CWE-77 · Command Injection (page 25)
Page 25 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-31473 | Medium | 4.9 | 2023-05-11 | An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. Thi… |
CVE-2023-2649 | High | 7.2 | 2023-05-11 | A vulnerability was found in Tenda AC23 16.03.07.45_cn. It has been declared as critical. This vulnerability affects unknown code of the file /bin/ate of the c… |
CVE-2023-2647 | Medium | 6.3 | 2023-05-11 | A vulnerability was found in Weaver E-Office 9.5 and classified as critical. Affected by this issue is some unknown functionality of the file /webroot/inc/util… |
CVE-2022-29842 | Critical | 9.8 | 2023-05-10 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability that could allow an attacker to execute code in the context o… |
CVE-2023-30353 | Critical | 9.8 | 2023-05-10 | Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows unauthenticated remote code execution via an XML document. |
CVE-2023-31476 | High | 7.5 | 2023-05-09 | An issue was discovered on GL.iNet devices running firmware before 3.216. There is an arbitrary file write in which an empty file can be created almost anywher… |
CVE-2023-28832 | High | 7.2 | 2023-05-09 | A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1)… |
CVE-2023-27407 | Critical | 9.9 | 2023-05-09 | A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web based management of affected device does not properly validate user inpu… |
CVE-2023-22790 | High | 7.2 | 2023-05-08 | Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these v… |
CVE-2023-22789 | High | 7.2 | 2023-05-08 | Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these v… |
CVE-2023-22788 | High | 7.2 | 2023-05-08 | Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these v… |
CVE-2023-2574 | High | 8.8 | 2023-05-08 | Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the device name input field, which can be tri… |
CVE-2023-2573 | High | 8.8 | 2023-05-08 | Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the NTP server input field, which can be trig… |
CVE-2023-30135 | Critical | 9.8 | 2023-05-05 | Tenda AC18 v15.03.05.19(6318_)_cn was discovered to contain a command injection vulnerability via the deviceName parameter in the setUsbUnload function. |
CVE-2023-2520 | High | 8.8 | 2023-05-04 | A vulnerability was found in Caton Prime 2.1.2.51.e8d7225049(202303031001) and classified as critical. This issue affects some unknown processing of the file c… |
CVE-2023-26125 | Medium | 5.6 | 2023-05-04 | Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted re… |
CVE-2023-32007 | High | 8.8 | 2023-05-02 | ** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authenticatio… |
CVE-2023-2378 | High | 7.2 | 2023-04-28 | A flaw has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown function of the component Web Management Interface. This manipulat… |
CVE-2023-2377 | High | 7.2 | 2023-04-28 | A vulnerability was detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The impacted element is an unknown function of the component Web Management Interfa… |
CVE-2023-2376 | High | 7.2 | 2023-04-28 | A security vulnerability has been detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The affected element is an unknown function of the component Web Mana… |
CVE-2023-2375 | High | 7.2 | 2023-04-28 | A weakness has been identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. Impacted is an unknown function of the component Web Management Interface. Execut… |
CVE-2023-2374 | High | 7.2 | 2023-04-28 | A security flaw has been discovered in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This issue affects some unknown processing of the component Web Management I… |
CVE-2023-2373 | High | 7.2 | 2023-04-28 | A vulnerability was identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This vulnerability affects unknown code of the component Web Management Interface… |
CVE-2022-36769 | High | 7.2 | 2023-04-26 | IBM Cloud Pak for Data 4.5 and 4.6 could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the p… |
CVE-2023-30623 | High | 8.8 | 2023-04-24 | `embano1/wip` is a GitHub Action written in Bash. Prior to version 2, the `embano1/wip` action uses the `github.event.pull_request.title` parameter in an inse… |
CVE-2023-29566 | Critical | 9.8 | 2023-04-24 | huedawn-tesseract 0.3.3 and dawnsparks-node-tesseract 0.4.0 to 0.4.1 was discovered to contain a remote code execution (RCE) vulnerability via the child_proces… |
CVE-2023-27849 | Critical | 9.8 | 2023-04-24 | rails-routes-to-json v1.0.0 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function. |
CVE-2023-27848 | Critical | 9.8 | 2023-04-24 | broccoli-compass v0.2.4 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function. |
CVE-2023-22913 | High | 8.1 | 2023-04-24 | A post-authentication command injection vulnerability in the “account_operator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, a… |
CVE-2023-20865 | High | 7.2 | 2023-04-20 | VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs… |
CVE-2023-29855 | High | 7.2 | 2023-04-18 | WBCE CMS 1.5.3 has a command execution vulnerability via admin/languages/install.php. |
CVE-2022-46640 | Critical | 9.8 | 2023-04-18 | Nanoleaf Desktop App before v1.3.1 was discovered to contain a command injection vulnerability which is exploited via a crafted HTTP request. |
