was discovered to contain a remote code execution (RCE) vulnerability via the list parameter at /goform/SetNetControlList. |
CVE-2023-52137 | High | 7.7 | 2023-12-29 | The [`tj-actions/verify-changed-files`](https://github.com/tj-actions/verify-changed-files) action allows for command injection in changed filenames, allowing… |
CVE-2023-50445 | High | 7.8 | 2023-12-28 | Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7… |
CVE-2023-51664 | High | 7.3 | 2023-12-27 | tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command… |
CVE-2023-49226 | High | 7.2 | 2023-12-25 | An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin… |
CVE-2023-51016 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the setRebootScheCfg interface of the cstecgi .cgi. |
CVE-2023-51014 | Critical | 9.8 | 2023-12-22 | TOTOLINK EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanSecDns parameter’ of the setLanConfig interface of… |
CVE-2023-51025 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to an unauthorized arbitrary command execution in the ‘admuser’ parameter of the setPasswordCfg interfac… |
CVE-2023-51707 | Critical | 9.8 | 2023-12-22 | MotionPro in Array ArrayOS AG before 9.4.0.505 on AG and vxAG allows remote command execution via crafted packets. AG and vxAG 9.3.0.259.x are unaffected. |
CVE-2023-50989 | Critical | 9.8 | 2023-12-20 | Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the pingSet function. |
CVE-2023-50983 | Critical | 9.8 | 2023-12-20 | Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the sysScheduleRebootSet function. |
CVE-2023-6940 | High | 8.8 | 2023-12-19 | with only one user interaction(download a malicious config), attackers can gain full command execution on the victim system. |
CVE-2023-39509 | High | 7.2 | 2023-12-18 | A command injection vulnerability exists in Bosch IP cameras that allows an authenticated user with administrative rights to run arbitrary commands on the OS o… |
CVE-2023-6848 | High | 7.3 | 2023-12-16 | A vulnerability was found in kalcaddle kodbox up to 1.48. It has been declared as critical. Affected by this vulnerability is the function check of the file pl… |
CVE-2023-50917 | Critical | 9.8 | 2023-12-15 | MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mail… |
CVE-2023-50089 | Critical | 9.8 | 2023-12-15 | A Command Injection vulnerability exists in NETGEAR WNR2000v4 version 1.0.0.70. When using HTTP for SOAP authentication, command execution occurs during the pr… |
CVE-2023-49898 | High | 7.2 | 2023-12-15 | In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. all… |
CVE-2023-6572 | High | 8.1 | 2023-12-14 | Command Injection in GitHub repository gradio-app/gradio prior to main. |
CVE-2023-25643 | High | 8.4 | 2023-12-14 | There is a command injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of multiple network parameters, an aut… |
CVE-2023-48702 | High | 7.2 | 2023-12-13 | Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the `/System/MediaEncoder/Path` endpoint executes an arbitrary file using `Pro… |
CVE-2023-48791 | High | 8.8 | 2023-12-13 | An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in FortiPortal version 7.2.0, version 7.0.6 and b… |
CVE-2023-47576 | High | 8.8 | 2023-12-13 | An issue was discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices, allowing authenticated command injection through the web interface. |
CVE-2013-2513 | Critical | 9.8 | 2023-12-12 | The flash_tool gem through 0.6.0 for Ruby allows command execution via shell metacharacters in the name of a downloaded file. |
CVE-2023-49587 | Medium | 6.4 | 2023-12-12 | SAP Solution Manager - version 720, allows an authorized attacker to execute certain deprecated function modules which can read or modify data of same or other… |
CVE-2023-40301 | Critical | 9.8 | 2023-12-07 | NETSCOUT nGeniusPULSE 3.8 has a Command Injection Vulnerability. |
CVE-2023-49436 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList. |
CVE-2023-49435 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 is vulnerable to command injection. |
CVE-2023-49431 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName. |
CVE-2023-49437 | Critical | 9.8 | 2023-12-07 | Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList. |
CVE-2023-49428 | Critical | 9.8 | 2023-12-07 | Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName. |
