CWE-77 · Command Injection (page 22)
Page 22 of 39 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6321 | High | 7.2 | 2024-05-15 | A command injection vulnerability exists in the IOCTL that manages OTA updates. A specially crafted command can lead to command execution as the root user. An… |
CVE-2024-34713 | Low | 3.5 | 2024-05-14 | sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.3, any user authori… |
CVE-2024-32355 | High | 8.0 | 2024-05-14 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'password' parameter in the setSSServer function. |
CVE-2024-32354 | Medium | 6.0 | 2024-05-14 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'timeout' parameter in the setSSServer function at… |
CVE-2024-32353 | Critical | 9.8 | 2024-05-14 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'port' parameter in the setSSServer function at /cg… |
CVE-2024-32349 | Medium | 6.0 | 2024-05-14 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mtu" parameters in the… |
CVE-2024-31485 | High | 7.2 | 2024-05-14 | A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.30), SICORE Base system (All versions < V1.3.0). The web inte… |
CVE-2024-28136 | High | 7.8 | 2024-05-14 | A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input validation using the OCPP Remote s… |
CVE-2024-28135 | Medium | 5.0 | 2024-05-14 | A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper… |
CVE-2024-4712 | High | 7.8 | 2024-05-14 | An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific flaw exists within th… |
CVE-2024-34352 | Medium | 6.5 | 2024-05-14 | 1Panel is an open source Linux server operation and maintenance management panel. Prior to v1.10.3-lts, there are many command injections in the project, and… |
CVE-2024-34338 | High | 7.2 | 2024-05-14 | Tenda O3V2 with firmware versions V1.0.0.10 and V1.0.0.12 was discovered to contain a Blind Command Injection via dest parameter in /goform/getTraceroute. This… |
CVE-2024-34218 | Low | 3.8 | 2024-05-14 | TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime… |
CVE-2024-34206 | Medium | 6.5 | 2024-05-14 | TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx… |
CVE-2024-34204 | Critical | 9.8 | 2024-05-14 | TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the setUpgradeFW function via the FileName par… |
CVE-2024-29895 | Critical | 10.0 | 2024-05-14 | Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated u… |
CVE-2024-27818 | High | 7.8 | 2024-05-14 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5. An att… |
CVE-2024-34347 | High | 8.3 | 2024-05-08 | @hoppscotch/cli is a CLI to run Hoppscotch Test Scripts in CI environments. Prior to 0.8.0, the @hoppscotch/js-sandbox package provides a Javascript sandbox th… |
CVE-2024-33113 | Medium | 5.3 | 2024-05-06 | D-LINK DIR-845L <=v1.01KRb03 is vulnerable to Information disclosurey via bsc_sms_inbox.php. |
CVE-2024-33112 | High | 7.5 | 2024-05-06 | D-Link DIR-845L router v1.01KRb03 and before is vulnerable to Command injection via the hnap_main()func. |
CVE-2024-33788 | High | 8.0 | 2024-05-06 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the PinCode parameter at /API/info form endpoint. |
CVE-2024-33789 | Critical | 9.8 | 2024-05-03 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the ipurl parameter at /API/info form endpoint. |
CVE-2023-42128 | High | 8.0 | 2024-05-03 | Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on… |
CVE-2023-39471 | High | 8.8 | 2024-05-03 | TP-Link TL-WR841N ated_tp Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code… |
CVE-2023-38120 | High | 8.8 | 2024-05-03 | Adtran SR400ac ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected ins… |
CVE-2024-22546 | Medium | 6.4 | 2024-04-30 | TRENDnet TEW-815DAP 1.0.2.0 is vulnerable to Command Injection via the do_setNTP function. An authenticated attacker with administrator privileges can leverage… |
CVE-2023-1000 | Medium | 6.3 | 2024-04-27 | A vulnerability was found in cyanomiko dcnnt-py up to 0.9.0. It has been classified as critical. Affected is the function main of the file dcnnt/plugins/notifi… |
CVE-2024-33344 | Critical | 9.8 | 2024-04-26 | D-Link DIR-822+ V1.0.5 was found to contain a command injection in ftext function of upload_firmware.cgi, which allows remote attackers to execute arbitrary co… |
CVE-2024-33342 | High | 7.5 | 2024-04-26 | D-Link DIR-822+ V1.0.5 was found to contain a command injection in SetPlcNetworkpwd function of prog.cgi, which allows remote attackers to execute arbitrary co… |
CVE-2024-32884 | Medium | 6.4 | 2024-04-26 | gitoxide is a pure Rust implementation of Git. `gix-transport` does not check the username part of a URL for text that the external `ssh` program would interpr… |
CVE-2024-32766 | Critical | 10.0 | 2024-04-26 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2024-28328 | Medium | 5.4 | 2024-04-26 | CSV Injection vulnerability in the Asus RT-N12+ router allows administrator users to inject arbitrary commands or formulas in the client name parameter which c… |
