CWE-77 · Command Injection (page 24)
Page 24 of 39 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-50089 | Critical | 9.8 | 2023-12-15 | A Command Injection vulnerability exists in NETGEAR WNR2000v4 version 1.0.0.70. When using HTTP for SOAP authentication, command execution occurs during the pr… |
CVE-2023-49898 | High | 7.2 | 2023-12-15 | In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. all… |
CVE-2023-6572 | High | 8.1 | 2023-12-14 | Command Injection in GitHub repository gradio-app/gradio prior to main. |
CVE-2023-25643 | High | 8.4 | 2023-12-14 | There is a command injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of multiple network parameters, an aut… |
CVE-2023-48702 | High | 7.2 | 2023-12-13 | Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the `/System/MediaEncoder/Path` endpoint executes an arbitrary file using `Pro… |
CVE-2023-48791 | High | 8.8 | 2023-12-13 | An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in FortiPortal version 7.2.0, version 7.0.6 and b… |
CVE-2023-47576 | High | 8.8 | 2023-12-13 | An issue was discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices, allowing authenticated command injection through the web interface. |
CVE-2013-2513 | Critical | 9.8 | 2023-12-12 | The flash_tool gem through 0.6.0 for Ruby allows command execution via shell metacharacters in the name of a downloaded file. |
CVE-2023-49587 | Medium | 6.4 | 2023-12-12 | SAP Solution Manager - version 720, allows an authorized attacker to execute certain deprecated function modules which can read or modify data of same or other… |
CVE-2023-40301 | Critical | 9.8 | 2023-12-07 | NETSCOUT nGeniusPULSE 3.8 has a Command Injection Vulnerability. |
CVE-2023-49436 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList. |
CVE-2023-49435 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 is vulnerable to command injection. |
CVE-2023-49431 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName. |
CVE-2023-49437 | Critical | 9.8 | 2023-12-07 | Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList. |
CVE-2023-49428 | Critical | 9.8 | 2023-12-07 | Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName. |
CVE-2023-24046 | Medium | 6.8 | 2023-12-04 | An issue was discovered on Connectize AC21000 G6 641.139.1.1256 allows attackers to run arbitrary commands via use of a crafted string in the ping utility. |
CVE-2023-48801 | Critical | 9.8 | 2023-12-01 | In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_415534 function obtains fields from the front-end, connects them through the snprintf f… |
CVE-2023-48842 | Critical | 9.8 | 2023-12-01 | D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at hedwig.cgi. |
CVE-2023-43455 | Critical | 9.8 | 2023-12-01 | An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the command parameter of t… |
CVE-2023-43454 | Critical | 9.8 | 2023-12-01 | An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the hostName parameter of… |
CVE-2023-43453 | Critical | 9.8 | 2023-12-01 | An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the IP parameter of the se… |
CVE-2023-6071 | High | 8.4 | 2023-11-30 | An Improper Neutralization of Special Elements used in a command vulnerability in ESM prior to version 11.6.9 allows a remote administrator to execute arbitra… |
CVE-2023-49040 | Critical | 9.8 | 2023-11-27 | An issue in Tneda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the adslPwd parameter in the form_fast_setting_internet_set function. |
CVE-2023-49213 | High | 8.8 | 2023-11-23 | The API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary commands via crafted HTTP requests if a param… |
CVE-2023-49210 | Critical | 9.8 | 2023-11-23 | The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and accepts an opts argu… |
CVE-2023-45625 | High | 7.2 | 2023-11-14 | Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ab… |
CVE-2023-42326 | High | 8.8 | 2023-11-14 | An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_… |
CVE-2023-47253 | Critical | 9.8 | 2023-11-06 | Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.php gridValoresPopHid… |
CVE-2023-23369 | Critical | 9.0 | 2023-11-03 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2023-20220 | High | 7.2 | 2023-11-01 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2023-20219 | High | 7.2 | 2023-11-01 | Multiple vulnerabilities in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to e… |
CVE-2023-20170 | Medium | 6.0 | 2023-11-01 | A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the underlying operati… |
