CWE-77 · Command Injection (page 29)
Page 29 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-41001 | High | 8.8 | 2022-03-02 | An authenticated remote code execution vulnerability was discovered in the AOS-CX Network Analytics Engine (NAE) in Aruba CX 6200F Switch Series, Aruba 6300 Sw… |
CVE-2021-41000 | High | 8.8 | 2022-03-02 | Multiple authenticated remote code execution vulnerabilities were discovered in the AOS-CX command line interface in Aruba CX 6200F Switch Series, Aruba 6300 S… |
CVE-2021-44132 | High | 7.8 | 2022-02-25 | A command injection vulnerability in the function formImportOMCIShell of C-DATA ONU4FERW V2.1.13_X139 allows attackers to execute arbitrary commands via a craf… |
CVE-2021-40043 | High | 7.8 | 2022-02-25 | The laser command injection vulnerability exists on AIS-BW80H-00 versions earlier than AIS-BW80H-00 9.0.3.4(H100SP13C00). The devices cannot effectively defend… |
CVE-2021-39363 | Critical | 9.8 | 2022-02-24 | Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow a video replay attack after ARP cache poisoning has been achieved. |
CVE-2022-25137 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firm… |
CVE-2022-25136 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmwar… |
CVE-2022-25135 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function recv_mesh_info_sync of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attacker… |
CVE-2022-25134 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to ex… |
CVE-2022-25133 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers t… |
CVE-2022-25132 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to e… |
CVE-2022-25131 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10… |
CVE-2022-25130 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function updateWifiInfo of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware… |
CVE-2021-45082 | High | 7.8 | 2022-02-19 | An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules… |
CVE-2021-45401 | Critical | 9.8 | 2022-02-18 | A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49_multi via the setUsbUnload func… |
CVE-2021-41599 | High | 8.8 | 2022-02-18 | A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. To exploit this vul… |
CVE-2021-41552 | High | 8.8 | 2022-02-15 | CommScope SURFboard SBG6950AC2 9.1.103AA23 devices allow Command Injection. |
CVE-2019-16864 | High | 8.8 | 2022-02-14 | CompleteFTPService.exe in the server in EnterpriseDT CompleteFTP before 12.1.4 allows Remote Code Execution by leveraging a Windows user account that has SSH a… |
CVE-2022-24171 | Critical | 9.8 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetPppoeServer. This vulnerabilit… |
CVE-2022-24170 | Critical | 9.8 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpSecTunnel. This vulnerabilit… |
CVE-2022-24168 | Critical | 9.8 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpGroup. This vulnerability al… |
CVE-2022-24167 | Critical | 9.8 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetDMZ. This vulnerability allows… |
CVE-2022-24165 | Critical | 9.8 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetQvlanList. This vulnerability… |
CVE-2022-24150 | Critical | 9.8 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a command injection vulnerability in the function formSetSafeWanWebMan. This vulnerability allows attackers… |
CVE-2022-24148 | Critical | 9.8 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a command injection vulnerability in the function mDMZSetCfg. This vulnerability allows attackers to execut… |
CVE-2022-24144 | Critical | 9.8 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a command injection vulnerability in the function WanParameterSetting. This vulnerability allows attackers… |
CVE-2021-46457 | Critical | 9.8 | 2022-02-04 | D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function ChgSambaUserSettings. This vulnerability al… |
CVE-2021-46456 | Critical | 9.8 | 2022-02-04 | D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetWLanACLSettings. This vulnerability allo… |
CVE-2021-46455 | Critical | 9.8 | 2022-02-04 | D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetStationSettings. This vulnerability allo… |
CVE-2021-46454 | Critical | 9.8 | 2022-02-04 | D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetWLanApcliSettings. This vulnerability al… |
CVE-2021-46453 | Critical | 9.8 | 2022-02-04 | D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetStaticRouteSettings. This vulnerability… |
CVE-2021-46452 | Critical | 9.8 | 2022-02-04 | D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetNetworkTomographySettings. This vulnerab… |
