CWE-77 · Command Injection (page 26)
Page 26 of 39 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-34849 | Critical | 9.8 | 2023-06-29 | An unauthorized command injection vulnerability exists in the ActionLogin function of the webman.lua file in Ikuai router OS through 3.7.1. |
CVE-2023-26134 | Critical | 9.8 | 2023-06-28 | Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo () fails to saniti… |
CVE-2023-35932 | High | 7.1 | 2023-06-23 | jcvi is a Python library to facilitate genome assembly, annotation, and comparative genomics. A configuration injection happens when user input is considered b… |
CVE-2023-30260 | High | 8.8 | 2023-06-23 | Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd… |
CVE-2023-30258 | Critical | 9.8 | 2023-06-23 | Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request. |
CVE-2023-26429 | Low | 3.5 | 2023-06-20 | Control characters were not removed when exporting user feedback content. This allowed attackers to include unexpected content via user feedback and potentiall… |
CVE-2023-24032 | High | 7.8 | 2023-06-15 | In Zimbra Collaboration Suite through 9.0 and 8.8.15, an attacker (who has initial user access to a Zimbra server instance) can execute commands as root by pas… |
CVE-2023-31746 | Critical | 9.8 | 2023-06-14 | There is a command injection vulnerability in the adslr VW2100 router with firmware version M1DV1.0. An unauthenticated attacker can exploit the vulnerability… |
CVE-2023-27836 | Critical | 9.8 | 2023-06-13 | TP-Link TL-WPA8630P (US)_ V2_ Version 171011 was discovered to contain a command injection vulnerability via the devicePwd parameter in the function sub_ 40A80… |
CVE-2023-27837 | Critical | 9.8 | 2023-06-13 | TP-Link TL-WPA8630P (US)_ V2_ Version 171011 was discovered to contain a command injection vulnerability via the key parameter in the function sub_ 40A774. |
CVE-2023-33919 | High | 7.2 | 2023-06-13 | A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). The web interface… |
CVE-2023-26298 | High | 8.8 | 2023-06-12 | Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. |
CVE-2023-26297 | High | 8.8 | 2023-06-12 | Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. |
CVE-2023-26296 | High | 8.8 | 2023-06-12 | Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. |
CVE-2023-26295 | Critical | 9.8 | 2023-06-12 | Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. |
CVE-2023-26294 | High | 7.8 | 2023-06-12 | Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. |
CVE-2023-33625 | Critical | 9.8 | 2023-06-12 | D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a command injection vulnerability via the ST parameter in the lxmldbc_syste… |
CVE-2023-34105 | High | 7.5 | 2023-06-12 | SRS is a real-time video server supporting RTMP, WebRTC, HLS, HTTP-FLV, SRT, MPEG-DASH, and GB28181. Prior to versions 5.0.157, 5.0-b1, and 6.0.48, SRS's `api-… |
CVE-2023-3206 | Medium | 5.3 | 2023-06-12 | A vulnerability classified as problematic was found in Chengdu VEC40G 3.0. Affected by this vulnerability is an unknown functionality of the file /send_order.c… |
CVE-2022-38156 | High | 7.2 | 2023-06-12 | A remote command injection issues exists in the web server of the Kratos SpectralNet device with SpectralNet Narrowband (NB) before 1.7.5. As an admin user, an… |
CVE-2023-35035 | High | 8.8 | 2023-06-12 | Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8, and Manager… |
CVE-2023-35033 | High | 8.8 | 2023-06-12 | Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8, and Manager… |
CVE-2023-35032 | High | 8.8 | 2023-06-12 | Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow command injection by… |
CVE-2023-35031 | High | 8.8 | 2023-06-12 | Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8, and Manager… |
CVE-2023-25911 | Critical | 9.9 | 2023-06-11 | The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application parameters. |
CVE-2023-34233 | High | 8.8 | 2023-06-08 | The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations… |
CVE-2023-34232 | High | 7.3 | 2023-06-08 | snowflake-connector-nodejs, a NodeJS driver for Snowflake, is vulnerable to command injection via single sign on (SSO) browser URL authentication in versions p… |
CVE-2023-34230 | High | 7.3 | 2023-06-08 | snowflake-connector-net, the Snowflake Connector for .NET, is vulnerable to command injection prior to version 2.0.18 via SSO URL authentication. In order to e… |
CVE-2023-34231 | High | 8.8 | 2023-06-08 | gosnowflake is th Snowflake Golang driver. Prior to version 1.6.19, a command injection vulnerability exists in the Snowflake Golang driver via single sign-on… |
CVE-2023-33556 | Critical | 9.8 | 2023-06-07 | TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the staticGw parameter at /setting/setWanIeCfg. |
CVE-2023-20889 | High | 7.5 | 2023-06-07 | Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may… |
CVE-2023-20887 | Critical | 9.8 | 2023-06-07 | Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be ab… |
CVE-2023-33538 | High | 8.8 | 2023-06-07 | TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetwo… |
