CWE-77 · Command Injection (page 25)
Page 25 of 39 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-3710 | Critical | 9.9 | 2023-09-12 | Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions p… |
CVE-2023-36805 | High | 7.0 | 2023-09-12 | Windows MSHTML Platform Security Feature Bypass Vulnerability |
CVE-2023-33136 | High | 8.8 | 2023-09-12 | Azure DevOps Server Remote Code Execution Vulnerability |
CVE-2023-39637 | Critical | 9.8 | 2023-09-12 | D-Link DIR-816 A2 1.10 B05 was discovered to contain a command injection vulnerability via the component /goform/Diagnosis. |
CVE-2023-38829 | High | 8.8 | 2023-09-11 | An issue in NETIS SYSTEMS WF2409E v.3.6.42541 allows a remote attacker to execute arbitrary code via the ping and traceroute functions of the diagnostic tools… |
CVE-2023-39362 | High | 7.2 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can… |
CVE-2023-4310 | Critical | 9.8 | 2023-09-05 | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions 23.2.1 and 23.2.2 contain a command injection vulnerability which can be exploited… |
CVE-2023-40598 | High | 8.5 | 2023-08-30 | In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can… |
CVE-2023-38027 | Critical | 9.8 | 2023-08-28 | SpotCam Co., Ltd. SpotCam Sense’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulne… |
CVE-2023-40796 | High | 7.8 | 2023-08-25 | Phicomm k2 v22.6.529.216 was discovered to contain a command injection vulnerability via the function luci.sys.call. |
CVE-2023-25649 | Medium | 6.8 | 2023-08-25 | There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authe… |
CVE-2023-37469 | High | 8.8 | 2023-08-24 | CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled S… |
CVE-2023-39834 | Critical | 9.8 | 2023-08-24 | PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via create_function. |
CVE-2023-4212 | Medium | 6.8 | 2023-08-22 | A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root usin… |
CVE-2023-23564 | High | 8.8 | 2023-08-22 | An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to execute commands. |
CVE-2020-22570 | High | 7.5 | 2023-08-22 | Memcached 1.6.0 before 1.6.3 allows remote attackers to cause a denial of service (daemon crash) via a crafted meta command. |
CVE-2023-39618 | Critical | 9.8 | 2023-08-21 | TOTOLINK X5000R B20210419 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg interface. |
CVE-2023-39617 | Critical | 9.8 | 2023-08-21 | TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were discovered to contain a remote code execution (RCE) vulnerability via the lang… |
CVE-2023-39809 | Critical | 9.8 | 2023-08-21 | N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain an OS command injection vulnerability via shell metacharacters in the system_hostname parameter… |
CVE-2023-4414 | Medium | 6.3 | 2023-08-18 | A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230807. It has been declared as critical. Affected by this vulnerability is an unkno… |
CVE-2023-38902 | High | 8.8 | 2023-08-17 | A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG… |
CVE-2023-2910 | High | 8.8 | 2023-08-17 | Improper neutralization of special elements used in a command ('Command Injection') vulnerability in Printer service functionality in ASUSTOR Data Master (ADM)… |
CVE-2023-34215 | High | 7.2 | 2023-08-17 | TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validat… |
CVE-2023-34214 | High | 7.2 | 2023-08-17 | TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. Th… |
CVE-2023-34213 | High | 8.8 | 2023-08-17 | TN-5900 Series firmware versions v3.3 and prior are vulnerable to command-injection vulnerability. This vulnerability stems from insufficient input validation… |
CVE-2023-33239 | High | 8.8 | 2023-08-17 | TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. Th… |
CVE-2023-33238 | High | 7.2 | 2023-08-17 | TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. Th… |
CVE-2023-20237 | Medium | 4.3 | 2023-08-16 | A vulnerability in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access internal HTTP services that are otherwise ina… |
CVE-2023-20017 | Medium | 6.5 | 2023-08-16 | Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary commands using root-l… |
CVE-2023-20013 | Medium | 6.5 | 2023-08-16 | Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary commands using root-l… |
CVE-2023-20209 | Medium | 6.5 | 2023-08-16 | A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authent… |
CVE-2023-38866 | Critical | 9.8 | 2023-08-15 | COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_415588. Attackers can send POST request messages to /usr/bin/webmgnt and… |
CVE-2023-38864 | Critical | 9.8 | 2023-08-15 | An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the protal_delete_picname parameter in the sub_41171C function at bin/webm… |
CVE-2023-38865 | Critical | 9.8 | 2023-08-15 | COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_4143F0. Attackers can send POST request messages to /usr/bin/webmgnt and… |