CVE-2023-46485 | Critical | 9.8 | 2023-10-31 | An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setTracerouteCfg function of the stecgi.cgi compo… |
CVE-2023-46484 | Critical | 9.8 | 2023-10-31 | An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setLedCfg function. |
CVE-2023-46993 | Critical | 9.8 | 2023-10-31 | In TOTOLINK A3300R V17.0.0cu.557_B20221024 when dealing with setLedCfg request, there is no verification for the enable parameter, which can lead to command in… |
CVE-2023-46979 | Critical | 9.8 | 2023-10-31 | TOTOLINK X6000R V9.4.0cu.852_B20230719 was discovered to contain a command injection vulnerability via the enable parameter in the setLedCfg function. |
CVE-2023-46976 | Critical | 9.8 | 2023-10-31 | TOTOLINK A3300R 17.0.0cu.557_B20221024 contains a command injection via the file_name parameter in the UploadFirmwareFile function. |
CVE-2023-47104 | Critical | 9.8 | 2023-10-30 | tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign) in titles, messages, and other input d… |
CVE-2023-43322 | High | 8.8 | 2023-10-28 | ZPE Systems, Inc Nodegrid OS v5.0.0 to v5.0.17, v5.2.0 to v5.2.19, v5.4.0 to v5.4.16, v5.6.0 to v5.6.13, v5.8.0 to v5.8.10, and v5.10.0 to v5.10.3 was discover… |
CVE-2023-45498 | Critical | 9.8 | 2023-10-27 | VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability. |
CVE-2023-46424 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_422BD4 function. |
CVE-2023-46423 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_417094 function. |
CVE-2023-46422 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411994 function. |
CVE-2023-46421 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411D00 function. |
CVE-2023-46420 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41590C function. |
CVE-2023-46419 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415730 function. |
CVE-2023-46418 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_412688 function. |
CVE-2023-46417 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415498 function. |
CVE-2023-46416 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ The 41A414 function. |
CVE-2023-46415 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41E588 function. |
CVE-2023-46414 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ 41D494 function. |
CVE-2023-46413 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_4155DC function. |
CVE-2023-46412 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_41D998 function. |
CVE-2023-46411 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_415258 function. |
CVE-2023-46410 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 416F60 function. |
CVE-2023-46409 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ 41CC04 function. |
CVE-2023-46408 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 41DD80 function. |
CVE-2023-5752 | Medium | 5.5 | 2023-10-25 | When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inje… |
CVE-2023-46574 | Critical | 9.8 | 2023-10-25 | An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile func… |
CVE-2023-46370 | Critical | 9.8 | 2023-10-25 | Tenda W18E V16.01.0.8(1576) has a command injection vulnerability via the hostName parameter in the formSetNetCheckTools function. |
CVE-2023-43510 | Medium | 4.7 | 2023-10-25 | A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying ho… |
CVE-2023-38193 | High | 8.8 | 2023-10-21 | An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Remote Code Execution via a crafted sendmail command line. |
CVE-2023-21413 | Critical | 9.1 | 2023-10-16 | GoSecure on behalf of Genetec Inc. has found a flaw that allows for a remote code execution during the installation of ACAP applications on the Axis device. Th… |
CVE-2023-36954 | Critical | 9.8 | 2023-10-16 | TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection. |
CVE-2023-36953 | Critical | 9.8 | 2023-10-16 | TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection. |
CVE-2023-26155 | High | 7.3 | 2023-10-14 | All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize its parameter input… |
CVE-2023-45852 | Critical | 9.8 | 2023-10-14 | In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharact… |
CVE-2023-45466 | Critical | 9.8 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the pin_host parameter in the WPS Settings. |
CVE-2023-45465 | Critical | 9.8 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ddnsDomainName parameter in the Dynamic DNS settings. |
CVE-2023-32632 | High | 8.8 | 2023-10-11 | A command execution vulnerability exists in the validate.so diag_ping_start functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can… |
