CWE-77 · Command Injection (page 31)
Page 31 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-34348 | Critical | 9.8 | 2021-09-27 | A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arb… |
CVE-2021-22868 | Medium | 4.3 | 2021-09-24 | A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configurat… |
CVE-2021-34729 | Medium | 6.7 | 2021-09-23 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software and Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands… |
CVE-2021-34726 | Medium | 6.7 | 2021-09-23 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root-level pr… |
CVE-2021-34725 | Medium | 6.7 | 2021-09-23 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root-l… |
CVE-2019-6288 | Critical | 9.8 | 2021-09-22 | Edgecore ECS2020 Firmware 1.0.0.0 devices allow Unauthenticated Command Injection via the command1 HTTP header to the /EXCU_SHELL URI. |
CVE-2021-28960 | Critical | 9.8 | 2021-09-21 | Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand oper… |
CVE-2021-41383 | High | 7.2 | 2021-09-17 | setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntp_server field. |
CVE-2020-14119 | Critical | 9.8 | 2021-09-16 | There is command injection in the addMeshNode interface of xqnetwork.lua, which leads to command execution under administrator authority on Xiaomi router AX360… |
CVE-2020-14109 | High | 7.2 | 2021-09-16 | There is command injection in the meshd program in the routing system, resulting in command execution under administrator authority on Xiaomi router AX3600 wit… |
CVE-2020-19151 | High | 8.8 | 2021-09-15 | Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the compon… |
CVE-2020-26300 | Medium | 5.9 | 2021-09-09 | systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command… |
CVE-2021-37145 | High | 7.2 | 2021-09-07 | A command-injection vulnerability in an authenticated Telnet connection in Poly (formerly Polycom) CX5500 and CX5100 1.3.5 leads an attacker to Privilege Escal… |
CVE-2021-37724 | High | 7.2 | 2021-09-07 | A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.16… |
CVE-2021-37723 | High | 7.2 | 2021-09-07 | A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.16… |
CVE-2021-37722 | High | 7.2 | 2021-09-07 | A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8… |
CVE-2021-37721 | High | 7.2 | 2021-09-07 | A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8… |
CVE-2021-37720 | High | 7.2 | 2021-09-07 | A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8… |
CVE-2021-37719 | High | 7.2 | 2021-09-07 | A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8… |
CVE-2021-37718 | High | 7.2 | 2021-09-07 | A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8… |
CVE-2021-37717 | High | 7.2 | 2021-09-07 | A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8… |
CVE-2020-18048 | Critical | 9.8 | 2021-09-02 | An issue in craigms/main.php of CraigMS 1.0 allows attackers to execute arbitrary commands via a crafted input entered into the DB Name field. |
CVE-2019-10095 | Critical | 9.8 | 2021-09-02 | bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affects Apache… |
CVE-2021-36024 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements Us… |
CVE-2021-35220 | High | 8.1 | 2021-08-31 | Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page. |
CVE-2020-19001 | Critical | 9.8 | 2021-08-27 | Command Injection in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary system commands via line 64 of the component 'simiki/blob/master/si… |
CVE-2021-1580 | Medium | 6.5 | 2021-08-25 | Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote… |
CVE-2021-39510 | Critical | 9.8 | 2021-08-24 | An issue was discovered in D-Link DIR816_A1_FW101CNB04 750m11ac wireless router, The HTTP request parameter is used in the handler function of /goform/form2use… |
CVE-2021-39509 | Critical | 9.8 | 2021-08-24 | An issue was discovered in D-Link DIR-816 DIR-816A2_FWv1.10CNB05_R1B011D88210 The HTTP request parameter is used in the handler function of /goform/form2userco… |
CVE-2021-38556 | High | 8.8 | 2021-08-24 | includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection. |
CVE-2021-38611 | Critical | 9.8 | 2021-08-24 | A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as… |
CVE-2020-18885 | High | 7.2 | 2021-08-20 | Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the "text color" field of the component '/admin/web_config.php'. |
CVE-2021-32830 | Low | 3.9 | 2021-08-17 | The @diez/generation npm package is a client for Diez. The locateFont method of @diez/generation has a command injection vulnerability. Clients of the @diez/ge… |
CVE-2020-29548 | High | 8.1 | 2021-08-17 | An issue was discovered in SmarterTools SmarterMail through 100.0.7537. Meddler-in-the-middle attackers can pipeline commands after a POP3 STLS command, inject… |
