CWE-77 · Command Injection (page 23)
Page 23 of 39 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-1356 | High | 7.2 | 2024-03-05 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-51835 | Medium | 6.8 | 2024-02-29 | An issue in TRENDnet TEW-822DRE v.1.03B02 allows a local attacker to execute arbitrary code via the parameters ipv4_ping in the /boafrm/formSystemCheck. |
CVE-2024-26298 | High | 7.2 | 2024-02-27 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2024-26297 | High | 7.2 | 2024-02-27 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2024-26296 | High | 7.2 | 2024-02-27 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2024-26295 | High | 7.2 | 2024-02-27 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2024-26294 | High | 7.2 | 2024-02-27 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2024-22544 | High | 8.0 | 2024-02-27 | An issue was discovered in Linksys Router E1700 version 1.0.04 (build 3), allows authenticated attackers to execute arbitrary code via the setDateTime function. |
CVE-2024-25082 | Medium | 6.5 | 2024-02-26 | Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files. |
CVE-2024-25081 | Medium | 4.2 | 2024-02-26 | Splinefont in FontForge through 20230101 allows command injection via crafted filenames. |
CVE-2023-49959 | Critical | 9.8 | 2024-02-26 | In Indo-Sol PROFINET-INspektor NT through 2.4.0, a command injection vulnerability in the gedtupdater service of the firmware allows remote attackers to execut… |
CVE-2024-1781 | Medium | 6.3 | 2024-02-23 | A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_20230719. It has been rated as critical. This issue affects the function setWizardCfg of the fi… |
CVE-2024-25850 | Critical | 9.8 | 2024-02-22 | Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the wps_ap_ssid5g parameter |
CVE-2023-24331 | Critical | 9.8 | 2024-02-21 | Command Injection vulnerability in D-Link Dir 816 with firmware version DIR-816_A2_v1.10CNB04 allows attackers to run arbitrary commands via the urlAdd paramet… |
CVE-2023-24330 | High | 8.8 | 2024-02-21 | Command Injection vulnerability in D-Link Dir 882 with firmware version DIR882A1_FW130B06 allows attackers to run arbitrary commands via crafted POST request t… |
CVE-2024-23346 | Critical | 9.3 | 2024-02-21 | Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTra… |
CVE-2024-24377 | Critical | 9.8 | 2024-02-16 | An issue in idocv v.14.1.3_20231228 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted script. |
CVE-2024-24301 | High | 8.8 | 2024-02-14 | Command Injection vulnerability discovered in 4ipnet EAP-767 device v3.42.00 within the web interface of the device allows attackers with valid credentials to… |
CVE-2024-22093 | High | 8.7 | 2024-02-14 | When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed systems… |
CVE-2024-1378 | Critical | 9.1 | 2024-02-13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-1374 | Critical | 9.1 | 2024-02-13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-1372 | Critical | 9.1 | 2024-02-13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-1369 | Critical | 9.1 | 2024-02-13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-1359 | Critical | 9.1 | 2024-02-13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-1355 | Critical | 9.1 | 2024-02-13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-1354 | High | 8.0 | 2024-02-13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-20667 | High | 7.5 | 2024-02-13 | Azure DevOps Server Remote Code Execution Vulnerability |
CVE-2023-47218 | Medium | 5.8 | 2024-02-13 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2024-23749 | High | 7.8 | 2024-02-09 | KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitization and validation… |
CVE-2023-49716 | Medium | 6.9 | 2024-02-09 | In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an authenticated user with network access could run arbitrary commands from a remote computer. |
CVE-2023-46687 | Critical | 9.8 | 2024-02-09 | In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could execute arbitrary commands in root context f… |
CVE-2023-40263 | High | 8.8 | 2024-02-08 | An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows authenticated command injection via ftp. |
CVE-2024-24321 | Critical | 9.8 | 2024-02-08 | An issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4_ssid_2 parameter in the sub_42DA54 function. |
CVE-2024-24216 | Critical | 9.8 | 2024-02-08 | Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/module/repo/model.ph… |
CVE-2024-23049 | Critical | 9.8 | 2024-02-05 | An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component. |
CVE-2024-22107 | High | 7.2 | 2024-02-02 | An issue was discovered in GTB Central Console 15.17.1-30814.NG. The method systemSettingsDnsDataAction at /opt/webapp/src/AppBundle/Controller/React/SystemSet… |