CVE-2023-38863 | Critical | 9.8 | 2023-08-15 | An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the ifname and mac parameters in the sub_410074 function at bin/webmgnt. |
CVE-2023-38862 | Critical | 9.8 | 2023-08-15 | An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the destination parameter of sub_431F64 function in bin/webmgnt. |
CVE-2023-38861 | Critical | 9.8 | 2023-08-15 | An issue in Wavlink WL_WNJ575A3 v.R75A3_V1410_220513 allows a remote attacker to execute arbitrary code via username parameter of the set_sys_adm function in a… |
CVE-2023-39293 | Critical | 9.8 | 2023-08-14 | A Command Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a malicious actor to execute… |
CVE-2023-40293 | Medium | 6.8 | 2023-08-14 | Harman Infotainment 20190525031613 and later allows command injection via unauthenticated RPC with a D-Bus connection object. |
CVE-2023-38034 | Critical | 9.8 | 2023-08-10 | A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, could allow a Remote Cod… |
CVE-2023-39008 | Critical | 9.8 | 2023-08-09 | A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allo… |
CVE-2023-39001 | Critical | 9.8 | 2023-08-09 | A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attacker… |
CVE-2023-32782 | High | 7.2 | 2023-08-09 | A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with write permissions coul… |
CVE-2023-32781 | High | 7.2 | 2023-08-09 | A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user with write permissions… |
CVE-2023-26310 | High | 7.4 | 2023-08-09 | There is a command injection problem in the old version of the mobile phone backup app. |
CVE-2023-35390 | High | 7.8 | 2023-08-08 | .NET and Visual Studio Remote Code Execution Vulnerability |
CVE-2023-39523 | Medium | 6.8 | 2023-08-07 | ScanCode.io is a server to script and automate software composition analysis with ScanPipe pipelines. Prior to version 32.5.1, the software has a possible comm… |
CVE-2023-38928 | Critical | 9.8 | 2023-08-07 | Netgear R7100LG 1.0.0.78 was discovered to contain a command injection vulnerability via the password parameter at usb_remote_invite.cgi. |
CVE-2023-38921 | High | 8.8 | 2023-08-07 | Netgear WG302v2 v5.2.9 and WAG302v2 v5.1.19 were discovered to contain multiple command injection vulnerabilities in the upgrade_handler function via the firmw… |
CVE-2023-38690 | Medium | 5.8 | 2023-08-04 | matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly p… |
CVE-2023-38941 | Critical | 9.8 | 2023-08-04 | django-sspanel v2022.2.2 was discovered to contain a remote command execution (RCE) vulnerability via the component sspanel/admin_view.py -> GoodsCreateView._p… |
CVE-2023-38942 | Critical | 9.8 | 2023-08-03 | Dango-Translator v4.5.5 was discovered to contain a remote command execution (RCE) vulnerability via the component app/config/cloud_config.json. |
CVE-2023-4120 | Medium | 6.3 | 2023-08-03 | A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230722 and classified as critical. This issue affects some unknown processing of the… |
CVE-2023-37679 | Critical | 9.8 | 2023-08-03 | A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server. |
CVE-2023-26317 | High | 7.0 | 2023-08-02 | Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from external interface… |
CVE-2023-26430 | Low | 3.5 | 2023-08-02 | Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE extension that… |
CVE-2023-3739 | Medium | 6.3 | 2023-08-01 | Insufficient validation of untrusted input in Chromad in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed a remote attacker to execute arbitrary code… |
CVE-2023-31429 | Medium | 5.5 | 2023-08-01 | Brocade Fabric OS before Brocade Fabric OS 9.1.1c, 9.2.0 contains a vulnerability when using various commands such as “chassisdistribute”, “reboot”, “rasman”… |
CVE-2023-3718 | High | 8.8 | 2023-08-01 | An authenticated command injection vulnerability exists in the AOS-CX command line interface. Successful exploitation of this vulnerability results in the abi… |
CVE-2022-39987 | High | 8.8 | 2023-08-01 | A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via the "entity" POST pa… |
CVE-2022-39986 | Critical | 9.8 | 2023-08-01 | A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg_id parameter in /ajax/o… |
CVE-2023-34960 | Critical | 9.8 | 2023-08-01 | A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API… |
CVE-2023-37214 | Critical | 9.8 | 2023-07-30 | Heights Telecom ERO1xS-Pro Dual-Band FW version BZ_ERO1XP.025. |
CVE-2023-28012 | Medium | 5.4 | 2023-07-27 | HCL BigFix Mobile is vulnerable to a command injection attack. An authenticated attacker could run arbitrary shell commands on the WebUI server. |
CVE-2023-28130 | High | 7.2 | 2023-07-26 | Local user may lead to privilege escalation using Gaia Portal hostnames page. |