CVE-2020-15955 | Medium | 5.9 | 2021-08-17 | In s/qmail through 4.0.07, an active MitM can inject arbitrary plaintext commands into a STARTTLS encrypted session between an SMTP client and s/qmail. This al… |
CVE-2021-3617 | High | 7.2 | 2021-08-17 | A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow command injection by setting a specially crafted network configuration. Th… |
CVE-2021-21595 | Medium | 6.0 | 2021-08-16 | Dell EMC PowerScale OneFS versions 8.2.x - 9.1.1.x contain an improper neutralization of special elements used in an OS command. This vulnerability could allow… |
CVE-2021-37708 | High | 8.8 | 2021-08-16 | Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a command injection vulnerability in mail agent settings. Version 6.4.3.1 cont… |
CVE-2021-22938 | High | 7.2 | 2021-08-16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter… |
CVE-2021-22935 | High | 7.2 | 2021-08-16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter. |
CVE-2020-18758 | Critical | 9.8 | 2021-08-13 | An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to execute arbitrary code. |
CVE-2021-38530 | Critical | 9.6 | 2021-08-11 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK40 before 2.5.1.16, RBR40 before 2.5.1.16, RBS40 befo… |
CVE-2021-38529 | High | 8.3 | 2021-08-11 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7800 before 1.0.1.56, R7800 before 1.0.2.68, R8900 befo… |
CVE-2021-38528 | Critical | 9.6 | 2021-08-11 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D8500 before 1.0.3.58, R6900P before 1.3.2.132, R7000P b… |
CVE-2021-38527 | High | 8.1 | 2021-08-11 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.14, EX6100v2 before 1.0.1.98, EX6150v… |
CVE-2021-38521 | Medium | 6.1 | 2021-08-11 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6400 before 1.0.1.50, R7900P before 1.4.1.50, R8000P before 1… |
CVE-2021-38520 | Medium | 6.6 | 2021-08-11 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6400 before 1.0.1.52, R6400v2 before 1.0.4.84, R6700v3 before… |
CVE-2021-38519 | Medium | 6.3 | 2021-08-11 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6250 before 1.0.4.36, R6300v2 before 1.0.4.36, R6400 before 1… |
CVE-2021-38518 | High | 8.4 | 2021-08-11 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RAX200 before 1.0.4.120, RAX75 before 1.0.4.120, RAX80 before… |
CVE-2021-38373 | Medium | 5.3 | 2021-08-10 | In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked. |
CVE-2021-38372 | Low | 3.7 | 2021-08-10 | In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS. |
CVE-2021-38370 | Medium | 5.9 | 2021-08-10 | In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS. |
CVE-2021-38189 | Critical | 9.8 | 2021-08-08 | An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two <CR><LF> sequences… |
CVE-2020-36463 | High | 8.1 | 2021-08-08 | An issue was discovered in the multiqueue crate through 2020-12-25 for Rust. There are unconditional implementations of Send for InnerSend<RW, T>, InnerRecv<RW… |
CVE-2020-36462 | High | 8.1 | 2021-08-08 | An issue was discovered in the syncpool crate before 0.1.6 for Rust. There is an unconditional implementation of Send for Bucket2. |
CVE-2020-36461 | High | 8.1 | 2021-08-08 | An issue was discovered in the noise_search crate through 2020-12-10 for Rust. There are unconditional implementations of Send and Sync for MvccRwLock. |
CVE-2020-36459 | High | 8.1 | 2021-08-08 | An issue was discovered in the dces crate through 2020-12-09 for Rust. The World type is marked as Send but lacks bounds on its EntityStore and ComponentStore. |
CVE-2020-36457 | High | 8.1 | 2021-08-08 | An issue was discovered in the lever crate before 0.1.1 for Rust. AtomicBox<T> implements the Send and Sync traits for all types T. |
CVE-2020-36456 | High | 8.1 | 2021-08-08 | An issue was discovered in the toolshed crate through 2020-11-15 for Rust. In CopyCell<T>, the Send trait lacks bounds on the contained type. |
CVE-2020-36455 | High | 8.1 | 2021-08-08 | An issue was discovered in the slock crate through 2020-11-17 for Rust. Slock<T> unconditionally implements Send and Sync. |
CVE-2020-36451 | High | 8.1 | 2021-08-08 | An issue was discovered in the rcu_cell crate through 2020-11-14 for Rust. There are unconditional implementations of Send and Sync for RcuCell<T>. |
CVE-2020-36450 | High | 8.1 | 2021-08-08 | An issue was discovered in the bunch crate through 2020-11-12 for Rust. There are unconditional implementations of Send and Sync for Bunch<T>. |
CVE-2020-36449 | High | 8.1 | 2021-08-08 | An issue was discovered in the kekbit crate before 0.3.4 for Rust. For ShmWriter<H>, Send is implemented without requiring H: Send. |
CVE-2020-36448 | High | 8.1 | 2021-08-08 | An issue was discovered in the cache crate through 2020-11-24 for Rust. There are unconditional implementations of Send and Sync for Cache<K>. |
