CWE-77 · Command Injection (page 30)
Page 30 of 39 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-28422 | Medium | 6.4 | 2022-07-25 | All versions of package git-archive are vulnerable to Command Injection via the exports function. |
CVE-2022-2143 | Critical | 9.8 | 2022-07-22 | The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code. |
CVE-2022-0902 | High | 8.1 | 2022-07-21 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injecti… |
CVE-2022-31161 | Critical | 10.0 | 2022-07-15 | Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subproc… |
CVE-2022-34820 | High | 8.4 | 2022-07-12 | A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions < V3.3.46), SIMATIC CP 1243-1 (All versions < V3.3.46), SIMATIC CP 1243-7 LTE EU (All… |
CVE-2022-29560 | High | 7.2 | 2022-07-12 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < 2.15.1), RUGGEDCOM ROX MX5000RE (All versions < 2.15.1), RUGGEDCOM ROX RX1400 (All… |
CVE-2022-34592 | Critical | 9.8 | 2022-07-07 | Wavlink WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability via the function obtw. This vulnerability allows attackers… |
CVE-2022-32449 | Critical | 9.8 | 2022-07-07 | TOTOLINK EX300_V2 V4.0.3c.7484 was discovered to contain a command injection vulnerability via the langType parameter in the setLanguageCfg function. This vuln… |
CVE-2022-28935 | High | 7.2 | 2022-07-06 | Totolink A830R V5.9c.4729_B20191112, Totolink A3100R V4.1.2cu.5050_B20200504, Totolink A950RG V4.1.2cu.5161_B20200903, Totolink A800R V4.1.2cu.5137_B20200730… |
CVE-2022-28171 | High | 7.5 | 2022-06-27 | The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attac… |
CVE-2022-31874 | Critical | 9.8 | 2022-06-17 | ASUS RT-N53 3.0.0.4.376.3754 has a command injection vulnerability in the SystemCmd parameter of the apply.cgi interface. |
CVE-2022-32154 | Medium | 6.8 | 2022-06-15 | Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a… |
CVE-2022-32262 | High | 8.8 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a file upload server that is vulne… |
CVE-2020-36529 | High | 8.8 | 2022-06-07 | A vulnerability classified as critical has been found in SevOne Network Management System up to 5.7.2.22. This affects the file traceroute.php of the Tracerout… |
CVE-2019-9972 | High | 8.8 | 2022-06-07 | PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an authenticated attacker to run arbitrary commands with the phonesyste… |
CVE-2022-29712 | Critical | 9.8 | 2022-06-02 | LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param parameters. |
CVE-2022-29256 | Medium | 6.5 | 2022-05-25 | sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at `npm install` tim… |
CVE-2022-30321 | High | 8.6 | 2022-05-25 | go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 an… |
CVE-2022-28618 | Critical | 9.8 | 2022-05-20 | A command injection security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble St… |
CVE-2022-29184 | High | 8.8 | 2022-05-20 | GoCD is a continuous delivery server. In GoCD versions prior to 22.1.0, it is possible for existing authenticated users who have permissions to edit or create… |
CVE-2022-24394 | High | 8.8 | 2022-05-17 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “update_checkfile” value… |
CVE-2022-24393 | High | 8.8 | 2022-05-17 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “check_vertica_upgrade”… |
CVE-2022-24392 | High | 8.8 | 2022-05-17 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “feed_comm_test” value f… |
CVE-2022-24390 | High | 8.8 | 2022-05-17 | Vulnerability in rconfig “remote_text_file” enables an attacker with user level access to the CLI to inject user level commands into Fidelis Network and Decept… |
CVE-2022-24389 | High | 8.8 | 2022-05-17 | Vulnerability in rconfig “cert_utils” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception Co… |
CVE-2022-24388 | High | 8.8 | 2022-05-17 | Vulnerability in rconfig “date” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandP… |
CVE-2022-26085 | High | 8.8 | 2022-05-12 | An OS command injection vulnerability exists in the httpd wlscan_ASP functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can… |
CVE-2022-26042 | High | 8.8 | 2022-05-12 | An OS command injection vulnerability exists in the daretools binary functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request c… |
CVE-2022-26007 | High | 7.2 | 2022-05-12 | An OS command injection vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request ca… |
CVE-2022-27806 | High | 8.7 | 2022-05-05 | On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all vers… |
