CWE-77 · Command Injection (page 27)
Page 27 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-20045 | Medium | 4.9 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Small Business RV160 and RV260 Series VPN Routers could allow an authenticated, remote attacker… |
CVE-2023-20026 | Medium | 6.5 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320 and RV325 Routers could allow an authenticated… |
CVE-2023-0315 | High | 8.8 | 2023-01-16 | Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8. |
CVE-2023-22496 | High | 8.1 | 2023-01-14 | Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the ability to establish a streaming connection… |
CVE-2022-41955 | High | 8.8 | 2023-01-14 | Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded p… |
CVE-2022-21191 | High | 7.4 | 2023-01-13 | Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes be… |
CVE-2022-4616 | High | 7.2 | 2023-01-13 | The webserver in Delta DX-3021 versions prior to 1.24 is vulnerable to command injection through the network diagnosis page. This vulnerability could allow a… |
CVE-2020-36650 | Medium | 5.5 | 2023-01-11 | A vulnerability, which was classified as critical, was found in IonicaBizau node-gry up to 5.x. This affects an unknown part. The manipulation leads to command… |
CVE-2022-45094 | High | 8.4 | 2023-01-10 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (… |
CVE-2022-39073 | Critical | 9.8 | 2023-01-06 | There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the vulnerability to ex… |
CVE-2020-36642 | Medium | 5.5 | 2023-01-06 | A vulnerability was found in trampgeek jobe up to 1.6.x and classified as critical. This issue affects the function run_in_sandbox of the file application/libr… |
CVE-2023-22671 | Critical | 9.8 | 2023-01-06 | Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injection when calling anal… |
CVE-2022-25923 | High | 7.4 | 2023-01-06 | Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess() functionality due to improper user-input sanitizat… |
CVE-2021-4304 | Medium | 6.3 | 2023-01-05 | A vulnerability was found in eprintsug ulcc-core. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file cgi/… |
CVE-2022-39088 | Medium | 6.7 | 2023-01-04 | In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
CVE-2022-39087 | Medium | 6.7 | 2023-01-04 | In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
CVE-2022-39086 | Medium | 6.7 | 2023-01-04 | In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
CVE-2022-39085 | Medium | 6.7 | 2023-01-04 | In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
CVE-2022-39084 | Medium | 6.7 | 2023-01-04 | In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
CVE-2022-39083 | Medium | 6.7 | 2023-01-04 | In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
CVE-2022-39082 | Medium | 6.7 | 2023-01-04 | In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
CVE-2022-39081 | Medium | 6.7 | 2023-01-04 | In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
CVE-2022-32665 | Critical | 9.8 | 2023-01-03 | In Boa, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with no additional execution… |
CVE-2022-32664 | High | 8.8 | 2023-01-03 | In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with User executio… |
CVE-2017-20156 | Medium | 5.5 | 2022-12-31 | A vulnerability was found in Exciting Printer and classified as critical. This issue affects some unknown processing of the file lib/printer/jobs/prepare_page… |
CVE-2022-44621 | Critical | 9.8 | 2022-12-30 | Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request. |
CVE-2022-46642 | Critical | 9.9 | 2022-12-23 | D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the auto_upgrade_hour parameter in the SetAutoUpgradeInfo function. |
CVE-2022-46641 | Critical | 9.9 | 2022-12-23 | D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the lan(0)_dhcps_staticlist parameter in the SetIpMacBindSettings fu… |
CVE-2021-32692 | Critical | 9.6 | 2022-12-23 | Activity Watch is a free and open-source automated time tracker. Versions prior to 0.11.0 allow an attacker to execute arbitrary commands on any macOS machine… |
CVE-2020-15685 | High | 8.8 | 2022-12-22 | During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. This vulner… |
CVE-2022-46421 | Critical | 9.8 | 2022-12-20 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.Th… |
CVE-2022-45796 | Critical | 9.1 | 2022-12-16 | Command injection vulnerability in nw_interface.html in SHARP multifunction printers (MFPs)'s Digital Full-color Multifunctional System 202 or earlier, 120 or… |
CVE-2022-31702 | Critical | 9.8 | 2022-12-14 | vRealize Network Insight (vRNI) contains a command injection vulnerability present in the vRNI REST API. A malicious actor with network access to the vRNI REST… |
CVE-2022-44832 | Critical | 9.8 | 2022-12-14 | D-Link DIR-3040 device with firmware 120B03 was discovered to contain a command injection vulnerability via the SetTriggerLEDBlink function. |
CVE-2022-46404 | Critical | 9.8 | 2022-12-13 | A command injection vulnerability has been identified in Atos Unify OpenScape 4000 Assistant and Unify OpenScape 4000 Manager (8 before R2.22.18, 10 before 0.2… |
