CWE-77 · Command Injection (page 23)
Page 23 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-43891 | Critical | 9.8 | 2023-10-02 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the Changing Username and Password function. This vulnerability is exploi… |
CVE-2023-26145 | High | 7.4 | 2023-09-28 | This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept… |
CVE-2023-41303 | High | 7.5 | 2023-09-25 | Command injection vulnerability in the distributed file system module. Successful exploitation of this vulnerability may cause variables in the sock structure… |
CVE-2023-41031 | High | 8.0 | 2023-09-22 | Command injection in homemng.htm in Juplink RX4-1500 versions V1.0.2, V1.0.3, V1.0.4, and V1.0.5 allows remote authenticated attackers to execute commands via… |
CVE-2023-41029 | High | 8.0 | 2023-09-22 | Command injection vulnerability in the homemng.htm endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.2, V1.0.3, V1.0.4, and V1.0.5 allows authent… |
CVE-2023-43128 | Critical | 9.8 | 2023-09-21 | D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of HTTP_ST parameters. |
CVE-2023-42810 | Critical | 9.8 | 2023-09-21 | systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem was fixed… |
CVE-2023-43138 | High | 8.8 | 2023-09-20 | TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds NAPT rules after authentication, and the rule… |
CVE-2023-43137 | High | 8.8 | 2023-09-20 | TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds ACL rules after authentication, and the rule n… |
CVE-2023-43207 | Critical | 9.8 | 2023-09-20 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function config_upload_handler. This vulnerability allows… |
CVE-2023-43206 | Critical | 9.8 | 2023-09-20 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function web_cert_download_handler. This vulnerability all… |
CVE-2023-43204 | Critical | 9.8 | 2023-09-20 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub_2EF50. This vulnerability allows attackers to… |
CVE-2023-43202 | Critical | 9.8 | 2023-09-20 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function pcap_download_handler. This vulnerability allows… |
CVE-2023-43477 | Medium | 6.8 | 2023-09-20 | The ping_from parameter of ping_tracerte.cgi in the web UI of Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, was not properly sanit… |
CVE-2023-33831 | Critical | 9.8 | 2023-09-18 | A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST… |
CVE-2023-34999 | High | 8.4 | 2023-09-18 | A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 (< 5.7.6) and v6 (< 6.5.0) that allows an attacker to perform arbitra… |
CVE-2023-39638 | Critical | 9.8 | 2023-09-14 | D-LINK DIR-859 A1 1.05 and A1 1.06B01 Beta01 was discovered to contain a command injection vulnerability via the lxmldbc_system function at /htdocs/cgibin. |
CVE-2023-41011 | Critical | 9.8 | 2023-09-14 | Command Execution vulnerability in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary c… |
CVE-2023-36642 | Medium | 6.7 | 2023-09-13 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiTester 3.0.0 through 7.2.3 may… |
CVE-2023-3710 | Critical | 9.9 | 2023-09-12 | Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions p… |
CVE-2023-36805 | High | 7.0 | 2023-09-12 | Windows MSHTML Platform Security Feature Bypass Vulnerability |
CVE-2023-33136 | High | 8.8 | 2023-09-12 | Azure DevOps Server Remote Code Execution Vulnerability |
CVE-2023-39637 | Critical | 9.8 | 2023-09-12 | D-Link DIR-816 A2 1.10 B05 was discovered to contain a command injection vulnerability via the component /goform/Diagnosis. |
CVE-2023-38829 | High | 8.8 | 2023-09-11 | An issue in NETIS SYSTEMS WF2409E v.3.6.42541 allows a remote attacker to execute arbitrary code via the ping and traceroute functions of the diagnostic tools… |
CVE-2023-39362 | High | 7.2 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can… |
CVE-2023-4310 | Critical | 9.8 | 2023-09-05 | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions 23.2.1 and 23.2.2 contain a command injection vulnerability which can be exploited… |
CVE-2023-40598 | High | 8.5 | 2023-08-30 | In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can… |
CVE-2023-38027 | Critical | 9.8 | 2023-08-28 | SpotCam Co., Ltd. SpotCam Sense’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulne… |
CVE-2023-40796 | High | 7.8 | 2023-08-25 | Phicomm k2 v22.6.529.216 was discovered to contain a command injection vulnerability via the function luci.sys.call. |
CVE-2023-25649 | Medium | 6.8 | 2023-08-25 | There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authe… |
CVE-2023-37469 | High | 8.8 | 2023-08-24 | CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled S… |
CVE-2023-39834 | Critical | 9.8 | 2023-08-24 | PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via create_function. |
CVE-2023-4212 | Medium | 6.8 | 2023-08-22 | A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root usin… |
