CWE-77 · Command Injection (page 26)
Page 26 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0628 | Medium | 6.1 | 2023-03-13 | Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to… |
CVE-2023-1277 | High | 7.8 | 2023-03-08 | A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin. Affected is the function InstallSnap of… |
CVE-2023-0093 | High | 8.8 | 2023-03-06 | Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated li… |
CVE-2021-4329 | Medium | 5.5 | 2023-03-05 | A vulnerability, which was classified as critical, has been found in json-logic-js 2.0.0. Affected by this issue is some unknown functionality of the file logi… |
CVE-2023-1162 | High | 7.2 | 2023-03-03 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is an unknown func… |
CVE-2023-1097 | Critical | 9.3 | 2023-03-01 | Baicells EG7035-M11 devices with firmware through BCE-ODU-1.0.8 are vulnerable to improper code exploitation via HTTP GET command injections. Commands are exe… |
CVE-2023-22770 | High | 7.2 | 2023-03-01 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-22769 | High | 7.2 | 2023-03-01 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-22768 | High | 7.2 | 2023-03-01 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-22767 | High | 7.2 | 2023-03-01 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-22766 | High | 7.2 | 2023-03-01 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-22765 | High | 7.2 | 2023-03-01 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-22764 | High | 7.2 | 2023-03-01 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-22763 | High | 7.2 | 2023-03-01 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-22762 | High | 7.2 | 2023-03-01 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-22761 | High | 7.2 | 2023-03-01 | Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities re… |
CVE-2023-22760 | High | 7.2 | 2023-03-01 | Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities re… |
CVE-2023-22759 | High | 7.2 | 2023-03-01 | Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities re… |
CVE-2023-22758 | High | 7.2 | 2023-03-01 | Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities re… |
CVE-2023-22750 | Critical | 9.8 | 2023-03-01 | There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to… |
CVE-2023-22749 | Critical | 9.8 | 2023-03-01 | There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to… |
CVE-2023-22748 | Critical | 9.8 | 2023-03-01 | There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to… |
CVE-2023-22747 | Critical | 9.8 | 2023-03-01 | There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to… |
CVE-2023-20075 | Medium | 6.0 | 2023-03-01 | Vulnerability in the CLI of Cisco Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary commands. These vulnerability is d… |
CVE-2021-3855 | High | 8.8 | 2023-03-01 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Liman Central Management System Liman MYS (HTTP/Controller… |
CVE-2022-48259 | Critical | 9.8 | 2023-02-27 | There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation could allow attackers to gain higher privileges. |
CVE-2022-48255 | Critical | 9.8 | 2023-02-27 | There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. A Huawei printer has a system command injection vulnerability. Successful exploi… |
CVE-2023-23080 | Critical | 9.8 | 2023-02-27 | Certain Tenda products are vulnerable to command injection. This affects Tenda CP7 Tenda CP7<=V11.10.00.2211041403 and Tenda CP3 v.10 Tenda CP3 v.10<=V20220906… |
CVE-2023-26602 | Critical | 9.8 | 2023-02-26 | ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create extensions, as demonstrated by snmpset for N… |
CVE-2023-23295 | High | 8.8 | 2023-02-23 | Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an modify the sysCmd pa… |
CVE-2023-23294 | High | 8.8 | 2023-02-23 | Korenix JetWave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection. An attacker can modify the file_name parameter to execute… |
CVE-2023-23917 | High | 8.8 | 2023-02-23 | A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create thei… |
CVE-2022-45600 | High | 8.8 | 2023-02-22 | Aztech WMB250AC Mesh Routers Firmware Version 016 2020 devices improperly manage sessions, which allows remote attackers to bypass authentication in opportunis… |
CVE-2023-24184 | Critical | 9.8 | 2023-02-21 | TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability. |
CVE-2022-48338 | High | 7.3 | 2023-02-20 | An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-f… |
CVE-2023-25805 | Critical | 9.8 | 2023-02-20 | versionn, software for changing version information across multiple files, has a command injection vulnerability in all versions prior to version 1.1.0. This i… |
