CWE-77 · Command Injection (page 28)
Page 28 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-34974 | Critical | 9.8 | 2022-08-03 | D-Link DIR810LA1_FW102B22 was discovered to contain a command injection vulnerability via the Ping_addr function. |
CVE-2020-7795 | High | 7.3 | 2022-08-02 | The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js. |
CVE-2020-28453 | Critical | 9.4 | 2022-08-02 | This affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js. |
CVE-2020-28451 | Critical | 9.8 | 2022-08-02 | This affects the package image-tiler before 2.0.2. |
CVE-2020-28437 | Critical | 9.4 | 2022-08-02 | This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js. |
CVE-2020-28434 | Critical | 9.4 | 2022-08-02 | This affects all versions of package gitblame. The injection point is located in line 15 in lib/gitblame.js. |
CVE-2020-28433 | High | 7.3 | 2022-08-02 | This affects all versions of package node-latex-pdf. |
CVE-2020-28425 | High | 7.3 | 2022-08-02 | This affects all versions of package curljs. |
CVE-2020-28423 | Critical | 9.8 | 2022-08-02 | This affects all versions of package monorepo-build. |
CVE-2022-2323 | High | 8.8 | 2022-07-29 | Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remote code execution in the host system. Th… |
CVE-2022-29558 | High | 8.8 | 2022-07-28 | Realtek rtl819x-SDK before v3.6.1 allows command injection over the web interface. |
CVE-2016-4991 | Critical | 9.8 | 2022-07-28 | Input passed to the Pdf() function is shell escaped and passed to child_process.exec() during PDF rendering. However, the shell escape does not properly encode… |
CVE-2020-28447 | Critical | 9.8 | 2022-07-25 | This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopen(filepath) |
CVE-2020-28446 | Critical | 9.8 | 2022-07-25 | The package ntesseract before 0.2.9 are vulnerable to Command Injection via lib/tesseract.js. |
CVE-2020-28445 | Critical | 9.8 | 2022-07-25 | This affects all versions of package npm-help. The injection point is located in line 13 in index.js file in export.latestVersion() function. |
CVE-2020-28443 | Critical | 9.8 | 2022-07-25 | This affects all versions of package sonar-wrapper. The injection point is located in lib/sonarRunner.js. |
CVE-2020-28438 | Critical | 9.8 | 2022-07-25 | This affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js |
CVE-2020-28436 | High | 7.3 | 2022-07-25 | This affects all versions of package google-cloudstorage-commands. |
CVE-2020-28435 | Critical | 9.4 | 2022-07-25 | This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js. |
CVE-2020-28422 | Medium | 6.4 | 2022-07-25 | All versions of package git-archive are vulnerable to Command Injection via the exports function. |
CVE-2022-2143 | Critical | 9.8 | 2022-07-22 | The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code. |
CVE-2022-0902 | High | 8.1 | 2022-07-21 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injecti… |
CVE-2022-31161 | Critical | 10.0 | 2022-07-15 | Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subproc… |
CVE-2022-34820 | High | 8.4 | 2022-07-12 | A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions < V3.3.46), SIMATIC CP 1243-1 (All versions < V3.3.46), SIMATIC CP 1243-7 LTE EU (All… |
CVE-2022-29560 | High | 7.2 | 2022-07-12 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < 2.15.1), RUGGEDCOM ROX MX5000RE (All versions < 2.15.1), RUGGEDCOM ROX RX1400 (All… |
CVE-2022-34592 | Critical | 9.8 | 2022-07-07 | Wavlink WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability via the function obtw. This vulnerability allows attackers… |
CVE-2022-32449 | Critical | 9.8 | 2022-07-07 | TOTOLINK EX300_V2 V4.0.3c.7484 was discovered to contain a command injection vulnerability via the langType parameter in the setLanguageCfg function. This vuln… |
CVE-2022-28935 | High | 7.2 | 2022-07-06 | Totolink A830R V5.9c.4729_B20191112, Totolink A3100R V4.1.2cu.5050_B20200504, Totolink A950RG V4.1.2cu.5161_B20200903, Totolink A800R V4.1.2cu.5137_B20200730… |
CVE-2022-28171 | High | 7.5 | 2022-06-27 | The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attac… |
CVE-2022-31874 | Critical | 9.8 | 2022-06-17 | ASUS RT-N53 3.0.0.4.376.3754 has a command injection vulnerability in the SystemCmd parameter of the apply.cgi interface. |
CVE-2022-32154 | Medium | 6.8 | 2022-06-15 | Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a… |
CVE-2022-32262 | High | 8.8 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a file upload server that is vulne… |