CVE-2023-23564 | High | 8.8 | 2023-08-22 | An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to execute commands. |
CVE-2020-22570 | High | 7.5 | 2023-08-22 | Memcached 1.6.0 before 1.6.3 allows remote attackers to cause a denial of service (daemon crash) via a crafted meta command. |
CVE-2023-39618 | Critical | 9.8 | 2023-08-21 | TOTOLINK X5000R B20210419 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg interface. |
CVE-2023-39617 | Critical | 9.8 | 2023-08-21 | TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were discovered to contain a remote code execution (RCE) vulnerability via the lang… |
CVE-2023-39809 | Critical | 9.8 | 2023-08-21 | N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain an OS command injection vulnerability via shell metacharacters in the system_hostname parameter… |
CVE-2023-4414 | Medium | 6.3 | 2023-08-18 | A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230807. It has been declared as critical. Affected by this vulnerability is an unkno… |
CVE-2023-38902 | High | 8.8 | 2023-08-17 | A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG… |
CVE-2023-2910 | High | 8.8 | 2023-08-17 | Improper neutralization of special elements used in a command ('Command Injection') vulnerability in Printer service functionality in ASUSTOR Data Master (ADM)… |
CVE-2023-34215 | High | 7.2 | 2023-08-17 | TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validat… |
CVE-2023-34214 | High | 7.2 | 2023-08-17 | TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. Th… |
CVE-2023-34213 | High | 8.8 | 2023-08-17 | TN-5900 Series firmware versions v3.3 and prior are vulnerable to command-injection vulnerability. This vulnerability stems from insufficient input validation… |
CVE-2023-33239 | High | 8.8 | 2023-08-17 | TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. Th… |
CVE-2023-33238 | High | 7.2 | 2023-08-17 | TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. Th… |
CVE-2023-20237 | Medium | 4.3 | 2023-08-16 | A vulnerability in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access internal HTTP services that are otherwise ina… |
CVE-2023-20017 | Medium | 6.5 | 2023-08-16 | Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary commands using root-l… |
CVE-2023-20013 | Medium | 6.5 | 2023-08-16 | Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary commands using root-l… |
CVE-2023-20209 | Medium | 6.5 | 2023-08-16 | A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authent… |
CVE-2023-38866 | Critical | 9.8 | 2023-08-15 | COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_415588. Attackers can send POST request messages to /usr/bin/webmgnt and… |
CVE-2023-38864 | Critical | 9.8 | 2023-08-15 | An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the protal_delete_picname parameter in the sub_41171C function at bin/webm… |
CVE-2023-38865 | Critical | 9.8 | 2023-08-15 | COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_4143F0. Attackers can send POST request messages to /usr/bin/webmgnt and… |
CVE-2023-38863 | Critical | 9.8 | 2023-08-15 | An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the ifname and mac parameters in the sub_410074 function at bin/webmgnt. |
CVE-2023-38862 | Critical | 9.8 | 2023-08-15 | An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the destination parameter of sub_431F64 function in bin/webmgnt. |
CVE-2023-38861 | Critical | 9.8 | 2023-08-15 | An issue in Wavlink WL_WNJ575A3 v.R75A3_V1410_220513 allows a remote attacker to execute arbitrary code via username parameter of the set_sys_adm function in a… |
CVE-2023-39293 | Critical | 9.8 | 2023-08-14 | A Command Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a malicious actor to execute… |
CVE-2023-40293 | Medium | 6.8 | 2023-08-14 | Harman Infotainment 20190525031613 and later allows command injection via unauthenticated RPC with a D-Bus connection object. |
CVE-2023-38034 | Critical | 9.8 | 2023-08-10 | A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, could allow a Remote Cod… |
CVE-2023-39008 | Critical | 9.8 | 2023-08-09 | A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allo… |
CVE-2023-39001 | Critical | 9.8 | 2023-08-09 | A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attacker… |
CVE-2023-32782 | High | 7.2 | 2023-08-09 | A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with write permissions coul… |
CVE-2023-32781 | High | 7.2 | 2023-08-09 | A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user with write permissions… |
CVE-2023-26310 | High | 7.4 | 2023-08-09 | There is a command injection problem in the old version of the mobile phone backup app. |
CVE-2023-35390 | High | 7.8 | 2023-08-08 | .NET and Visual Studio Remote Code Execution Vulnerability |
CVE-2023-39523 | Medium | 6.8 | 2023-08-07 | ScanCode.io is a server to script and automate software composition analysis with ScanPipe pipelines. Prior to version 32.5.1, the software has a possible comm… |