CVE-2022-27588 | Critical | 9.8 | 2022-05-05 | We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.6 build 20220401 and later |
CVE-2022-26415 | High | 7.7 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all… |
CVE-2021-44051 | High | 8.8 | 2022-05-05 | A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows remote att… |
CVE-2022-20801 | Medium | 4.7 | 2022-05-04 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to… |
CVE-2022-20799 | Medium | 4.7 | 2022-05-04 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to… |
CVE-2021-43163 | Critical | 9.8 | 2022-05-04 | A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the checkNet fu… |
CVE-2021-43162 | High | 8.8 | 2022-05-04 | A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the runPackDiag… |
CVE-2021-43161 | High | 8.8 | 2022-05-04 | A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the doSwitchApi… |
CVE-2021-43160 | High | 8.8 | 2022-05-04 | A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the switchFastD… |
CVE-2021-43159 | High | 8.8 | 2022-05-04 | A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the setSessionT… |
CVE-2022-1509 | Critical | 9.9 | 2022-04-28 | Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitr… |
CVE-2021-34592 | High | 8.8 | 2022-04-27 | In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands i… |
CVE-2022-26826 | High | 7.2 | 2022-04-15 | Windows DNS Server Remote Code Execution Vulnerability |
CVE-2021-43286 | High | 8.8 | 2022-04-14 | An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker with privileges to create a new pipeline on a GoCD server can abuse a command-line inje… |
CVE-2015-20107 | High | 7.6 | 2022-04-13 | In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow att… |
CVE-2022-26151 | High | 7.2 | 2022-04-13 | Citrix XenMobile Server 10.12 through RP11, 10.13 through RP7, and 10.14 through RP4 allows Command Injection. |
CVE-2021-44520 | High | 8.8 | 2022-04-13 | In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Command Injection vulnerability, leading to remote code execution with root privileges. |
CVE-2022-0999 | High | 8.8 | 2022-04-11 | An authenticated user may be able to misuse parameters to inject arbitrary operating system commands into mySCADA myPRO versions 8.25.0 and prior. |
CVE-2021-43474 | Critical | 9.8 | 2022-04-07 | An Access Control vulnerability exists in D-Link DIR-823G REVA1 1.02B05 (Lastest) via any parameter in the HNAP1 function |
CVE-2022-20665 | Medium | 6.0 | 2022-04-06 | A vulnerability in the CLI of Cisco StarOS could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due… |
CVE-2021-32933 | Critical | 10.0 | 2022-04-01 | An attacker could leverage an API to pass along a malicious file that could then manipulate the process creation command line in MDT AutoSave versions prior to… |
CVE-2021-23247 | Critical | 9.8 | 2022-04-01 | A command injection vulerability found in quick game engine allows arbitrary remote code in quick app. Allows remote attacke0rs to gain arbitrary code executio… |
CVE-2021-43663 | High | 7.5 | 2022-03-31 | totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component cloudupdate_check. |
CVE-2021-43664 | High | 8.1 | 2022-03-30 | totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component process forceugpo. |
CVE-2022-25619 | Low | 3.8 | 2022-03-30 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in ping tool of Profelis IT Consultancy SambaBox allows AUTHE… |
CVE-2021-43118 | Critical | 9.8 | 2022-03-29 | A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3, DrayTek Vigor 3900 1.5.1.3, and DrayTek Vigor 300B 1.5.1.3 via a crafted HTTP me… |
CVE-2022-22688 | High | 8.8 | 2022-03-25 | Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology DiskStation Manager… |
CVE-2022-27083 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadAccessCodePic. |
CVE-2022-27082 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetInternetLanInfo. |
CVE-2022-27081 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetLanInfo. |
CVE-2022-27080 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setWorkmode. |
CVE-2022-27079 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setPicListItem. |
CVE-2022-27078 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setAdInfoDetail. |
CVE-2022-27077 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadWeiXinPic. |
CVE-2022-27076 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/delAd. |
CVE-2022-26536 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setFixTools. |
CVE-2022-26189 | Critical | 9.8 | 2022-03-22 | TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the langType parameter in the login interface. |