CVE-2020-36529 | High | 8.8 | 2022-06-07 | A vulnerability classified as critical has been found in SevOne Network Management System up to 5.7.2.22. This affects the file traceroute.php of the Tracerout… |
CVE-2019-9972 | High | 8.8 | 2022-06-07 | PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an authenticated attacker to run arbitrary commands with the phonesyste… |
CVE-2022-29712 | Critical | 9.8 | 2022-06-02 | LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param parameters. |
CVE-2022-29256 | Medium | 6.5 | 2022-05-25 | sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at `npm install` tim… |
CVE-2022-30321 | High | 8.6 | 2022-05-25 | go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 an… |
CVE-2022-28618 | Critical | 9.8 | 2022-05-20 | A command injection security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble St… |
CVE-2022-29184 | High | 8.8 | 2022-05-20 | GoCD is a continuous delivery server. In GoCD versions prior to 22.1.0, it is possible for existing authenticated users who have permissions to edit or create… |
CVE-2022-24394 | High | 8.8 | 2022-05-17 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “update_checkfile” value… |
CVE-2022-24393 | High | 8.8 | 2022-05-17 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “check_vertica_upgrade”… |
CVE-2022-24392 | High | 8.8 | 2022-05-17 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “feed_comm_test” value f… |
CVE-2022-24390 | High | 8.8 | 2022-05-17 | Vulnerability in rconfig “remote_text_file” enables an attacker with user level access to the CLI to inject user level commands into Fidelis Network and Decept… |
CVE-2022-24389 | High | 8.8 | 2022-05-17 | Vulnerability in rconfig “cert_utils” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception Co… |
CVE-2022-24388 | High | 8.8 | 2022-05-17 | Vulnerability in rconfig “date” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandP… |
CVE-2022-26085 | High | 8.8 | 2022-05-12 | An OS command injection vulnerability exists in the httpd wlscan_ASP functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can… |
CVE-2022-26042 | High | 8.8 | 2022-05-12 | An OS command injection vulnerability exists in the daretools binary functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request c… |
CVE-2022-26007 | High | 7.2 | 2022-05-12 | An OS command injection vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request ca… |
CVE-2022-27806 | High | 8.7 | 2022-05-05 | On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all vers… |
CVE-2022-27588 | Critical | 9.8 | 2022-05-05 | We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.6 build 20220401 and later |
CVE-2022-26415 | High | 7.7 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all… |
CVE-2021-44051 | High | 8.8 | 2022-05-05 | A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows remote att… |
CVE-2022-20801 | Medium | 4.7 | 2022-05-04 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to… |
CVE-2022-20799 | Medium | 4.7 | 2022-05-04 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to… |
CVE-2021-43163 | Critical | 9.8 | 2022-05-04 | A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the checkNet fu… |
CVE-2021-43162 | High | 8.8 | 2022-05-04 | A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the runPackDiag… |
CVE-2021-43161 | High | 8.8 | 2022-05-04 | A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the doSwitchApi… |
CVE-2021-43160 | High | 8.8 | 2022-05-04 | A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the switchFastD… |
CVE-2021-43159 | High | 8.8 | 2022-05-04 | A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the setSessionT… |
CVE-2022-1509 | Critical | 9.9 | 2022-04-28 | Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitr… |
CVE-2021-34592 | High | 8.8 | 2022-04-27 | In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands i… |
CVE-2022-26826 | High | 7.2 | 2022-04-15 | Windows DNS Server Remote Code Execution Vulnerability |
CVE-2021-43286 | High | 8.8 | 2022-04-14 | An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker with privileges to create a new pipeline on a GoCD server can abuse a command-line inje… |
CVE-2015-20107 | High | 7.6 | 2022-04-13 | In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow att… |
CVE-2022-26151 | High | 7.2 | 2022-04-13 | Citrix XenMobile Server 10.12 through RP11, 10.13 through RP7, and 10.14 through RP4 allows Command Injection. |
CVE-2021-44520 | High | 8.8 | 2022-04-13 | In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Command Injection vulnerability, leading to remote code execution with root privileges. |