CVE-2022-37704 | Medium | 6.7 | 2023-04-16 | Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as ro… |
CVE-2019-14944 | Medium | 6.5 | 2023-04-16 | An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Gitaly allows injection of command… |
CVE-2023-30535 | High | 7.3 | 2023-04-14 | Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Users of the Snowflake JDBC drive… |
CVE-2023-29803 | Critical | 9.8 | 2023-04-14 | TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the pid parameter in the disconnectVPN function. |
CVE-2023-29802 | Critical | 9.8 | 2023-04-14 | TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function. |
CVE-2023-29801 | Critical | 9.8 | 2023-04-14 | TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain multiple command injection vulnerabilities via the rtLogEnabled and rtLogServer parameters in th… |
CVE-2023-29800 | Critical | 9.8 | 2023-04-14 | TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function. |
CVE-2023-29799 | Critical | 9.8 | 2023-04-14 | TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function. |
CVE-2023-29798 | Critical | 9.8 | 2023-04-14 | TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function. |
CVE-2023-30638 | High | 7.2 | 2023-04-14 | Atos Unify OpenScape SBC 10 before 10R3.1.3, OpenScape Branch 10 before 10R3.1.2, and OpenScape BCF 10 before 10R10.7.0 allow remote authenticated admins to in… |
CVE-2023-29084 | High | 7.2 | 2023-04-13 | Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings. |
CVE-2023-20118 | Medium | 6.5 | 2023-04-13 | A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an auth… |
CVE-2023-28489 | Critical | 9.8 | 2023-04-11 | A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). Affected devices a… |
CVE-2023-26978 | Critical | 9.8 | 2023-04-07 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pppoeAcName parameter at /setting/setWanIeCfg. |
CVE-2023-26848 | Critical | 9.8 | 2023-04-07 | TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the org parameter at setting/delStaticDhcpRules. |
CVE-2023-29475 | Critical | 9.8 | 2023-04-06 | inventory in Atos Unify OpenScape 4000 Platform and OpenScape 4000 Manager Platform 10 R1 before 10 R1.34.4 allows an unauthenticated attacker to run arbitrary… |
CVE-2023-29474 | Critical | 9.8 | 2023-04-06 | inventory in Atos Unify OpenScape 4000 Platform and OpenScape 4000 Manager Platform 10 R1 before 10 R1.34.4 allows an unauthenticated attacker to run arbitrary… |
CVE-2023-29473 | Critical | 9.8 | 2023-04-06 | webservice in Atos Unify OpenScape 4000 Platform and OpenScape 4000 Manager Platform 10 R1 before 10 R1.34.4 allows an unauthenticated attacker to run arbitrar… |
CVE-2023-1708 | Medium | 5.7 | 2023-04-05 | An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable c… |
CVE-2023-20153 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injectio… |
CVE-2023-20122 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in the restricted shell of Cisco Evolved Programmable Network Manager (EPNM), Cisco Identity Services Engine (ISE), and Cisco Prime In… |
CVE-2023-20121 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in the restricted shell of Cisco Evolved Programmable Network Manager (EPNM), Cisco Identity Services Engine (ISE), and Cisco Prime In… |
CVE-2023-20152 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injectio… |
CVE-2023-20124 | Medium | 6.5 | 2023-04-05 | A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticate… |
CVE-2023-1877 | Critical | 9.8 | 2023-04-05 | Command Injection in GitHub repository microweber/microweber prior to 1.3.3. |
CVE-2023-26866 | Critical | 9.8 | 2023-04-04 | GreenPacket OH736's WR-1200 Indoor Unit, OT-235 with firmware versions M-IDU-1.6.0.3_V1.1 and MH-46360-2.0.3-R5-GP respectively are vulnerable to remote comman… |
CVE-2023-1671 | Critical | 9.8 | 2023-04-04 | A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code. |
CVE-2022-4934 | High | 7.2 | 2023-04-04 | A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrators to execute arbitr… |
CVE-2023-28854 | High | 8.0 | 2023-04-03 | nophp is a PHP web framework. Prior to version 0.0.1, nophp is vulnerable to shell command injection on httpd user. A patch was made available at commit e5409a… |
CVE-2023-28677 | Critical | 9.8 | 2023-04-02 | Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-buil… |
CVE-2023-26822 | Critical | 9.8 | 2023-04-01 | D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at soapcgi.main. |
CVE-2023-28935 | High | 8.8 | 2023-03-30 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation… |
CVE-2022-43623 | Medium | 6.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authenticati… |
CVE-2023-1685 | Medium | 6.3 | 2023-03-29 | A vulnerability was found in HadSky up to 7.11.8. It has been declared as critical. This vulnerability affects unknown code of the file /install/index.php of t… |
CVE-2023-23355 | Medium | 6.6 | 2023-03-29 | An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated… |
CVE-2023-27232 | Critical | 9.8 | 2023-03-28 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wanStrategy parameter at /setting/setWanIeCfg. |
CVE-2023-27231 | Critical | 9.8 | 2023-03-28 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the downBw parameter at /setting/setWanIeCfg. |