CVE-2023-26320 | High | 7.5 | 2023-10-11 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection. |
CVE-2023-26319 | Medium | 6.7 | 2023-10-11 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection. |
CVE-2023-36415 | High | 8.8 | 2023-10-10 | Azure Identity SDK Remote Code Execution Vulnerability |
CVE-2023-36414 | High | 8.8 | 2023-10-10 | Azure Identity SDK Remote Code Execution Vulnerability |
CVE-2023-45208 | High | 8.8 | 2023-10-10 | A command injection in the parsing_xml_stasurvey function inside libcgifunc.so of the D-Link DAP-X1860 repeater 1.00 through 1.01b05-01 allows attackers (withi… |
CVE-2023-44959 | High | 8.8 | 2023-10-10 | An issue found in D-Link DSL-3782 v.1.03 and before allows remote authenticated users to execute arbitrary code as root via the Router IP Address fields of the… |
CVE-2023-44827 | High | 8.8 | 2023-10-10 | An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execute arbitrary code v… |
CVE-2023-45356 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 4000 and Manager Platform V10 R1 before Hotfix V10 R1.42.2 allow command injection by an au… |
CVE-2023-45355 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 and 4000 and Manager Platform V10 R1 before Hotfix V10 R1.42.2 allow command injection by a… |
CVE-2023-45351 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.1, 4000 Assistant V10 R0, 4000 Manager V10 R1 before V10 R1.42.1, and 4000 Manager V10 R0 allow Aut… |
CVE-2023-4401 | High | 7.8 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contains an OS Command Injection Vulnerability in the CLI use of the ‘more’ command. A local or remote au… |
CVE-2023-43891 | Critical | 9.8 | 2023-10-02 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the Changing Username and Password function. This vulnerability is exploi… |
CVE-2023-26145 | High | 7.4 | 2023-09-28 | This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept… |
CVE-2023-41303 | High | 7.5 | 2023-09-25 | Command injection vulnerability in the distributed file system module. Successful exploitation of this vulnerability may cause variables in the sock structure… |
CVE-2023-41031 | High | 8.0 | 2023-09-22 | Command injection in homemng.htm in Juplink RX4-1500 versions V1.0.2, V1.0.3, V1.0.4, and V1.0.5 allows remote authenticated attackers to execute commands via… |
CVE-2023-41029 | High | 8.0 | 2023-09-22 | Command injection vulnerability in the homemng.htm endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.2, V1.0.3, V1.0.4, and V1.0.5 allows authent… |
CVE-2023-43128 | Critical | 9.8 | 2023-09-21 | D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of HTTP_ST parameters. |
CVE-2023-42810 | Critical | 9.8 | 2023-09-21 | systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem was fixed… |
CVE-2023-43138 | High | 8.8 | 2023-09-20 | TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds NAPT rules after authentication, and the rule… |
CVE-2023-43137 | High | 8.8 | 2023-09-20 | TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds ACL rules after authentication, and the rule n… |
CVE-2023-43207 | Critical | 9.8 | 2023-09-20 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function config_upload_handler. This vulnerability allows… |
CVE-2023-43206 | Critical | 9.8 | 2023-09-20 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function web_cert_download_handler. This vulnerability all… |
CVE-2023-43204 | Critical | 9.8 | 2023-09-20 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub_2EF50. This vulnerability allows attackers to… |
CVE-2023-43202 | Critical | 9.8 | 2023-09-20 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function pcap_download_handler. This vulnerability allows… |
CVE-2023-43477 | Medium | 6.8 | 2023-09-20 | The ping_from parameter of ping_tracerte.cgi in the web UI of Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, was not properly sanit… |
CVE-2023-33831 | Critical | 9.8 | 2023-09-18 | A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST… |
CVE-2023-34999 | High | 8.4 | 2023-09-18 | A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 (< 5.7.6) and v6 (< 6.5.0) that allows an attacker to perform arbitra… |
CVE-2023-39638 | Critical | 9.8 | 2023-09-14 | D-LINK DIR-859 A1 1.05 and A1 1.06B01 Beta01 was discovered to contain a command injection vulnerability via the lxmldbc_system function at /htdocs/cgibin. |
CVE-2023-41011 | Critical | 9.8 | 2023-09-14 | Command Execution vulnerability in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary c… |
CVE-2023-36642 | Medium | 6.7 | 2023-09-13 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiTester 3.0.0 through 7.2.3 may… |