CVE-2022-0999 | High | 8.8 | 2022-04-11 | An authenticated user may be able to misuse parameters to inject arbitrary operating system commands into mySCADA myPRO versions 8.25.0 and prior. |
CVE-2021-43474 | Critical | 9.8 | 2022-04-07 | An Access Control vulnerability exists in D-Link DIR-823G REVA1 1.02B05 (Lastest) via any parameter in the HNAP1 function |
CVE-2022-20665 | Medium | 6.0 | 2022-04-06 | A vulnerability in the CLI of Cisco StarOS could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due… |
CVE-2021-32933 | Critical | 10.0 | 2022-04-01 | An attacker could leverage an API to pass along a malicious file that could then manipulate the process creation command line in MDT AutoSave versions prior to… |
CVE-2021-23247 | Critical | 9.8 | 2022-04-01 | A command injection vulerability found in quick game engine allows arbitrary remote code in quick app. Allows remote attacke0rs to gain arbitrary code executio… |
CVE-2021-43663 | High | 7.5 | 2022-03-31 | totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component cloudupdate_check. |
CVE-2021-43664 | High | 8.1 | 2022-03-30 | totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component process forceugpo. |
CVE-2022-25619 | Low | 3.8 | 2022-03-30 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in ping tool of Profelis IT Consultancy SambaBox allows AUTHE… |
CVE-2021-43118 | Critical | 9.8 | 2022-03-29 | A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3, DrayTek Vigor 3900 1.5.1.3, and DrayTek Vigor 300B 1.5.1.3 via a crafted HTTP me… |
CVE-2022-22688 | High | 8.8 | 2022-03-25 | Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology DiskStation Manager… |
CVE-2022-27083 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadAccessCodePic. |
CVE-2022-27082 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetInternetLanInfo. |
CVE-2022-27081 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetLanInfo. |
CVE-2022-27080 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setWorkmode. |
CVE-2022-27079 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setPicListItem. |
CVE-2022-27078 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setAdInfoDetail. |
CVE-2022-27077 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadWeiXinPic. |
CVE-2022-27076 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/delAd. |
CVE-2022-26536 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setFixTools. |
CVE-2022-26189 | Critical | 9.8 | 2022-03-22 | TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the langType parameter in the login interface. |
CVE-2022-26188 | Critical | 9.8 | 2022-03-22 | TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost. |
CVE-2022-26187 | Critical | 9.8 | 2022-03-22 | TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function. |
CVE-2022-26186 | Critical | 9.8 | 2022-03-22 | TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the exportOvpn interface at cstecgi.cgi. |
CVE-2021-45876 | Critical | 9.8 | 2022-03-21 | Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by unauthenticated command injection. The url parameter of the function module downloadAndUpdate is… |
CVE-2022-27002 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddns_name, ddns_pwd, h_ddns、ddns_host parameters… |
CVE-2022-27001 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the dhcp function via the hostname parameter. This vulnerability allows at… |
CVE-2022-27000 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the time and time zone function via the h_primary_ntp_server, h_backup_ntp_… |
CVE-2022-26999 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the static ip settings function via the wan_ip_stat, wan_mask_stat, wan_gw_… |
CVE-2022-26998 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wps_enrolee_pin parameter. This vulnerabil… |
CVE-2022-26997 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the upnp function via the upnp_ttl parameter. This vulnerability allows att… |
CVE-2022-26996 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pppoe function via the pppoe_username, pppoe_passwd, and pppoe_servicen… |
CVE-2022-26995 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pptp (wan_pptp.html) function via the pptp_fix_ip, pptp_fix_mask, pptp_… |
CVE-2021-44620 | Critical | 9.8 | 2022-03-11 | A Command Injection vulnerability exits in TOTOLINK A3100R <=V4.1.2cu.5050_B20200504 in adm/ntm.asp via the hosTime parameters. |
CVE-2021-4045 | Critical | 9.8 | 2022-03-10 | TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary runnin… |