CVE-2023-37794 | Critical | 9.8 | 2023-07-14 | WAYOS FBM-291W 19.09.11V was discovered to contain a command injection vulnerability via the component /upgrade_filter.asp. |
CVE-2023-38336 | Critical | 9.8 | 2023-07-14 | netkit-rcp in rsh-client 0.17-24 allows command injection via filenames because /bin/sh is used by susystem, a related issue to CVE-2006-0225, CVE-2019-7283, a… |
CVE-2023-38286 | High | 7.5 | 2023-07-14 | Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML… |
CVE-2023-37568 | High | 8.0 | 2023-07-13 | ELECOM wireless LAN routers WRC-1167GHBK-S v1.03 and earlier, and WRC-1167GEBK-S v1.03 and earlier allow a network-adjacent authenticated attacker to execute a… |
CVE-2023-37567 | Critical | 9.8 | 2023-07-13 | Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a remote unauthenticated attacker to execute an arbitrary command by sending… |
CVE-2023-37566 | High | 8.0 | 2023-07-13 | Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a network-adjacent authenticated attacker to execute an arbitrary command by… |
CVE-2023-36755 | Critical | 9.1 | 2023-07-11 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2023-36754 | Critical | 9.1 | 2023-07-11 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2023-36753 | Critical | 9.1 | 2023-07-11 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2023-36752 | Critical | 9.1 | 2023-07-11 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2023-36751 | Critical | 9.1 | 2023-07-11 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2023-36750 | Critical | 9.1 | 2023-07-11 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2021-4406 | Critical | 9.1 | 2023-07-10 | An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITSM tab * add a we… |
CVE-2023-37149 | Critical | 9.8 | 2023-07-07 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadSetting function. |
CVE-2023-37148 | Critical | 9.8 | 2023-07-07 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the ussd parameter in the setUssd function. |
CVE-2023-37146 | Critical | 9.8 | 2023-07-07 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function. |
CVE-2023-37145 | Critical | 9.8 | 2023-07-07 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function. |
CVE-2023-37144 | Critical | 9.8 | 2023-07-07 | Tenda AC10 v15.03.06.26 was discovered to contain a command injection vulnerability via the mac parameter in the function formWriteFacMac. |
CVE-2023-24583 | High | 8.8 | 2023-07-06 | Two OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5. A specially crafted network requ… |
CVE-2023-24582 | High | 8.8 | 2023-07-06 | Two OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5. A specially crafted network requ… |
CVE-2023-24520 | High | 8.8 | 2023-07-06 | Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. A specially-crafted networ… |
CVE-2023-24519 | High | 8.8 | 2023-07-06 | Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. A specially-crafted networ… |
CVE-2023-23550 | High | 7.2 | 2023-07-06 | An OS command injection vulnerability exists in the ys_thirdparty user_delete functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet ca… |
CVE-2023-22659 | High | 7.2 | 2023-07-06 | An os command injection vulnerability exists in the libzebra.so change_hostname functionality of Milesight UR32L v32.3.0.5. A specially-crafted network packets… |
CVE-2023-22371 | High | 8.1 | 2023-07-06 | An os command injection vulnerability exists in the liburvpn.so create_private_key functionality of Milesight VPN v2.0.2. A specially-crafted network request c… |
CVE-2023-22306 | High | 7.2 | 2023-07-06 | An OS command injection vulnerability exists in the libzebra.so bridge_group functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can… |
CVE-2023-36458 | Medium | 6.3 | 2023-07-05 | 1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious paylo… |
CVE-2023-36457 | Medium | 6.3 | 2023-07-05 | 1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious paylo… |
CVE-2023-35974 | High | 7.2 | 2023-07-05 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-35973 | High | 7.2 | 2023-07-05 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-35972 | High | 7.2 | 2023-07-05 | An authenticated remote command injection vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability res… |
CVE-2023-28365 | Critical | 9.1 | 2023-07-01 | A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems allows application administrators to ex… |
CVE-2023-33298 | High | 7.8 | 2023-06-30 | com.perimeter81.osx.HelperTool in Perimeter81 10.0.0.19 on macOS allows Local Privilege Escalation (to root) via shell metacharacters in usingCAPath. |
CVE-2023-22816 | Medium | 6.0 | 2023-06-30 | A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an attacker to build files… |
CVE-2023-22815 | Medium | 6.2 | 2023-06-30 | Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute code in the context… |