CWE-77 · Command Injection (page 24)
Page 24 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-37145 | Critical | 9.8 | 2023-07-07 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function. |
CVE-2023-37144 | Critical | 9.8 | 2023-07-07 | Tenda AC10 v15.03.06.26 was discovered to contain a command injection vulnerability via the mac parameter in the function formWriteFacMac. |
CVE-2023-24583 | High | 8.8 | 2023-07-06 | Two OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5. A specially crafted network requ… |
CVE-2023-24582 | High | 8.8 | 2023-07-06 | Two OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5. A specially crafted network requ… |
CVE-2023-24520 | High | 8.8 | 2023-07-06 | Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. A specially-crafted networ… |
CVE-2023-24519 | High | 8.8 | 2023-07-06 | Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. A specially-crafted networ… |
CVE-2023-23550 | High | 7.2 | 2023-07-06 | An OS command injection vulnerability exists in the ys_thirdparty user_delete functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet ca… |
CVE-2023-22659 | High | 7.2 | 2023-07-06 | An os command injection vulnerability exists in the libzebra.so change_hostname functionality of Milesight UR32L v32.3.0.5. A specially-crafted network packets… |
CVE-2023-22371 | High | 8.1 | 2023-07-06 | An os command injection vulnerability exists in the liburvpn.so create_private_key functionality of Milesight VPN v2.0.2. A specially-crafted network request c… |
CVE-2023-22306 | High | 7.2 | 2023-07-06 | An OS command injection vulnerability exists in the libzebra.so bridge_group functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can… |
CVE-2023-36458 | Medium | 6.3 | 2023-07-05 | 1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious paylo… |
CVE-2023-36457 | Medium | 6.3 | 2023-07-05 | 1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious paylo… |
CVE-2023-35974 | High | 7.2 | 2023-07-05 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-35973 | High | 7.2 | 2023-07-05 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-35972 | High | 7.2 | 2023-07-05 | An authenticated remote command injection vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability res… |
CVE-2023-28365 | Critical | 9.1 | 2023-07-01 | A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems allows application administrators to ex… |
CVE-2023-33298 | High | 7.8 | 2023-06-30 | com.perimeter81.osx.HelperTool in Perimeter81 10.0.0.19 on macOS allows Local Privilege Escalation (to root) via shell metacharacters in usingCAPath. |
CVE-2023-22816 | Medium | 6.0 | 2023-06-30 | A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an attacker to build files… |
CVE-2023-22815 | Medium | 6.2 | 2023-06-30 | Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute code in the context… |
CVE-2023-34849 | Critical | 9.8 | 2023-06-29 | An unauthorized command injection vulnerability exists in the ActionLogin function of the webman.lua file in Ikuai router OS through 3.7.1. |
CVE-2023-26134 | Critical | 9.8 | 2023-06-28 | Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo () fails to saniti… |
CVE-2023-35932 | High | 7.1 | 2023-06-23 | jcvi is a Python library to facilitate genome assembly, annotation, and comparative genomics. A configuration injection happens when user input is considered b… |
CVE-2023-30260 | High | 8.8 | 2023-06-23 | Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd… |
CVE-2023-30258 | Critical | 9.8 | 2023-06-23 | Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request. |
CVE-2023-26429 | Low | 3.5 | 2023-06-20 | Control characters were not removed when exporting user feedback content. This allowed attackers to include unexpected content via user feedback and potentiall… |
CVE-2023-24032 | High | 7.8 | 2023-06-15 | In Zimbra Collaboration Suite through 9.0 and 8.8.15, an attacker (who has initial user access to a Zimbra server instance) can execute commands as root by pas… |
CVE-2023-31746 | Critical | 9.8 | 2023-06-14 | There is a command injection vulnerability in the adslr VW2100 router with firmware version M1DV1.0. An unauthenticated attacker can exploit the vulnerability… |
CVE-2023-27836 | Critical | 9.8 | 2023-06-13 | TP-Link TL-WPA8630P (US)_ V2_ Version 171011 was discovered to contain a command injection vulnerability via the devicePwd parameter in the function sub_ 40A80… |
CVE-2023-27837 | Critical | 9.8 | 2023-06-13 | TP-Link TL-WPA8630P (US)_ V2_ Version 171011 was discovered to contain a command injection vulnerability via the key parameter in the function sub_ 40A774. |
CVE-2023-33919 | High | 7.2 | 2023-06-13 | A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). The web interface… |
CVE-2023-26298 | High | 8.8 | 2023-06-12 | Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. |
CVE-2023-26297 | High | 8.8 | 2023-06-12 | Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. |
CVE-2023-26296 | High | 8.8 | 2023-06-12 | Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. |