CVE-2022-40021 | Critical | 9.8 | 2023-02-17 | QVidium Technologies Amino A140 (prior to firmware version 1.0.0-283) was discovered to contain a command injection vulnerability. |
CVE-2022-45701 | High | 8.8 | 2023-02-17 | Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature. |
CVE-2023-24238 | Critical | 9.8 | 2023-02-16 | TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the city parameter at setting/delStaticDhcpRules. |
CVE-2023-24236 | Critical | 9.8 | 2023-02-16 | TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the province parameter at setting/delStaticDhcpRules. |
CVE-2023-0861 | High | 7.2 | 2023-02-16 | NetModule NSRW web administration interface executes an OS command constructed with unsanitized user input. A successful exploit could allow an authenticated u… |
CVE-2023-0849 | Medium | 4.7 | 2023-02-15 | A vulnerability has been found in Netgear WNDR3700v2 1.0.1.14 and classified as critical. This vulnerability affects unknown code of the component Web Interfac… |
CVE-2023-21778 | High | 8.0 | 2023-02-14 | Microsoft Dynamics Unified Service Desk Remote Code Execution Vulnerability |
CVE-2023-21805 | High | 7.8 | 2023-02-14 | Windows MSHTML Platform Remote Code Execution Vulnerability |
CVE-2023-22935 | High | 8.1 | 2023-02-14 | In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘display.page.search.patterns.sensitivity’ search parameter lets a search bypass SPL safegua… |
CVE-2023-0830 | Medium | 6.3 | 2023-02-14 | A vulnerability classified as critical has been found in EasyNAS 1.1.0. Affected is the function system of the file /backup.pl. The manipulation leads to os co… |
CVE-2023-24161 | Critical | 9.8 | 2023-02-14 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the webWlanIdx parameter in the setWebWlanIdx function. |
CVE-2023-24160 | Critical | 9.8 | 2023-02-14 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function. |
CVE-2023-24159 | Critical | 9.8 | 2023-02-14 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admpass parameter in the setPasswordCfg function. |
CVE-2022-40022 | Critical | 9.8 | 2023-02-13 | Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability. |
CVE-2023-0789 | High | 8.1 | 2023-02-12 | Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2023-0127 | High | 7.8 | 2023-02-11 | A command injection vulnerability in the firmware_update command, in the device's restricted telnet interface, allows an authenticated attacker to execute arbi… |
CVE-2023-0776 | High | 8.1 | 2023-02-11 | Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote shell code exploit… |
CVE-2022-45104 | High | 8.8 | 2023-02-11 | Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain a command execution vulnerability. A low privileged re… |
CVE-2022-43550 | Critical | 9.8 | 2023-02-09 | A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows which could allow a… |
CVE-2023-23333 | Critical | 9.8 | 2023-02-06 | There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloa… |
CVE-2021-31575 | Critical | 9.8 | 2023-02-06 | In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal at… |
CVE-2021-31574 | Critical | 9.8 | 2023-02-06 | In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal at… |
CVE-2021-31573 | Critical | 9.8 | 2023-02-06 | In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal at… |
CVE-2023-24276 | Critical | 9.8 | 2023-02-06 | TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the country parameter at setting/delStaticDhcpRules. |
CVE-2022-25855 | High | 7.4 | 2023-02-06 | All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization. |
CVE-2023-24157 | Critical | 9.8 | 2023-02-03 | A command injection vulnerability in the serverIp parameter in the function updateWifiInfo of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary comman… |
CVE-2023-24156 | Critical | 9.8 | 2023-02-03 | A command injection vulnerability in the ip parameter in the function recvSlaveUpgstatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands… |
CVE-2023-24154 | Critical | 9.8 | 2023-02-03 | TOTOLINK T8 V4.1.5cu was discovered to contain a command injection vulnerability via the slaveIpList parameter in the function setUpgradeFW. |
CVE-2023-24153 | Critical | 9.8 | 2023-02-03 | A command injection vulnerability in the version parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitr… |
CVE-2023-24152 | Critical | 9.8 | 2023-02-03 | A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary comma… |
CVE-2023-24151 | Critical | 9.8 | 2023-02-03 | A command injection vulnerability in the ip parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary c… |
CVE-2023-24150 | Critical | 9.8 | 2023-02-03 | A command injection vulnerability in the serverIp parameter in the function meshSlaveDlfw of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary command… |