CVE-2022-4364 | High | 7.3 | 2022-12-08 | A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16. Affected by this issue is some unknown functionality of the file palette.php of the componen… |
CVE-2022-41800 | High | 8.7 | 2022-12-07 | In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrict… |
CVE-2022-3086 | High | 7.1 | 2022-12-02 | Cradlepoint IBR600 NCOS versions 6.5.0.160bc2e and prior are vulnerable to shell escape, which enables local attackers with non-superuser credentials to gain… |
CVE-2022-36962 | High | 7.2 | 2022-11-29 | SolarWinds Platform was susceptible to Command Injection. This vulnerability allows a remote adversary with complete control over the SolarWinds database to ex… |
CVE-2022-40282 | High | 8.8 | 2022-11-25 | The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command injection. This allows an authenticated attacker to pass commands to the… |
CVE-2022-45462 | Critical | 9.8 | 2022-11-23 | Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to versio… |
CVE-2022-40770 | High | 7.2 | 2022-11-23 | Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by high-privileged users. |
CVE-2020-23584 | Critical | 9.8 | 2022-11-23 | Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes arbitrary commands with IP-ADDRESS using… |
CVE-2020-23583 | Critical | 9.8 | 2022-11-23 | OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution. The issue occurs when the attacker sends an arbitrary code on "/diag_ping_admin.asp" to "Ping… |
CVE-2022-40765 | Medium | 6.8 | 2022-11-22 | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network… |
CVE-2022-40746 | High | 7.2 | 2022-11-21 | IBM i Access Family 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused… |
CVE-2022-42904 | High | 7.2 | 2022-11-18 | Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings. |
CVE-2022-36786 | Critical | 9.9 | 2022-11-17 | DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 has an interface where you can configure NTP servers (Network Time Protocol) via jsonrpc API. It is p… |
CVE-2022-40881 | Critical | 9.8 | 2022-11-17 | SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.php |
CVE-2022-43781 | Critical | 9.8 | 2022-11-17 | There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their userna… |
CVE-2022-40752 | Critical | 9.8 | 2022-11-16 | IBM InfoSphere DataStage 11.7 is vulnerable to a command injection vulnerability due to improper neutralization of special elements. IBM X-Force ID: 236687. |
CVE-2022-20934 | Medium | 6.0 | 2022-11-15 | A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software and Cisco FXOS Software could allow an authenticated, local attacker to execute arb… |
CVE-2022-20926 | Medium | 6.3 | 2022-11-15 | A vulnerability in the web management interface of the Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execut… |
CVE-2022-20925 | Medium | 6.3 | 2022-11-15 | A vulnerability in the web management interface of the Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execut… |
CVE-2022-45063 | Critical | 9.8 | 2022-11-10 | xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi lin… |
CVE-2022-43109 | Critical | 9.8 | 2022-11-03 | D-Link DIR-823G v1.0.2 was found to contain a command injection vulnerability in the function SetNetworkTomographySettings. This vulnerability allows attackers… |
CVE-2022-37425 | Critical | 9.9 | 2022-10-28 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in OpenNebula OpenNebula core on Linux allows Remote Code Inc… |
CVE-2022-43367 | Critical | 9.8 | 2022-10-27 | IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the formSetDebugCfg function. |
CVE-2022-35271 | High | 7.5 | 2022-10-25 | A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can… |
CVE-2022-35270 | High | 7.5 | 2022-10-25 | A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can… |
CVE-2022-35269 | High | 7.5 | 2022-10-25 | A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can… |
CVE-2022-35267 | High | 7.5 | 2022-10-25 | A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can… |
CVE-2022-35266 | High | 7.5 | 2022-10-25 | A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can… |
CVE-2022-35265 | High | 7.5 | 2022-10-25 | A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can… |
CVE-2022-32765 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the sysupgrade command injection functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network… |
CVE-2021-26731 | Critical | 9.1 | 2022-10-24 | Command injection and multiple stack-based buffer overflows vulnerabilities in the modifyUserb_func function of spx_restservice allow an authenticated attacker… |
CVE-2021-26729 | Critical | 10.0 | 2022-10-24 | Command injection and multiple stack-based buffer overflows vulnerabilities in the Login_handler_func function of spx_restservice allow an attacker to execute… |
CVE-2021-26728 | Critical | 10.0 | 2022-10-24 | Command injection and stack-based buffer overflow vulnerabilities in the KillDupUsr_func function of spx_restservice allow an attacker to execute arbitrary cod… |