CVE-2023-24046 | Medium | 6.8 | 2023-12-04 | An issue was discovered on Connectize AC21000 G6 641.139.1.1256 allows attackers to run arbitrary commands via use of a crafted string in the ping utility. |
CVE-2023-48801 | Critical | 9.8 | 2023-12-01 | In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_415534 function obtains fields from the front-end, connects them through the snprintf f… |
CVE-2023-48842 | Critical | 9.8 | 2023-12-01 | D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at hedwig.cgi. |
CVE-2023-43455 | Critical | 9.8 | 2023-12-01 | An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the command parameter of t… |
CVE-2023-43454 | Critical | 9.8 | 2023-12-01 | An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the hostName parameter of… |
CVE-2023-43453 | Critical | 9.8 | 2023-12-01 | An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the IP parameter of the se… |
CVE-2023-6071 | High | 8.4 | 2023-11-30 | An Improper Neutralization of Special Elements used in a command vulnerability in ESM prior to version 11.6.9 allows a remote administrator to execute arbitra… |
CVE-2023-49040 | Critical | 9.8 | 2023-11-27 | An issue in Tneda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the adslPwd parameter in the form_fast_setting_internet_set function. |
CVE-2023-49213 | High | 8.8 | 2023-11-23 | The API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary commands via crafted HTTP requests if a param… |
CVE-2023-49210 | Critical | 9.8 | 2023-11-23 | The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and accepts an opts argu… |
CVE-2023-45625 | High | 7.2 | 2023-11-14 | Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ab… |
CVE-2023-42326 | High | 8.8 | 2023-11-14 | An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_… |
CVE-2023-47253 | Critical | 9.8 | 2023-11-06 | Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.php gridValoresPopHid… |
CVE-2023-23369 | Critical | 9.0 | 2023-11-03 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2023-20220 | High | 7.2 | 2023-11-01 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2023-20219 | High | 7.2 | 2023-11-01 | Multiple vulnerabilities in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to e… |
CVE-2023-20170 | Medium | 6.0 | 2023-11-01 | A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the underlying operati… |
CVE-2023-46485 | Critical | 9.8 | 2023-10-31 | An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setTracerouteCfg function of the stecgi.cgi compo… |
CVE-2023-46484 | Critical | 9.8 | 2023-10-31 | An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setLedCfg function. |
CVE-2023-46993 | Critical | 9.8 | 2023-10-31 | In TOTOLINK A3300R V17.0.0cu.557_B20221024 when dealing with setLedCfg request, there is no verification for the enable parameter, which can lead to command in… |
CVE-2023-46979 | Critical | 9.8 | 2023-10-31 | TOTOLINK X6000R V9.4.0cu.852_B20230719 was discovered to contain a command injection vulnerability via the enable parameter in the setLedCfg function. |
CVE-2023-46976 | Critical | 9.8 | 2023-10-31 | TOTOLINK A3300R 17.0.0cu.557_B20221024 contains a command injection via the file_name parameter in the UploadFirmwareFile function. |
CVE-2023-47104 | Critical | 9.8 | 2023-10-30 | tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign) in titles, messages, and other input d… |
CVE-2023-43322 | High | 8.8 | 2023-10-28 | ZPE Systems, Inc Nodegrid OS v5.0.0 to v5.0.17, v5.2.0 to v5.2.19, v5.4.0 to v5.4.16, v5.6.0 to v5.6.13, v5.8.0 to v5.8.10, and v5.10.0 to v5.10.3 was discover… |
CVE-2023-45498 | Critical | 9.8 | 2023-10-27 | VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability. |
CVE-2023-46424 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_422BD4 function. |
CVE-2023-46423 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_417094 function. |
CVE-2023-46422 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411994 function. |
CVE-2023-46421 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411D00 function. |
CVE-2023-46420 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41590C function. |
CVE-2023-46419 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415730 function. |
CVE-2023-46418 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_412688 function. |