CVE-2021-46233 | Critical | 9.8 | 2022-02-04 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function msp_info.htm. This vulnerability allows att… |
CVE-2021-46232 | Critical | 9.8 | 2022-02-04 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function version_upgrade.asp. This vulnerability all… |
CVE-2021-46231 | Critical | 9.8 | 2022-02-04 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function urlrd_opt.asp. This vulnerability allows at… |
CVE-2021-46230 | Critical | 9.8 | 2022-02-04 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function upgrade_filter. This vulnerability allows a… |
CVE-2021-46229 | Critical | 9.8 | 2022-02-04 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function usb_paswd.asp. This vulnerability allows at… |
CVE-2021-46228 | Critical | 9.8 | 2022-02-04 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function httpd_debug.asp. This vulnerability allows… |
CVE-2021-46227 | Critical | 9.8 | 2022-02-04 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function proxy_client.asp. This vulnerability allows… |
CVE-2021-46226 | Critical | 9.8 | 2022-02-04 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function wget_test.asp. This vulnerability allows at… |
CVE-2021-45998 | Critical | 9.8 | 2022-02-04 | D-Link device DIR_882 DIR_882_FW1.30B06_Hotfix_02 was discovered to contain a command injection vulnerability in the LocalIPAddress parameter. This vulnerabili… |
CVE-2021-45990 | Critical | 9.8 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function uploadPicture. This vulnerability all… |
CVE-2021-45742 | Critical | 9.8 | 2022-02-04 | TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers t… |
CVE-2021-45738 | Critical | 9.8 | 2022-02-04 | TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function UploadFirmwareFile. This vulnerability allow… |
CVE-2021-45733 | Critical | 9.8 | 2022-02-04 | TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function NTPSyncWithHost. This vulnerability allows a… |
CVE-2021-44882 | Critical | 9.8 | 2022-02-04 | D-Link device DIR_878_FW1.30B08_Hotfix_02 was discovered to contain a command injection vulnerability in the twsystem function. This vulnerability allows attac… |
CVE-2021-44881 | Critical | 9.8 | 2022-02-04 | D-Link device DIR_882 DIR_882_FW1.30B06_Hotfix_02 was discovered to contain a command injection vulnerability in the twsystem function. This vulnerability allo… |
CVE-2021-44880 | Critical | 9.8 | 2022-02-04 | D-Link devices DIR_878 DIR_878_FW1.30B08_Hotfix_02 and DIR_882 DIR_882_FW1.30B06_Hotfix_02 were discovered to contain a command injection vulnerability in the… |
CVE-2021-44247 | Critical | 9.8 | 2022-02-04 | Totolink devices A3100R v4.1.2cu.5050_B20200504, A830R v5.9c.4729_B20191112, and A720R v4.1.5cu.470_B20200911 were discovered to contain command injection vuln… |
CVE-2021-42638 | High | 8.1 | 2022-02-01 | PrinterLogic Web Stack versions 19.1.1.13 SP9 and below do not sanitize user input resulting in pre-auth remote code execution. |
CVE-2021-32849 | High | 8.8 | 2022-01-26 | Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in ve… |
CVE-2021-46560 | Critical | 9.8 | 2022-01-26 | The firmware on Moxa TN-5900 devices through 3.1 allows command injection that could lead to device damage. |
CVE-2021-43589 | Medium | 6.0 | 2022-01-24 | Dell EMC Unity, Dell EMC UnityVSA and Dell EMC Unity XT versions prior to 5.1.2.0.5.007 contain an operating system (OS) command injection Vulnerability. A loc… |
CVE-2021-44735 | Critical | 9.8 | 2022-01-20 | Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07. |
CVE-2021-33965 | High | 8.8 | 2022-01-18 | China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRMesh/set_ZRMesh which receives parameters by POST request, and the parameter mesh_en… |
CVE-2021-33964 | High | 8.8 | 2022-01-18 | China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRRuleFilter/set_firewall_level which receives parameters by POST request, and the par… |
CVE-2021-33963 | Critical | 9.8 | 2022-01-15 | China Mobile An Lianbao WF-1 v1.0.1 router web interface through /api/ZRMacClone/mac_addr_clone receives parameters by POST request, and the parameter macType… |
CVE-2022-22991 | High | 7.8 | 2022-01-13 | A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP cal… |
CVE-2021-42559 | High | 8.8 | 2022-01-12 | An issue was discovered in CALDERA 2.8.1. It contains multiple startup "requirements" that execute commands when starting the server. Because these commands ca… |
CVE-2022-21668 | High | 8.0 | 2022-01-10 | pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files a… |
CVE-2021-45456 | Critical | 9.8 | 2022-01-06 | Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what… |