CVE-2021-26727 | Critical | 10.0 | 2022-10-24 | Multiple command injections and stack-based buffer overflows vulnerabilities in the SubNet_handler_func function of spx_restservice allow an attacker to execut… |
CVE-2022-41617 | High | 7.2 | 2022-10-19 | In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, When the Advanced WAF / ASM module is provision… |
CVE-2016-20017 | Critical | 9.8 | 2022-10-19 | D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2… |
CVE-2022-42161 | High | 8.8 | 2022-10-13 | D-Link COVR 1200,1202,1203 v1.08 was discovered to contain a command injection vulnerability via the /SetTriggerWPS/PIN parameter at function SetTriggerWPS. |
CVE-2022-42160 | High | 8.8 | 2022-10-13 | D-Link COVR 1200,1202,1203 v1.08 was discovered to contain a command injection vulnerability via the system_time_timezone parameter at function SetNTPServerSet… |
CVE-2022-42156 | High | 8.8 | 2022-10-13 | D-Link COVR 1200,1203 v1.08 was discovered to contain a command injection vulnerability via the tomography_ping_number parameter at function SetNetworkTomograp… |
CVE-2022-42906 | High | 7.8 | 2022-10-13 | powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that chan… |
CVE-2022-42897 | Critical | 9.8 | 2022-10-13 | Array Networks AG/vxAG with ArrayOS AG before 9.4.0.469 allows unauthenticated command injection that leads to privilege escalation and control of the system… |
CVE-2022-34432 | High | 7.3 | 2022-10-11 | Dell Hybrid Client below 1.8 version contains a gedit vulnerability. A guest attacker could potentially exploit this vulnerability, allowing deletion of user a… |
CVE-2022-39265 | High | 7.2 | 2022-10-06 | MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connecti… |
CVE-2022-20851 | Medium | 5.5 | 2022-09-30 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected… |
CVE-2022-41870 | High | 7.2 | 2022-09-30 | AP Manager in Innovaphone before 13r2 Service Release 17 allows command injection via a modified service ID during app upload. |
CVE-2022-39243 | High | 8.4 | 2022-09-26 | NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang… |
CVE-2022-40100 | Critical | 9.8 | 2022-09-23 | Tenda i9 v1.0.0.8(3828) was discovered to contain a command injection vulnerability via the FormexeCommand function. |
CVE-2022-37883 | High | 7.2 | 2022-09-20 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2022-37881 | High | 7.2 | 2022-09-20 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2022-37879 | High | 7.2 | 2022-09-20 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2022-28220 | High | 7.5 | 2022-09-08 | Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solv… |
CVE-2022-3008 | High | 8.1 | 2022-09-05 | The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This functi… |
CVE-2022-37125 | Critical | 9.8 | 2022-08-31 | D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/NTPSyncWithHost. |
CVE-2022-34383 | High | 8.1 | 2022-08-31 | Dell Edge Gateway 5200 (EGW) versions before 1.03.10 contain an operating system command injection vulnerability. A local malicious user may potentially exploi… |
CVE-2022-21941 | Critical | 10.0 | 2022-08-31 | All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow an unauthenticated user root access to the syste… |
CVE-2022-36559 | Critical | 9.8 | 2022-08-29 | Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain a command injection vulnerability via the Ping parameter at ping_exec.cgi. |
CVE-2022-36556 | Critical | 9.8 | 2022-08-29 | Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain a command injection vulnerability via the ipAddress parameter at 07system08execute_ping… |
CVE-2022-36554 | Critical | 9.8 | 2022-08-29 | A command injection vulnerability in the CLI (Command Line Interface) implementation of Hytec Inter HWL-2511-SS v1.05 and below allows attackers to execute arb… |
CVE-2022-36553 | Critical | 9.8 | 2022-08-29 | Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi. |
CVE-2022-2234 | Critical | 9.9 | 2022-08-24 | An authenticated mySCADA myPRO 8.26.0 user may be able to modify parameters to run commands directly in the operating system. |
CVE-2022-36523 | Critical | 9.8 | 2022-08-15 | D-Link Go-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to command injection via /htdocs/upnpinc/gena.php. |
CVE-2022-35954 | Medium | 5.0 | 2022-08-15 | The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The `core.exportVariable` function uses a well known delimiter that atta… |
CVE-2022-35518 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 nas.cgi has no filtering on parameters: User1Passwd and User1, which leads to command injection in page /n… |
CVE-2022-20345 | High | 8.8 | 2022-08-10 | In l2cble_process_sig_cmd of l2c_ble.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over B… |
CVE-2022-34660 | Critical | 9.8 | 2022-08-10 | A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.15), Teamcenter V13.0 (All versions < V13.0.0.10), Teamcenter V13.1 (All versio… |