CVE-2023-47562 | High | 7.4 | 2024-02-02 | An OS command injection vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated users to execute com… |
CVE-2023-45025 | Critical | 9.0 | 2024-02-02 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2023-41283 | Medium | 5.5 | 2024-02-02 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2023-41282 | Medium | 5.5 | 2024-02-02 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2023-41281 | Medium | 5.5 | 2024-02-02 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2024-22903 | High | 8.8 | 2024-02-02 | Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK function. |
CVE-2024-22900 | High | 8.8 | 2024-02-02 | Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function. |
CVE-2024-0325 | Low | 3.6 | 2024-02-01 | In Helix Sync versions prior to 2024.1, a local command injection was identified. Reported by Bryan Riggins. |
CVE-2024-23745 | Critical | 9.8 | 2024-01-31 | In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, e… |
CVE-2024-21488 | High | 7.3 | 2024-01-30 | Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitiza… |
CVE-2024-0920 | High | 7.2 | 2024-01-26 | A vulnerability was found in TRENDnet TEW-822DRE 1.03B02. It has been declared as critical. This vulnerability affects unknown code of the file /admin_ping.htm… |
CVE-2024-0919 | High | 8.8 | 2024-01-26 | A vulnerability was found in TRENDnet TEW-815DAP 1.0.2.0. It has been classified as critical. This affects the function do_setNTP of the component POST Request… |
CVE-2024-22545 | High | 7.8 | 2024-01-26 | An issue was discovered in TRENDnet TEW-824DRU version 1.04b01, allows unauthenticated attackers to execute arbitrary code via the system.ntp.server parameter… |
CVE-2024-23628 | Critical | 9.0 | 2024-01-26 | A command injection vulnerability exists in the 'SaveStaticRouteIPv6Params' parameter of the Motorola MR2600. A remote attacker can exploit this vulnerabilit… |
CVE-2024-23627 | Critical | 9.0 | 2024-01-26 | A command injection vulnerability exists in the 'SaveStaticRouteIPv4Params' parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability… |
CVE-2024-23626 | Critical | 9.0 | 2024-01-26 | A command injection vulnerability exists in the ‘SaveSysLogParams’ parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability to achi… |
CVE-2024-23625 | Critical | 9.6 | 2024-01-26 | A command injection vulnerability exists in D-Link DAP-1650 devices when handling UPnP SUBSCRIBE messages. An unauthenticated attacker can exploit this vulnera… |
CVE-2024-23624 | Critical | 9.6 | 2024-01-26 | A command injection vulnerability exists in the gena.cgi module of D-Link DAP-1650 devices. An unauthenticated attacker can exploit this vulnerability to gain… |
CVE-2023-51833 | High | 8.1 | 2024-01-25 | A command injection issue in TRENDnet TEW-411BRPplus v.2.07_eu that allows a local attacker to execute arbitrary code via the data1 parameter in the debug.cgi… |
CVE-2023-7227 | Critical | 9.8 | 2024-01-25 | SystemK NVR 504/508/516 versions 2.3.5SK.30084998 and prior are vulnerable to a command injection vulnerability in the dynamic domain name system (DDNS) setti… |
CVE-2024-22529 | Critical | 9.8 | 2024-01-25 | TOTOLINK X2000R_V2 V2.0.0-B20230727.10434 has a command injection vulnerability in the sub_449040 (handle function of formUploadFile) of /bin/boa. |
CVE-2024-22729 | Critical | 9.8 | 2024-01-25 | NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page. |
CVE-2023-52040 | Critical | 9.8 | 2024-01-24 | An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_41284C function. |
CVE-2023-52039 | Critical | 9.8 | 2024-01-24 | An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415AA4 function. |
CVE-2023-52038 | Critical | 9.8 | 2024-01-24 | An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415C80 function. |
CVE-2023-51887 | Critical | 9.8 | 2024-01-24 | Command Injection vulnerability in Mathtex v.1.05 and before allows a remote attacker to execute arbitrary code via crafted string in application URL. |
CVE-2024-22651 | Critical | 9.8 | 2024-01-24 | There is a command injection vulnerability in the ssdpcgi_main function of cgibin binary in D-Link DIR-815 router firmware v1.04. |
CVE-2023-50274 | High | 7.8 | 2024-01-23 | HPE OneView may allow command injection with local privilege escalation. |
CVE-2024-22663 | Critical | 9.8 | 2024-01-23 | TOTOLINK_A3700R_V9.1.2u.6165_20211012has a command Injection vulnerability via setOpModeCfg |
CVE-2023-24135 | High | 7.8 | 2024-01-22 | Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a command injection vulnerability in the function formWriteFacMac. This vulnerabil… |
CVE-2024-20287 | Medium | 6.5 | 2024-01-17 | A vulnerability in the web-based management interface of the Cisco WAP371 Wireless-AC/N Dual Radio Access Point (AP) with Single Point Setup could allow an aut… |