CVE-2023-24148 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadUserData function. |
CVE-2023-24146 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the minute parameter in the setRebootScheCfg function. |
CVE-2023-24145 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the plugin_version parameter in the setUnloadUserData function. |
CVE-2023-24144 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the hour parameter in the setRebootScheCfg function. |
CVE-2023-24143 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagTracertHop parameter in the setNetworkDiag function. |
CVE-2023-24142 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingSize parameter in the setNetworkDiag function. |
CVE-2023-24141 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingTimeOut parameter in the setNetworkDiag function. |
CVE-2023-24140 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingNum parameter in the setNetworkDiag function. |
CVE-2023-24139 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagHost parameter in the setNetworkDiag function. |
CVE-2023-24138 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the host_time parameter in the NTPSyncWithHost function. |
CVE-2023-0649 | Medium | 6.3 | 2023-02-02 | A vulnerability has been found in dst-admin 1.5.0 and classified as critical. This vulnerability affects unknown code of the file /home/sendBroadcast. The mani… |
CVE-2023-0648 | Medium | 6.3 | 2023-02-02 | A vulnerability, which was classified as critical, was found in dst-admin 1.5.0. This affects an unknown part of the file /home/masterConsole. The manipulation… |
CVE-2023-0647 | Medium | 6.3 | 2023-02-02 | A vulnerability, which was classified as critical, has been found in dst-admin 1.5.0. Affected by this issue is some unknown functionality of the file /home/ki… |
CVE-2023-0646 | Medium | 6.3 | 2023-02-02 | A vulnerability classified as critical was found in dst-admin 1.5.0. Affected by this vulnerability is an unknown functionality of the file /home/cavesConsole… |
CVE-2023-0640 | High | 7.2 | 2023-02-02 | A vulnerability was found in TRENDnet TEW-652BRP 3.04b01. It has been classified as critical. Affected is an unknown function of the file ping.ccp of the compo… |
CVE-2023-0638 | High | 7.2 | 2023-02-02 | A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical. This vulnerability affects unknown code of the component Web Interfa… |
CVE-2023-22657 | High | 7.0 | 2023-02-01 | On F5OS-A beginning in version 1.2.0 to before 1.3.0 and F5OS-C beginning in version 1.3.0 to before 1.5.0, processing F5OS tenant file names may allow for com… |
CVE-2023-0611 | High | 8.8 | 2023-02-01 | A vulnerability, which was classified as critical, has been found in TRENDnet TEW-652BRP 3.04B01. This issue affects some unknown processing of the file get_se… |
CVE-2022-45095 | Medium | 6.7 | 2023-02-01 | Dell PowerScale OneFS, 8.2.x-9.4.x, contain a command injection vulnerability. An authenticated user having access local shell and having the privilege to gat… |
CVE-2022-25916 | High | 7.4 | 2023-02-01 | Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function. |
CVE-2022-21129 | High | 7.4 | 2023-01-31 | Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function… |
CVE-2023-24612 | Critical | 9.8 | 2023-01-30 | The PdfBook extension through 2.0.5 before b07b6a64 for MediaWiki allows command injection via an option. |
CVE-2021-41231 | High | 7.2 | 2023-01-27 | OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via DataFlow and to create… |
CVE-2021-41144 | High | 8.8 | 2023-01-27 | OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, a layout block was able to bypass the block blacklist to execute remote code. Ve… |
CVE-2021-41143 | High | 7.2 | 2023-01-27 | OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the… |
CVE-2021-39217 | High | 7.2 | 2023-01-27 | OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Custom Layout enabled admin users to execute arbitrary commands via block method… |
CVE-2022-25962 | High | 7.4 | 2023-01-26 | All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization. |
CVE-2022-25908 | High | 7.4 | 2023-01-26 | All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization. |
CVE-2022-25350 | High | 7.4 | 2023-01-26 | All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization. |
CVE-2022-21810 | High | 7.4 | 2023-01-26 | All versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization. |
CVE-2023-22884 | Critical | 9.8 | 2023-01-21 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software… |
CVE-2020-22662 | High | 7.5 | 2023-01-20 | In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199… |