CVE-2023-38928 | Critical | 9.8 | 2023-08-07 | Netgear R7100LG 1.0.0.78 was discovered to contain a command injection vulnerability via the password parameter at usb_remote_invite.cgi. |
CVE-2023-38921 | High | 8.8 | 2023-08-07 | Netgear WG302v2 v5.2.9 and WAG302v2 v5.1.19 were discovered to contain multiple command injection vulnerabilities in the upgrade_handler function via the firmw… |
CVE-2023-38690 | Medium | 5.8 | 2023-08-04 | matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly p… |
CVE-2023-38941 | Critical | 9.8 | 2023-08-04 | django-sspanel v2022.2.2 was discovered to contain a remote command execution (RCE) vulnerability via the component sspanel/admin_view.py -> GoodsCreateView._p… |
CVE-2023-38942 | Critical | 9.8 | 2023-08-03 | Dango-Translator v4.5.5 was discovered to contain a remote command execution (RCE) vulnerability via the component app/config/cloud_config.json. |
CVE-2023-4120 | Medium | 6.3 | 2023-08-03 | A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230722 and classified as critical. This issue affects some unknown processing of the… |
CVE-2023-37679 | Critical | 9.8 | 2023-08-03 | A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server. |
CVE-2023-26317 | High | 7.0 | 2023-08-02 | Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from external interface… |
CVE-2023-26430 | Low | 3.5 | 2023-08-02 | Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE extension that… |
CVE-2023-3739 | Medium | 6.3 | 2023-08-01 | Insufficient validation of untrusted input in Chromad in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed a remote attacker to execute arbitrary code… |
CVE-2023-31429 | Medium | 5.5 | 2023-08-01 | Brocade Fabric OS before Brocade Fabric OS 9.1.1c, 9.2.0 contains a vulnerability when using various commands such as “chassisdistribute”, “reboot”, “rasman”… |
CVE-2023-3718 | High | 8.8 | 2023-08-01 | An authenticated command injection vulnerability exists in the AOS-CX command line interface. Successful exploitation of this vulnerability results in the abi… |
CVE-2022-39987 | High | 8.8 | 2023-08-01 | A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via the "entity" POST pa… |
CVE-2022-39986 | Critical | 9.8 | 2023-08-01 | A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg_id parameter in /ajax/o… |
CVE-2023-34960 | Critical | 9.8 | 2023-08-01 | A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API… |
CVE-2023-37214 | Critical | 9.8 | 2023-07-30 | Heights Telecom ERO1xS-Pro Dual-Band FW version BZ_ERO1XP.025. |
CVE-2023-28012 | Medium | 5.4 | 2023-07-27 | HCL BigFix Mobile is vulnerable to a command injection attack. An authenticated attacker could run arbitrary shell commands on the WebUI server. |
CVE-2023-28130 | High | 7.2 | 2023-07-26 | Local user may lead to privilege escalation using Gaia Portal hostnames page. |
CVE-2023-37794 | Critical | 9.8 | 2023-07-14 | WAYOS FBM-291W 19.09.11V was discovered to contain a command injection vulnerability via the component /upgrade_filter.asp. |
CVE-2023-38336 | Critical | 9.8 | 2023-07-14 | netkit-rcp in rsh-client 0.17-24 allows command injection via filenames because /bin/sh is used by susystem, a related issue to CVE-2006-0225, CVE-2019-7283, a… |
CVE-2023-38286 | High | 7.5 | 2023-07-14 | Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML… |
CVE-2023-37568 | High | 8.0 | 2023-07-13 | ELECOM wireless LAN routers WRC-1167GHBK-S v1.03 and earlier, and WRC-1167GEBK-S v1.03 and earlier allow a network-adjacent authenticated attacker to execute a… |
CVE-2023-37567 | Critical | 9.8 | 2023-07-13 | Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a remote unauthenticated attacker to execute an arbitrary command by sending… |
CVE-2023-37566 | High | 8.0 | 2023-07-13 | Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a network-adjacent authenticated attacker to execute an arbitrary command by… |
CVE-2023-36755 | Critical | 9.1 | 2023-07-11 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2023-36754 | Critical | 9.1 | 2023-07-11 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2023-36753 | Critical | 9.1 | 2023-07-11 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2023-36752 | Critical | 9.1 | 2023-07-11 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2023-36751 | Critical | 9.1 | 2023-07-11 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2023-36750 | Critical | 9.1 | 2023-07-11 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2021-4406 | Critical | 9.1 | 2023-07-10 | An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITSM tab * add a we… |
CVE-2023-37149 | Critical | 9.8 | 2023-07-07 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadSetting function. |
CVE-2023-37148 | Critical | 9.8 | 2023-07-07 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the ussd parameter in the setUssd function. |
CVE-2023-37146 | Critical | 9.8 | 2023-07-07 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function. |