CVE-2024-0740 | Critical | 9.8 | 2024-04-26 | Eclipse Target Management: Terminal and Remote System Explorer (RSE) version <= 4.5.400 has a remote code execution vulnerability that does not require authent… |
CVE-2024-3154 | High | 7.2 | 2024-04-26 | A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation… |
CVE-2022-35503 | High | 7.5 | 2024-04-22 | Improper verification of a user input in Open Source MANO v7-v12 allows an authenticated attacker to execute arbitrary code within the LCM module container via… |
CVE-2024-22061 | Critical | 9.8 | 2024-04-19 | A Heap Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to execute arbitrary com… |
CVE-2024-32314 | Low | 3.8 | 2024-04-17 | Tenda AC500 V2.0.1.9(1307) firmware contains a command injection vulnerablility in the formexeCommand function via the cmdinput parameter. |
CVE-2024-32292 | High | 8.8 | 2024-04-17 | Tenda W30E v1.0 V1.0.1.25(633) firmware contains a command injection vulnerablility in the formexeCommand function via the cmdinput parameter. |
CVE-2024-32283 | High | 7.3 | 2024-04-17 | Tenda FH1203 V2.0.1.6 firmware has a command injection vulnerablility in formexeCommand function via the cmdinput parameter. |
CVE-2024-32282 | Medium | 6.3 | 2024-04-17 | Tenda FH1202 v1.2.0.14(408) firmware contains a command injection vulnerablility in the formexeCommand function via the cmdinput parameter. |
CVE-2024-32281 | High | 8.8 | 2024-04-17 | Tenda AC7V1.0 v15.03.06.44 firmware contains a command injection vulnerablility in formexeCommand function via the cmdinput parameter. |
CVE-2023-40146 | Medium | 6.8 | 2024-04-17 | A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted command line argument… |
CVE-2024-3908 | Medium | 6.3 | 2024-04-17 | A vulnerability classified as critical has been found in Tenda AC500 2.0.1.9(1307). Affected is the function formWriteFacMac of the file /goform/WriteFacMac. T… |
CVE-2024-21117 | Medium | 5.3 | 2024-04-16 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). Supported versions that are affected are 8… |
CVE-2024-32027 | Critical | 9.1 | 2024-04-16 | Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss v22.6.1 is vulnerable to command injection in `finetune_gui.py` This vulnerability is fixed i… |
CVE-2024-32026 | Critical | 9.1 | 2024-04-16 | Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a command injection in `git_caption_gui.py`. This vulnerability is fixed in… |
CVE-2024-32025 | Critical | 9.1 | 2024-04-16 | Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a command injection in `group_images_gui.py`. This vulnerability is fixed in… |
CVE-2024-32022 | Critical | 9.1 | 2024-04-16 | Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to command injection in basic_caption_gui.py. This vulnerability is fixed in 2… |
CVE-2024-3871 | Critical | 9.8 | 2024-04-16 | The Delta Electronics DVW-W02W2-E2 devices expose a web administration interface to users. This interface implements multiple features that are affected by com… |
CVE-2024-3271 | Critical | 9.8 | 2024-04-16 | A command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended… |
CVE-2023-33806 | High | 7.8 | 2024-04-15 | Insecure default configurations in Hikvision Interactive Tablet DS-D5B86RB/B V2.3.0 build220119, allows attackers to execute arbitrary commands. |
CVE-2024-30220 | High | 8.8 | 2024-04-15 | Command injection vulnerability in PLANEX COMMUNICATIONS wireless LAN routers allows a network-adjacent unauthenticated attacker to execute an arbitrary comman… |
CVE-2024-3400 | Critical | 10.0 | 2024-04-12 | A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS… |
CVE-2024-29269 | High | 8.8 | 2024-04-10 | An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the Cmd parameter. |
CVE-2024-3566 | Critical | 9.8 | 2024-04-10 | A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function whe… |
CVE-2023-6999 | High | 8.8 | 2024-04-09 | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Remote Code Exxecution via shortcode in all versions up to, and including, 3.0… |
CVE-2024-21322 | High | 7.2 | 2024-04-09 | Microsoft Defender for IoT Remote Code Execution Vulnerability |
CVE-2023-49134 | High | 8.1 | 2024-04-09 | A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0… |
CVE-2023-49133 | High | 8.1 | 2024-04-09 | A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0… |
CVE-2024-31811 | High | 8.0 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the langType parameter in the setLanguageCfg fu… |
CVE-2024-30891 | High | 8.8 | 2024-04-05 | A command injection vulnerability exists in /goform/exeCommand in Tenda AC18 v15.03.05.05, which allows attackers to construct cmdinput parameters for arbitrar… |
CVE-2024-27981 | Critical | 9.8 | 2024-04-04 | A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.0.28 and earlier) allows a mal… |
CVE-2024-3116 | High | 7.4 | 2024-04-04 | pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute… |
CVE-2024-3273 | High | 7.3 | 2024-04-04 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403… |
CVE-2024-30572 | High | 8.0 | 2024-04-03 | Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the ntp_server parameter. |