CVE-2023-33782 | High | 8.8 | 2023-06-07 | D-Link DIR-842V2 v1.0.3 was discovered to contain a command injection vulnerability via the iperf3 diagnostics function. |
CVE-2023-30400 | Critical | 9.8 | 2023-06-07 | An issue was discovered in Anyka Microelectronics AK3918EV300 MCU v18. A command injection vulnerability in the network configuration script within the MCU's o… |
CVE-2022-25834 | High | 7.8 | 2023-06-07 | In Percona XtraBackup (PXB) through 2.2.24 and 3.x through 8.0.27-19, a crafted filename on the local file system could trigger unexpected command shell execut… |
CVE-2023-34111 | High | 8.1 | 2023-06-06 | The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerability which allows for arbitrary code exec… |
CVE-2023-33533 | High | 8.8 | 2023-06-06 | Netgear D6220 with Firmware Version 1.0.0.80, D8500 with Firmware Version 1.0.3.60, R6700 with Firmware Version 1.0.2.26, and R6900 with Firmware Version 1.0.2… |
CVE-2023-33532 | Critical | 9.8 | 2023-06-06 | There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48. If an attacker gains web management privileges, they can… |
CVE-2023-31569 | Critical | 9.8 | 2023-06-06 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection via the setWanCfg function. |
CVE-2023-33530 | High | 8.8 | 2023-06-06 | There is a command injection vulnerability in the Tenda G103 Gigabit GPON Terminal with firmware version V1.0.0.5. If an attacker gains web management privileg… |
CVE-2023-0636 | High | 7.2 | 2023-06-05 | Improper Input Validation vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103… |
CVE-2023-23952 | Critical | 9.8 | 2023-06-01 | Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Command Injection vulnerability. |
CVE-2023-33722 | High | 8.8 | 2023-05-31 | EDIMAX BR-6288ACL v1.12 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the pppUserName parameter. |
CVE-2023-33487 | Critical | 9.8 | 2023-05-31 | TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a command insertion vulnerability in setDiagnosisCfg.This vulnerability allows an at… |
CVE-2023-33486 | Critical | 9.8 | 2023-05-31 | TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setOpModeCfg. This vulnerability allows an attac… |
CVE-2023-34153 | High | 7.8 | 2023-05-30 | A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VI… |
CVE-2022-47028 | Medium | 5.5 | 2023-05-30 | An issue discovered in Action Launcher for Android v50.5 allows an attacker to cause a denial of service via arbitary data injection to function insert. |
CVE-2022-46361 | Medium | 6.9 | 2023-05-30 | An attacker having physical access to WDM can plug USB device to gain access and execute unwanted commands. A malicious user could enter a system command along… |
CVE-2023-26130 | High | 7.5 | 2023-05-30 | Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in… |
CVE-2022-24630 | High | 7.2 | 2023-05-29 | An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. BrowseFiles.php allows a ?cmd=ssh POST request with an ssh_command field… |
CVE-2020-29547 | Medium | 5.9 | 2023-05-29 | An issue was discovered in Citadel through webcit-926. Meddler-in-the-middle attackers can pipeline commands after POP3 STLS, IMAP STARTTLS, or SMTP STARTTLS c… |
CVE-2015-20108 | Critical | 9.8 | 2023-05-27 | xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used. |
CVE-2023-26129 | High | 8.4 | 2023-05-27 | All versions of the package bwm-ng are vulnerable to Command Injection due to improper input sanitization in the 'check' function in the bwm-ng.js file. **No… |
CVE-2023-26128 | High | 8.4 | 2023-05-27 | All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employ… |
CVE-2023-26127 | High | 7.8 | 2023-05-27 | All versions of the package n158 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function. **Note:** To execut… |
CVE-2023-31460 | High | 7.2 | 2023-05-24 | A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated attacker with intern… |
CVE-2023-2868 | Critical | 9.4 | 2023-05-24 | A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0… |
CVE-2023-31996 | High | 8.8 | 2023-05-23 | Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Command Injection due to improper sanitization of special characters for the NAS storage test function. |
CVE-2023-31741 | High | 7.2 | 2023-05-23 | There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management privileges, they can i… |
CVE-2023-31740 | High | 7.2 | 2023-05-23 | There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management privileges, they can i… |
CVE-2023-31742 | High | 7.2 | 2023-05-22 | There is a command injection vulnerability in the Linksys WRT54GL router with firmware version 4.30.18.006. If an attacker gains web management privileges, the… |
CVE-2023-33294 | Critical | 9.8 | 2023-05-22 | An issue was discovered in KaiOS 3.0 before 3.1. The /system/bin/tctweb_server binary exposes a local web server that responds to GET and POST requests on port… |
CVE-2023-33235 | High | 7.2 | 2023-05-22 | MXsecurity version 1.0 is vulnearble to command injection vulnerability. This vulnerability has been reported in the SSH CLI program, which can be exploited by… |
CVE-2023-32700 | High | 7.8 | 2023-05-20 | LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core… |