CVE-2023-52042 | Critical | 9.8 | 2024-01-16 | An issue discovered in sub_4117F8 function in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the 'lang' parameter. |
CVE-2024-0507 | Medium | 6.5 | 2024-01-16 | An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Ma… |
CVE-2024-0579 | Medium | 6.3 | 2024-01-16 | A vulnerability classified as critical was found in Totolink X2000R 1.0.0-B20221212.1452. Affected by this vulnerability is the function formMapDelDevice of th… |
CVE-2023-4797 | High | 7.2 | 2024-01-16 | The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, whi… |
CVE-2023-42136 | High | 7.8 | 2024-01-15 | PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow the execution of arbitrary commands with system account pr… |
CVE-2024-21887 | Critical | 9.1 | 2024-01-12 | A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administ… |
CVE-2024-22198 | High | 7.1 | 2024-01-11 | Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration settings. The `Home >… |
CVE-2024-22197 | High | 7.7 | 2024-01-11 | Nginx-ui is online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time. The `Home > Preference` page… |
CVE-2023-6634 | High | 8.1 | 2024-01-11 | The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. This is due… |
CVE-2023-52027 | Critical | 9.8 | 2024-01-11 | TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the NTPSyncWithHost function. |
CVE-2023-51126 | Critical | 9.8 | 2024-01-10 | Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter. NOTE: The ven… |
CVE-2023-51972 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 was discovered to contain a command injection vulnerability via the function fromAdvSetLanIp. |
CVE-2023-31446 | Critical | 9.8 | 2024-01-10 | In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. This leads to inject… |
CVE-2024-20676 | High | 8.0 | 2024-01-09 | Azure Storage Mover Remote Code Execution Vulnerability |
CVE-2023-49237 | Critical | 9.8 | 2024-01-09 | An issue was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Command injection can occur because the system function is used by davinci to unpack lang… |
CVE-2024-21663 | Critical | 9.9 | 2024-01-09 | Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord-Recon is vulnerabl… |
CVE-2024-0291 | Medium | 6.3 | 2024-01-08 | A vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130. It has been rated as critical. This issue affects the function UploadFirmwareFile of the… |
CVE-2023-47560 | High | 7.4 | 2024-01-05 | An OS command injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to execute commands… |
CVE-2023-51812 | Critical | 9.8 | 2024-01-04 | Tenda AX3 v16.03.12.11 was discovered to contain a remote code execution (RCE) vulnerability via the list parameter at /goform/SetNetControlList. |
CVE-2023-52137 | High | 7.7 | 2023-12-29 | The [`tj-actions/verify-changed-files`](https://github.com/tj-actions/verify-changed-files) action allows for command injection in changed filenames, allowing… |
CVE-2023-50445 | High | 7.8 | 2023-12-28 | Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7… |
CVE-2023-51664 | High | 7.3 | 2023-12-27 | tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command… |
CVE-2023-49226 | High | 7.2 | 2023-12-25 | An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin… |
CVE-2023-51016 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the setRebootScheCfg interface of the cstecgi .cgi. |
CVE-2023-51014 | Critical | 9.8 | 2023-12-22 | TOTOLINK EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanSecDns parameter’ of the setLanConfig interface of… |
CVE-2023-51025 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to an unauthorized arbitrary command execution in the ‘admuser’ parameter of the setPasswordCfg interfac… |
CVE-2023-51707 | Critical | 9.8 | 2023-12-22 | MotionPro in Array ArrayOS AG before 9.4.0.505 on AG and vxAG allows remote command execution via crafted packets. AG and vxAG 9.3.0.259.x are unaffected. |
CVE-2023-50989 | Critical | 9.8 | 2023-12-20 | Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the pingSet function. |
CVE-2023-50983 | Critical | 9.8 | 2023-12-20 | Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the sysScheduleRebootSet function. |
CVE-2023-6940 | High | 8.8 | 2023-12-19 | with only one user interaction(download a malicious config), attackers can gain full command execution on the victim system. |
CVE-2023-39509 | High | 7.2 | 2023-12-18 | A command injection vulnerability exists in Bosch IP cameras that allows an authenticated user with administrative rights to run arbitrary commands on the OS o… |
CVE-2023-6848 | High | 7.3 | 2023-12-16 | A vulnerability was found in kalcaddle kodbox up to 1.48. It has been declared as critical. Affected by this vulnerability is the function check of the file pl… |
CVE-2023-50917 | Critical | 9.8 | 2023-12-15 | MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mail… |