CVE-2023-26295 | Critical | 9.8 | 2023-06-12 | Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. |
CVE-2023-26294 | High | 7.8 | 2023-06-12 | Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. |
CVE-2023-33625 | Critical | 9.8 | 2023-06-12 | D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a command injection vulnerability via the ST parameter in the lxmldbc_syste… |
CVE-2023-34105 | High | 7.5 | 2023-06-12 | SRS is a real-time video server supporting RTMP, WebRTC, HLS, HTTP-FLV, SRT, MPEG-DASH, and GB28181. Prior to versions 5.0.157, 5.0-b1, and 6.0.48, SRS's `api-… |
CVE-2023-3206 | Medium | 5.3 | 2023-06-12 | A vulnerability classified as problematic was found in Chengdu VEC40G 3.0. Affected by this vulnerability is an unknown functionality of the file /send_order.c… |
CVE-2022-38156 | High | 7.2 | 2023-06-12 | A remote command injection issues exists in the web server of the Kratos SpectralNet device with SpectralNet Narrowband (NB) before 1.7.5. As an admin user, an… |
CVE-2023-35035 | High | 8.8 | 2023-06-12 | Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8, and Manager… |
CVE-2023-35033 | High | 8.8 | 2023-06-12 | Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8, and Manager… |
CVE-2023-35032 | High | 8.8 | 2023-06-12 | Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow command injection by… |
CVE-2023-35031 | High | 8.8 | 2023-06-12 | Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8, and Manager… |
CVE-2023-25911 | Critical | 9.9 | 2023-06-11 | The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application parameters. |
CVE-2023-34233 | High | 8.8 | 2023-06-08 | The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations… |
CVE-2023-34232 | High | 7.3 | 2023-06-08 | snowflake-connector-nodejs, a NodeJS driver for Snowflake, is vulnerable to command injection via single sign on (SSO) browser URL authentication in versions p… |
CVE-2023-34230 | High | 7.3 | 2023-06-08 | snowflake-connector-net, the Snowflake Connector for .NET, is vulnerable to command injection prior to version 2.0.18 via SSO URL authentication. In order to e… |
CVE-2023-34231 | High | 8.8 | 2023-06-08 | gosnowflake is th Snowflake Golang driver. Prior to version 1.6.19, a command injection vulnerability exists in the Snowflake Golang driver via single sign-on… |
CVE-2023-33556 | Critical | 9.8 | 2023-06-07 | TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the staticGw parameter at /setting/setWanIeCfg. |
CVE-2023-20889 | High | 7.5 | 2023-06-07 | Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may… |
CVE-2023-20887 | Critical | 9.8 | 2023-06-07 | Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be ab… |
CVE-2023-33538 | High | 8.8 | 2023-06-07 | TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetwo… |
CVE-2023-33782 | High | 8.8 | 2023-06-07 | D-Link DIR-842V2 v1.0.3 was discovered to contain a command injection vulnerability via the iperf3 diagnostics function. |
CVE-2023-30400 | Critical | 9.8 | 2023-06-07 | An issue was discovered in Anyka Microelectronics AK3918EV300 MCU v18. A command injection vulnerability in the network configuration script within the MCU's o… |
CVE-2022-25834 | High | 7.8 | 2023-06-07 | In Percona XtraBackup (PXB) through 2.2.24 and 3.x through 8.0.27-19, a crafted filename on the local file system could trigger unexpected command shell execut… |
CVE-2023-34111 | High | 8.1 | 2023-06-06 | The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerability which allows for arbitrary code exec… |
CVE-2023-33533 | High | 8.8 | 2023-06-06 | Netgear D6220 with Firmware Version 1.0.0.80, D8500 with Firmware Version 1.0.3.60, R6700 with Firmware Version 1.0.2.26, and R6900 with Firmware Version 1.0.2… |
CVE-2023-33532 | Critical | 9.8 | 2023-06-06 | There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48. If an attacker gains web management privileges, they can… |
CVE-2023-31569 | Critical | 9.8 | 2023-06-06 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection via the setWanCfg function. |
CVE-2023-33530 | High | 8.8 | 2023-06-06 | There is a command injection vulnerability in the Tenda G103 Gigabit GPON Terminal with firmware version V1.0.0.5. If an attacker gains web management privileg… |
CVE-2023-0636 | High | 7.2 | 2023-06-05 | Improper Input Validation vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103… |
CVE-2023-23952 | Critical | 9.8 | 2023-06-01 | Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Command Injection vulnerability. |
CVE-2023-33722 | High | 8.8 | 2023-05-31 | EDIMAX BR-6288ACL v1.12 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the pppUserName parameter. |
CVE-2023-33487 | Critical | 9.8 | 2023-05-31 | TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a command insertion vulnerability in setDiagnosisCfg.This vulnerability allows an at… |
CVE-2023-33486 | Critical | 9.8 | 2023-05-31 | TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setOpModeCfg. This vulnerability allows an attac… |
CVE-2023-34153 | High | 7.8 | 2023-05-30 | A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VI… |