CVE-2021-43711 | Critical | 9.8 | 2022-01-04 | The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command injection vulnerability when receiving GET parameters. The parameter n… |
CVE-2021-38542 | Medium | 5.9 | 2022-01-04 | Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle comma… |
CVE-2021-20167 | High | 8.0 | 2021-12-30 | Netgear RAX43 version 1.0.3.96 contains a command injection vulnerability. The readycloud cgi application is vulnerable to command injection in the name parame… |
CVE-2021-23727 | High | 7.5 | 2021-12-29 | This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata fro… |
CVE-2021-45635 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR750 before 4.6.3.6, RBK752 before 3.2.17.12, RBR750 b… |
CVE-2021-45634 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR750 before 4.6.3.6, RBK752 before 3.2.17.12, RBR750 b… |
CVE-2021-45633 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR750 before 4.6.3.6, RBR750 before 3.2.17.12, RBR850 b… |
CVE-2021-45632 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR750 before 4.6.3.6, RBK752 before 3.2.17.12, RBR750 b… |
CVE-2021-45631 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, RBK752 bef… |
CVE-2021-45630 | Critical | 10.0 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, RBK752 bef… |
CVE-2021-45629 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR750 before 4.6.3.6, RBK752 before 3.2.17.12, RBR750 b… |
CVE-2021-45628 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 3.2.18.2, RBK752 be… |
CVE-2021-45627 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR750 before 4.6.3.6, RBK852 before 3.2.17.12, RBR850 b… |
CVE-2021-45626 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK20 before 2.6.1.36, RBR20 before 2.6.1.36, RBS20 befo… |
CVE-2021-45625 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects XR300 before 1.0.3.68, R7000P before 1.3.3.140, and R690… |
CVE-2021-45624 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7000v2 before 1.0.0.66, D8500 before 1.0.3.58, R7000 be… |
CVE-2021-45623 | High | 8.3 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects R7800 before 1.0.2.74, R9000 before 1.0.5.2, and XR500 b… |
CVE-2021-45622 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, EAX20 befo… |
CVE-2021-45621 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 3.2.18.2, EAX20 bef… |
CVE-2021-45620 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, EAX20 befo… |
CVE-2021-45619 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects EX6200v2 before 1.0.1.86, EX6250 before 1.0.0.134, EX770… |
CVE-2021-45618 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7800 before 1.0.1.64, EX6200v2 before 1.0.1.86, EX6250… |
CVE-2021-45617 | Critical | 9.8 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, EAX20 before 1.0.0.48, EAX80 befo… |
CVE-2021-45616 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR750 before 3.2.18.2, LAX20 before 1.1.6.28, MK62 befo… |
CVE-2021-45615 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, R7900P bef… |
CVE-2021-45614 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7000v2 before 1.0.0.74, LAX20 before 1.1.6.28, MK62 bef… |
CVE-2021-45613 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, D7000v2 be… |
CVE-2021-45612 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, EAX20 befo… |
CVE-2021-45601 | High | 8.4 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, RBK852 before 3… |
CVE-2021-45600 | High | 8.4 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects CBR750 before 4.6.3.6, RBK852 before 3.2.17.12, RBR850 before… |
CVE-2021-45599 | High | 8.4 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, RBK852 before 3… |
CVE-2021-45598 | High | 8.4 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, RBK852 before 3… |
CVE-2021-45597 | High | 8.4 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, RBR850 before 3… |
CVE-2021-45596 | High | 8.4 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects CBR750 before 4.6.3.6, RBK752 before 3.2.17.12, RBR750 before… |
CVE-2021-45595 | High | 7.6 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects LBR20 before 2.6.3.50, RBS50Y before 2.7.3.22, RBR10 before 2… |
CVE-2021-45594 | High | 8.4 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBS50Y before 2.7.3.22, RBR20 before 2.7.3.22, RBR40 before 2… |
CVE-2021-45593 | High | 8.4 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBR20 before 2.7.3.22, RBR40 before 2.7.3.22, RBR50 before 2.7… |
CVE-2021-45592 | High | 8.4 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK752 before 3.2.16.6, RBR750 before 3.2.16.6, RBS750 before… |
CVE-2021-45591 | High | 8.4 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK752 before 3.2.16.6, RBR750 before 3.2.16.6, RBS750 before… |