CVE-2021-38173 | Critical | 9.8 | 2021-08-07 | Btrbk before 0.31.2 allows command execution because of the mishandling of remote hosts filtering SSH commands using ssh_filter_btrbk.sh in authorized_keys. |
CVE-2021-38169 | High | 8.8 | 2021-08-07 | Roxy-WI through 5.2.2.0 allows command injection via /app/funct.py and /api/api_funct.py. |
CVE-2021-36707 | Critical | 9.8 | 2021-08-06 | In ProLink PRC2402M V1.0.18 and older, the set_ledonoff function in the adm.cgi binary, accessible with a page parameter value of ledonoff contains a trivial c… |
CVE-2021-21406 | Medium | 5.8 | 2021-07-21 | Combodo iTop is an open source, web based IT Service Management tool. In versions prior to 2.7.4, there is a command injection vulnerability in the Setup Wizar… |
CVE-2021-22867 | Medium | 6.5 | 2021-07-14 | A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configurat… |
CVE-2021-32529 | Critical | 9.8 | 2021-07-07 | Command injection vulnerability in QSAN XEVO, SANOS allows remote unauthenticated attackers to execute arbitrary commands. Suggest contacting with QSAN and ref… |
CVE-2021-33515 | Medium | 4.8 | 2021-06-28 | The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlle… |
CVE-2020-17759 | High | 8.8 | 2021-06-24 | An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler. This enables attackers for arbitrary command execution if the us… |
CVE-2020-21785 | High | 8.8 | 2021-06-24 | In IBOS 4.5.4 Open, the database backup has Command Injection Vulnerability. |
CVE-2021-34809 | Critical | 9.9 | 2021-06-18 | Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology Download Station bef… |
CVE-2021-28811 | High | 7.2 | 2021-06-08 | If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. Roon Labs has already fixed this vulnerability in th… |
CVE-2021-20699 | Critical | 9.8 | 2021-06-07 | Sharp NEC Displays ((UN462A R1.300 and prior to it, UN462VA R1.300 and prior to it, UN492S R1.300 and prior to it, UN492VS R1.300 and prior to it, UN552A R1.30… |
CVE-2021-32661 | Medium | 6.8 | 2021-06-03 | Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin (`@backstage/plugin-techdocs`) prior to 0.9.5, a malic… |
CVE-2021-32660 | Medium | 6.8 | 2021-06-03 | Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of `@ba… |
CVE-2021-28812 | High | 8.8 | 2021-06-03 | A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to ex… |
CVE-2015-1877 | High | 8.8 | 2021-06-02 | The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which allows remote… |
CVE-2021-3515 | Medium | 6.7 | 2021-06-01 | A shell injection flaw was found in pglogical in versions before 2.3.4 and before 3.6.26. An attacker with CREATEDB privileges on a PostgreSQL server can craft… |
CVE-2020-10666 | Critical | 9.8 | 2021-05-31 | The restapps (aka Rest Phone apps) module for Sangoma FreePBX and PBXact 13, 14, and 15 through 15.0.19.2 allows remote code execution via a URL variable to an… |
CVE-2020-15180 | Critical | 9.0 | 2021-05-27 | A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited b… |
CVE-2021-22899 | High | 8.8 | 2021-05-27 | A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Wi… |
CVE-2019-25029 | Critical | 9.8 | 2021-05-26 | In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable applic… |
CVE-2020-28908 | Critical | 9.8 | 2021-05-24 | Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios. |
CVE-2020-28902 | Critical | 9.8 | 2021-05-24 | Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php. |
CVE-2020-28901 | Critical | 9.8 | 2021-05-24 | Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt component install… |
CVE-2021-1560 | Medium | 6.5 | 2021-05-22 | Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, remote attacker to perform a command injection attack on an affected devic… |
CVE-2021-1555 | Medium | 4.7 | 2021-05-22 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2021-1554 | Medium | 4.7 | 2021-05-22 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2021-1553 | Medium | 4.7 | 2021-05-22 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2021-1552 | Medium | 4.7 | 2021-05-22 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2021-1551 | Medium | 4.7 | 2021-05-22 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2021-1550 | Medium | 4.7 | 2021-05-22 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2021-1549 | Medium | 4.7 | 2021-05-22 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2021-1548 | Medium | 4.7 | 2021-05-22 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2021-1547 | Medium | 4.7 | 2021-05-22 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2020-20951 | Critical | 9.8 | 2021-05-18 | In Pluck-4.7.10-dev2 admin background, a remote command execution vulnerability exists when uploading files. |
CVE-2021-26311 | High | 7.2 | 2021-05-13 | In the AMD SEV/SEV-ES feature, memory can be rearranged in the guest address space that is not detected by the attestation mechanism which could be used by a m… |