CVE-2022-26188 | Critical | 9.8 | 2022-03-22 | TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost. |
CVE-2022-26187 | Critical | 9.8 | 2022-03-22 | TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function. |
CVE-2022-26186 | Critical | 9.8 | 2022-03-22 | TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the exportOvpn interface at cstecgi.cgi. |
CVE-2021-45876 | Critical | 9.8 | 2022-03-21 | Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by unauthenticated command injection. The url parameter of the function module downloadAndUpdate is… |
CVE-2022-27002 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddns_name, ddns_pwd, h_ddns、ddns_host parameters… |
CVE-2022-27001 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the dhcp function via the hostname parameter. This vulnerability allows at… |
CVE-2022-27000 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the time and time zone function via the h_primary_ntp_server, h_backup_ntp_… |
CVE-2022-26999 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the static ip settings function via the wan_ip_stat, wan_mask_stat, wan_gw_… |
CVE-2022-26998 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wps_enrolee_pin parameter. This vulnerabil… |
CVE-2022-26997 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the upnp function via the upnp_ttl parameter. This vulnerability allows att… |
CVE-2022-26996 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pppoe function via the pppoe_username, pppoe_passwd, and pppoe_servicen… |
CVE-2022-26995 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pptp (wan_pptp.html) function via the pptp_fix_ip, pptp_fix_mask, pptp_… |
CVE-2021-44620 | Critical | 9.8 | 2022-03-11 | A Command Injection vulnerability exits in TOTOLINK A3100R <=V4.1.2cu.5050_B20200504 in adm/ntm.asp via the hosTime parameters. |
CVE-2021-4045 | Critical | 9.8 | 2022-03-10 | TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary runnin… |
CVE-2021-41001 | High | 8.8 | 2022-03-02 | An authenticated remote code execution vulnerability was discovered in the AOS-CX Network Analytics Engine (NAE) in Aruba CX 6200F Switch Series, Aruba 6300 Sw… |
CVE-2021-41000 | High | 8.8 | 2022-03-02 | Multiple authenticated remote code execution vulnerabilities were discovered in the AOS-CX command line interface in Aruba CX 6200F Switch Series, Aruba 6300 S… |
CVE-2021-44132 | High | 7.8 | 2022-02-25 | A command injection vulnerability in the function formImportOMCIShell of C-DATA ONU4FERW V2.1.13_X139 allows attackers to execute arbitrary commands via a craf… |
CVE-2021-40043 | High | 7.8 | 2022-02-25 | The laser command injection vulnerability exists on AIS-BW80H-00 versions earlier than AIS-BW80H-00 9.0.3.4(H100SP13C00). The devices cannot effectively defend… |
CVE-2021-39363 | Critical | 9.8 | 2022-02-24 | Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow a video replay attack after ARP cache poisoning has been achieved. |
CVE-2022-25137 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firm… |
CVE-2022-25136 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmwar… |
CVE-2022-25135 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function recv_mesh_info_sync of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attacker… |
CVE-2022-25134 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to ex… |
CVE-2022-25133 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers t… |
CVE-2022-25132 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to e… |
CVE-2022-25131 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10… |
CVE-2022-25130 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function updateWifiInfo of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware… |
CVE-2021-45082 | High | 7.8 | 2022-02-19 | An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules… |
CVE-2021-45401 | Critical | 9.8 | 2022-02-18 | A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49_multi via the setUsbUnload func… |
CVE-2021-41599 | High | 8.8 | 2022-02-18 | A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. To exploit this vul… |
CVE-2021-41552 | High | 8.8 | 2022-02-15 | CommScope SURFboard SBG6950AC2 9.1.103AA23 devices allow Command Injection. |
CVE-2019-16864 | High | 8.8 | 2022-02-14 | CompleteFTPService.exe in the server in EnterpriseDT CompleteFTP before 12.1.4 allows Remote Code Execution by leveraging a Windows user account that has SSH a… |
CVE-2022-24171 | Critical | 9.8 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetPppoeServer. This vulnerabilit… |