CVE-2023-27229 | Critical | 9.8 | 2023-03-28 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the upBw parameter at /setting/setWanIeCfg. |
CVE-2023-28712 | High | 8.2 | 2023-03-28 | Osprey Pump Controller version 1.01 contains an unauthenticated command injection vulnerability that could allow system access with www-data permissions. |
CVE-2023-28430 | High | 7.3 | 2023-03-27 | OneSignal is an email, sms, push notification, and in-app message service for mobile apps.The Zapier.yml workflow is triggered on issues (types: [closed]) (i.e… |
CVE-2023-26493 | High | 8.1 | 2023-03-27 | Cocos Engine is an open-source framework for building 2D & 3D real-time rendering and interactive content. In the github repo for Cocos Engine the `web-interfa… |
CVE-2023-1141 | High | 8.8 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a command injection vulnerability that could allow an attacker to inject arbitrary c… |
CVE-2023-27796 | High | 8.8 | 2023-03-26 | RG-EW1200G PRO Wireless Routers EW_3.0(1)B11P204, RG-EW1800GX PRO Wireless Routers EW_3.0(1)B11P204, and RG-EW3200GX PRO Wireless Routers EW_3.0(1)B11P204 were… |
CVE-2023-26801 | Critical | 9.8 | 2023-03-26 | LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection vuln… |
CVE-2023-26800 | Critical | 9.8 | 2023-03-26 | Ruijie Networks RG-EW1200 Wireless Routers EW_3.0(1)B11P204 was discovered to contain a command injetion vulnerability via the params.path parameter in the upg… |
CVE-2023-1458 | High | 7.2 | 2023-03-25 | A vulnerability has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6 and classified as critical. Affected by this vulnerability is an unknown functionality o… |
CVE-2023-1457 | High | 7.2 | 2023-03-25 | A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. Affected is an unknown function of the component Static R… |
CVE-2023-1456 | High | 7.2 | 2023-03-25 | A vulnerability, which was classified as critical, has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. This issue affects some unknown processing of the co… |
CVE-2023-23149 | Critical | 9.8 | 2023-03-24 | DEK-1705 <=Firmware:34.23.1 device was discovered to have a command execution vulnerability. |
CVE-2023-20097 | Medium | 4.6 | 2023-03-23 | A vulnerability in Cisco access points (AP) software could allow an authenticated, local attacker to inject arbitrary commands and execute them with root privi… |
CVE-2022-28496 | Critical | 9.8 | 2023-03-23 | TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 discovered to contain a command injection vulnerability in the setPasswordCfg function via the adminuser and adm… |
CVE-2022-28497 | Critical | 9.8 | 2023-03-23 | TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the mtd_write_bootloader function via the filename… |
CVE-2023-27135 | Critical | 9.8 | 2023-03-23 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the enabled parameter at /setting/setWanIeCfg. |
CVE-2023-27078 | Critical | 9.8 | 2023-03-23 | A command injection issue was found in TP-Link MR3020 v.1_150921 that allows a remote attacker to execute arbitrary commands via a crafted request to the tftp… |
CVE-2023-27079 | High | 7.5 | 2023-03-23 | Command Injection vulnerability found in Tenda G103 v.1.0.05 allows an attacker to obtain sensitive information via a crafted package |
CVE-2023-27224 | Critical | 9.8 | 2023-03-22 | An issue found in NginxProxyManager v.2.9.19 allows an attacker to execute arbitrary code via a lua script to the configuration file. |
CVE-2023-1168 | High | 7.2 | 2023-03-22 | An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Successful exploitation of this vulnerability resul… |
CVE-2023-28425 | Medium | 5.5 | 2023-03-20 | Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to… |
CVE-2015-10096 | Medium | 5.0 | 2023-03-20 | A vulnerability, which was classified as critical, was found in Zarthus IRC Twitter Announcer Bot up to 1.1.0. This affects the function get_tweets of the file… |
CVE-2023-28110 | Medium | 5.7 | 2023-03-16 | Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and We… |
CVE-2022-4009 | High | 8.8 | 2023-03-16 | In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation |
CVE-2023-28460 | High | 7.2 | 2023-03-15 | A command injection vulnerability was discovered in Array Networks APV products. A remote attacker can send a crafted packet after logging into the affected ap… |
CVE-2023-1389 | High | 8.8 | 2023-03-15 | TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci… |
CVE-2023-24229 | High | 7.8 | 2023-03-15 | DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system commands via the mai… |
CVE-2023-27240 | Critical | 9.8 | 2023-03-15 | Tenda AX3 V16.03.12.11 was discovered to contain a command injection vulnerability via the lanip parameter at /goform/AdvSetLanip. |
CVE-2023-27581 | High | 8.8 | 2023-03-13 | github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0` and prio… |
CVE-2023-0351 | High | 8.8 | 2023-03-13 | The Akuvox E11 web server backend library allows command injection in the device phone-book contacts functionality. This could allow an attacker to upload file… |
CVE-2023-0978 | Medium | 6.4 | 2023-03-13 | A command injection vulnerability in Trellix Intelligent Sandbox CLI for version 5.2 and earlier, allows a local user to inject and execute arbitrary operatin… |