CVE-2023-31729 | Critical | 9.8 | 2023-05-18 | TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi. |
CVE-2023-2491 | High | 7.8 | 2023-05-17 | A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result i… |
CVE-2023-31701 | High | 8.8 | 2023-05-17 | TP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via _httpRpmPlcDeviceRemove. |
CVE-2023-31700 | High | 8.8 | 2023-05-17 | TP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via _httpRpmPlcDeviceAdd. |
CVE-2023-31208 | High | 8.3 | 2023-05-17 | Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8 (beta) allows arbitrary livestatus com… |
CVE-2023-31856 | Critical | 9.8 | 2023-05-16 | A command injection vulnerability in the hostTime parameter in the function NTPSyncWithHostof TOTOLINK CP300+ V5.2cu.7594_B20200910 allows attackers to execute… |
CVE-2023-31986 | Critical | 9.8 | 2023-05-15 | A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the setWAN function in /bi… |
CVE-2023-31983 | Critical | 9.8 | 2023-05-12 | A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the mp function in /bin/we… |
CVE-2023-32073 | High | 8.8 | 2023-05-12 | WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` w… |
CVE-2023-2682 | Medium | 6.3 | 2023-05-12 | A vulnerability was found in Caton Live up to 2023-04-26 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/ping.cgi o… |
CVE-2023-31985 | Critical | 9.8 | 2023-05-12 | A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the formAccept function in… |
CVE-2023-31531 | High | 8.8 | 2023-05-11 | Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the tomography_ping_number parameter. |
CVE-2023-31530 | High | 8.8 | 2023-05-11 | Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the smartqos_priority_devices parameter. |
CVE-2023-31529 | High | 8.8 | 2023-05-11 | Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the system_time_timezone parameter. |
CVE-2023-31528 | High | 8.8 | 2023-05-11 | Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the staticroute_list parameter. |
CVE-2023-24540 | Critical | 9.8 | 2023-05-11 | Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f… |
CVE-2023-31473 | Medium | 4.9 | 2023-05-11 | An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. Thi… |
CVE-2023-2649 | High | 7.2 | 2023-05-11 | A vulnerability was found in Tenda AC23 16.03.07.45_cn. It has been declared as critical. This vulnerability affects unknown code of the file /bin/ate of the c… |
CVE-2023-2647 | Medium | 6.3 | 2023-05-11 | A vulnerability was found in Weaver E-Office 9.5 and classified as critical. Affected by this issue is some unknown functionality of the file /webroot/inc/util… |
CVE-2022-29842 | Critical | 9.8 | 2023-05-10 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability that could allow an attacker to execute code in the context o… |
CVE-2023-30353 | Critical | 9.8 | 2023-05-10 | Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows unauthenticated remote code execution via an XML document. |
CVE-2023-31476 | High | 7.5 | 2023-05-09 | An issue was discovered on GL.iNet devices running firmware before 3.216. There is an arbitrary file write in which an empty file can be created almost anywher… |
CVE-2023-28832 | High | 7.2 | 2023-05-09 | A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1)… |
CVE-2023-27407 | Critical | 9.9 | 2023-05-09 | A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web based management of affected device does not properly validate user inpu… |
CVE-2023-22790 | High | 7.2 | 2023-05-08 | Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these v… |
CVE-2023-22789 | High | 7.2 | 2023-05-08 | Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these v… |
CVE-2023-22788 | High | 7.2 | 2023-05-08 | Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these v… |
CVE-2023-2574 | High | 8.8 | 2023-05-08 | Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the device name input field, which can be tri… |
CVE-2023-2573 | High | 8.8 | 2023-05-08 | Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the NTP server input field, which can be trig… |
CVE-2023-30135 | Critical | 9.8 | 2023-05-05 | Tenda AC18 v15.03.05.19(6318_)_cn was discovered to contain a command injection vulnerability via the deviceName parameter in the setUsbUnload function. |
CVE-2023-2520 | High | 8.8 | 2023-05-04 | A vulnerability was found in Caton Prime 2.1.2.51.e8d7225049(202303031001) and classified as critical. This issue affects some unknown processing of the file c… |
CVE-2023-26125 | Medium | 5.6 | 2023-05-04 | Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted re… |
CVE-2023-32007 | High | 8.8 | 2023-05-02 | ** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authenticatio… |
CVE-2023-2378 | High | 7.2 | 2023-04-28 | A flaw has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown function of the component Web Management Interface. This manipulat… |
CVE-2023-2377 | High | 7.2 | 2023-04-28 | A vulnerability was detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The impacted element is an unknown function of the component Web Management Interfa… |