CVE-2022-47028 | Medium | 5.5 | 2023-05-30 | An issue discovered in Action Launcher for Android v50.5 allows an attacker to cause a denial of service via arbitary data injection to function insert. |
CVE-2022-46361 | Medium | 6.9 | 2023-05-30 | An attacker having physical access to WDM can plug USB device to gain access and execute unwanted commands. A malicious user could enter a system command along… |
CVE-2023-26130 | High | 7.5 | 2023-05-30 | Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in… |
CVE-2022-24630 | High | 7.2 | 2023-05-29 | An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. BrowseFiles.php allows a ?cmd=ssh POST request with an ssh_command field… |
CVE-2020-29547 | Medium | 5.9 | 2023-05-29 | An issue was discovered in Citadel through webcit-926. Meddler-in-the-middle attackers can pipeline commands after POP3 STLS, IMAP STARTTLS, or SMTP STARTTLS c… |
CVE-2015-20108 | Critical | 9.8 | 2023-05-27 | xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used. |
CVE-2023-26129 | High | 8.4 | 2023-05-27 | All versions of the package bwm-ng are vulnerable to Command Injection due to improper input sanitization in the 'check' function in the bwm-ng.js file. **No… |
CVE-2023-26128 | High | 8.4 | 2023-05-27 | All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employ… |
CVE-2023-26127 | High | 7.8 | 2023-05-27 | All versions of the package n158 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function. **Note:** To execut… |
CVE-2023-31460 | High | 7.2 | 2023-05-24 | A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated attacker with intern… |
CVE-2023-2868 | Critical | 9.4 | 2023-05-24 | A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0… |
CVE-2023-31996 | High | 8.8 | 2023-05-23 | Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Command Injection due to improper sanitization of special characters for the NAS storage test function. |
CVE-2023-31741 | High | 7.2 | 2023-05-23 | There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management privileges, they can i… |
CVE-2023-31740 | High | 7.2 | 2023-05-23 | There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management privileges, they can i… |
CVE-2023-31742 | High | 7.2 | 2023-05-22 | There is a command injection vulnerability in the Linksys WRT54GL router with firmware version 4.30.18.006. If an attacker gains web management privileges, the… |
CVE-2023-33294 | Critical | 9.8 | 2023-05-22 | An issue was discovered in KaiOS 3.0 before 3.1. The /system/bin/tctweb_server binary exposes a local web server that responds to GET and POST requests on port… |
CVE-2023-33235 | High | 7.2 | 2023-05-22 | MXsecurity version 1.0 is vulnearble to command injection vulnerability. This vulnerability has been reported in the SSH CLI program, which can be exploited by… |
CVE-2023-32700 | High | 7.8 | 2023-05-20 | LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core… |
CVE-2023-31729 | Critical | 9.8 | 2023-05-18 | TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi. |
CVE-2023-2491 | High | 7.8 | 2023-05-17 | A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result i… |
CVE-2023-31701 | High | 8.8 | 2023-05-17 | TP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via _httpRpmPlcDeviceRemove. |
CVE-2023-31700 | High | 8.8 | 2023-05-17 | TP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via _httpRpmPlcDeviceAdd. |
CVE-2023-31208 | High | 8.3 | 2023-05-17 | Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8 (beta) allows arbitrary livestatus com… |
CVE-2023-31856 | Critical | 9.8 | 2023-05-16 | A command injection vulnerability in the hostTime parameter in the function NTPSyncWithHostof TOTOLINK CP300+ V5.2cu.7594_B20200910 allows attackers to execute… |
CVE-2023-31986 | Critical | 9.8 | 2023-05-15 | A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the setWAN function in /bi… |
CVE-2023-31983 | Critical | 9.8 | 2023-05-12 | A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the mp function in /bin/we… |
CVE-2023-32073 | High | 8.8 | 2023-05-12 | WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` w… |
CVE-2023-2682 | Medium | 6.3 | 2023-05-12 | A vulnerability was found in Caton Live up to 2023-04-26 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/ping.cgi o… |
CVE-2023-31985 | Critical | 9.8 | 2023-05-12 | A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the formAccept function in… |
CVE-2023-31531 | High | 8.8 | 2023-05-11 | Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the tomography_ping_number parameter. |
CVE-2023-31530 | High | 8.8 | 2023-05-11 | Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the smartqos_priority_devices parameter. |
CVE-2023-31529 | High | 8.8 | 2023-05-11 | Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the system_time_timezone parameter. |
CVE-2023-31528 | High | 8.8 | 2023-05-11 | Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the staticroute_list parameter. |
CVE-2023-24540 | Critical | 9.8 | 2023-05-11 | Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f… |