CVE-2023-46417 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415498 function. |
CVE-2023-46416 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ The 41A414 function. |
CVE-2023-46415 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41E588 function. |
CVE-2023-46414 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ 41D494 function. |
CVE-2023-46413 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_4155DC function. |
CVE-2023-46412 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_41D998 function. |
CVE-2023-46411 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_415258 function. |
CVE-2023-46410 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 416F60 function. |
CVE-2023-46409 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ 41CC04 function. |
CVE-2023-46408 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 41DD80 function. |
CVE-2023-5752 | Medium | 5.5 | 2023-10-25 | When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inje… |
CVE-2023-46574 | Critical | 9.8 | 2023-10-25 | An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile func… |
CVE-2023-46370 | Critical | 9.8 | 2023-10-25 | Tenda W18E V16.01.0.8(1576) has a command injection vulnerability via the hostName parameter in the formSetNetCheckTools function. |
CVE-2023-43510 | Medium | 4.7 | 2023-10-25 | A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying ho… |
CVE-2023-38193 | High | 8.8 | 2023-10-21 | An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Remote Code Execution via a crafted sendmail command line. |
CVE-2023-21413 | Critical | 9.1 | 2023-10-16 | GoSecure on behalf of Genetec Inc. has found a flaw that allows for a remote code execution during the installation of ACAP applications on the Axis device. Th… |
CVE-2023-36954 | Critical | 9.8 | 2023-10-16 | TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection. |
CVE-2023-36953 | Critical | 9.8 | 2023-10-16 | TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection. |
CVE-2023-26155 | High | 7.3 | 2023-10-14 | All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize its parameter input… |
CVE-2023-45852 | Critical | 9.8 | 2023-10-14 | In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharact… |
CVE-2023-45466 | Critical | 9.8 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the pin_host parameter in the WPS Settings. |
CVE-2023-45465 | Critical | 9.8 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ddnsDomainName parameter in the Dynamic DNS settings. |
CVE-2023-32632 | High | 8.8 | 2023-10-11 | A command execution vulnerability exists in the validate.so diag_ping_start functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can… |
CVE-2023-26320 | High | 7.5 | 2023-10-11 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection. |
CVE-2023-26319 | Medium | 6.7 | 2023-10-11 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection. |
CVE-2023-36415 | High | 8.8 | 2023-10-10 | Azure Identity SDK Remote Code Execution Vulnerability |
CVE-2023-36414 | High | 8.8 | 2023-10-10 | Azure Identity SDK Remote Code Execution Vulnerability |
CVE-2023-45208 | High | 8.8 | 2023-10-10 | A command injection in the parsing_xml_stasurvey function inside libcgifunc.so of the D-Link DAP-X1860 repeater 1.00 through 1.01b05-01 allows attackers (withi… |
CVE-2023-44959 | High | 8.8 | 2023-10-10 | An issue found in D-Link DSL-3782 v.1.03 and before allows remote authenticated users to execute arbitrary code as root via the Router IP Address fields of the… |
CVE-2023-44827 | High | 8.8 | 2023-10-10 | An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execute arbitrary code v… |
CVE-2023-45356 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 4000 and Manager Platform V10 R1 before Hotfix V10 R1.42.2 allow command injection by an au… |
CVE-2023-45355 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 and 4000 and Manager Platform V10 R1 before Hotfix V10 R1.42.2 allow command injection by a… |
CVE-2023-45351 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.1, 4000 Assistant V10 R0, 4000 Manager V10 R1 before V10 R1.42.1, and 4000 Manager V10 R0 allow Aut… |
CVE-2023-4401 | High | 7.8 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contains an OS Command Injection Vulnerability in the CLI use of the ‘more’ command. A local or remote au… |