CVE-2024-22246 | High | 7.4 | 2024-04-02 | VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution. A malicious actor with local acce… |
CVE-2024-29949 | High | 7.2 | 2024-04-02 | There is a command injection vulnerability in some Hikvision NVRs. This could allow an authenticated user with administrative rights to execute arbitrary comma… |
CVE-2024-29435 | Medium | 4.1 | 2024-04-01 | An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter. |
CVE-2023-41724 | High | 8.8 | 2024-03-31 | A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operatin… |
CVE-2024-30637 | High | 8.8 | 2024-03-29 | Tenda F1202 v1.2.0.20(408) has a command injection vulnerablility in the formWriteFacMac function in the mac parameter. |
CVE-2024-2947 | High | 7.3 | 2024-03-28 | A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in… |
CVE-2024-25955 | High | 7.2 | 2024-03-28 | Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could potentially exploit this vulnerability lea… |
CVE-2024-25946 | High | 7.2 | 2024-03-28 | Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could potentially exploit this vulnerability lea… |
CVE-2024-3009 | Medium | 6.3 | 2024-03-28 | A vulnerability has been found in Tenda FH1205 2.0.0.7(775) and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the f… |
CVE-2024-2991 | Medium | 6.3 | 2024-03-27 | A vulnerability has been found in Tenda FH1203 2.0.1.6 and classified as critical. This vulnerability affects the function formWriteFacMac of the file /goform/… |
CVE-2024-29946 | High | 8.1 | 2024-03-27 | In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub lacks protections for risky SPL commands. This could let attackers bypa… |
CVE-2024-2982 | Medium | 5.5 | 2024-03-27 | A vulnerability has been found in Tenda FH1202 1.2.0.14(408) and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the… |
CVE-2024-1540 | High | 8.2 | 2024-03-27 | A command injection vulnerability exists in the deploy+test-visual.yml workflow of the gradio-app/gradio repository, due to improper neutralization of special… |
CVE-2024-28545 | Critical | 9.8 | 2024-03-26 | Tenda AC18 V15.03.05.05 contains a command injection vulnerablility in the deviceName parameter of formsetUsbUnload function. |
CVE-2023-52624 | High | 7.8 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Wake DMCUB before executing GPINT commands [Why] DMCUB can be in idle wh… |
CVE-2024-24897 | High | 8.1 | 2024-03-25 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in openEuler A-Tune-Collector on Linux allows Command Injecti… |
CVE-2024-28041 | High | 8.8 | 2024-03-25 | HGW BL1500HM Ver 002.001.013 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary command. |
CVE-2024-29385 | Critical | 9.0 | 2024-03-22 | DIR-845L router <= v1.01KRb03 has an Unauthenticated remote code execution vulnerability in the cgibin binary via soapcgi_main function. |
CVE-2024-29366 | High | 8.8 | 2024-03-22 | A command injection vulnerability exists in the cgibin binary in DIR-845L router firmware <= v1.01KRb03. |
CVE-2024-29864 | Critical | 9.8 | 2024-03-21 | Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables. |
CVE-2024-2642 | High | 7.3 | 2024-03-19 | A vulnerability was found in Ruijie RG-NBS2009G-P up to 20240305. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2023-41334 | High | 8.4 | 2024-03-18 | Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vuln… |
CVE-2024-28354 | Critical | 10.0 | 2024-03-15 | There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post reque… |
CVE-2024-28353 | High | 8.8 | 2024-03-15 | There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post reque… |
CVE-2024-25228 | High | 8.8 | 2024-03-14 | Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler… |
CVE-2024-26204 | High | 7.5 | 2024-03-12 | Outlook for Android Information Disclosure Vulnerability |
CVE-2024-25998 | High | 7.3 | 2024-03-12 | An unauthenticated remote attacker can perform a command injection in the OCPP Service with limited privileges due to improper input validation. |
CVE-2024-22127 | Critical | 9.1 | 2024-03-12 | SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous… |
CVE-2024-2352 | Medium | 6.3 | 2024-03-10 | A vulnerability, which was classified as critical, has been found in 1Panel up to 1.10.1-lts. Affected by this issue is the function baseApi.UpdateDeviceSwap o… |
CVE-2024-25951 | High | 8.0 | 2024-03-09 | A command injection vulnerability exists in local RACADM. A malicious authenticated user could gain control of the underlying operating system. |
CVE-2024-23247 | High | 7.8 | 2024-03-08 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. Processing a file… |
CVE-2024-0817 | High | 7.8 | 2024-03-07 | Command injection in IrGraph.draw in paddlepaddle/paddle 2.6.0 |
CVE-2024-25613 | High | 7.2 | 2024-03-05 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2024-25612 | High | 7.2 | 2024-03-05 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2024-25611 | High | 7.2 | 2024-03-05 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |