CWE-77 · Command Injection (page 32)
Page 32 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-12967 | High | 7.2 | 2021-05-13 | The lack of nested page table protection in the AMD SEV/SEV-ES feature could potentially lead to arbitrary code execution within the guest VM if a malicious ad… |
CVE-2020-36198 | Medium | 6.7 | 2021-05-13 | A command injection vulnerability has been reported to affect certain versions of Malware Remover. If exploited, this vulnerability allows remote attackers to… |
CVE-2021-29501 | High | 8.1 | 2021-05-10 | Ticketer is a command based ticket system cog (plugin) for the red discord bot. A vulnerability allowing discord users to expose sensitive information has been… |
CVE-2021-1498 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injecti… |
CVE-2020-13664 | High | 8.8 | 2021-05-05 | Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site… |
CVE-2021-1488 | Medium | 6.7 | 2021-04-29 | A vulnerability in the upgrade process of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an aut… |
CVE-2021-25812 | Critical | 9.8 | 2021-04-29 | Command injection vulnerability in China Mobile An Lianbao WF-1 1.01 via the 'ip' parameter with a POST request to /api/ZRQos/set_online_client. |
CVE-2021-31726 | Critical | 9.8 | 2021-04-25 | Akuvox C315 115.116.2613 allows remote command Injection via the cfgd_server service. The attack vector is sending a payload to port 189 (default root 0.0.0.0). |
CVE-2020-7034 | High | 7.2 | 2021-04-23 | A command injection vulnerability in Avaya Session Border Controller for Enterprise could allow an authenticated, remote attacker to send specially crafted mes… |
CVE-2021-0253 | High | 7.8 | 2021-04-22 | NFX Series devices using Juniper Networks Junos OS are susceptible to a local command execution vulnerability thereby allowing an attacker to elevate their pri… |
CVE-2021-0252 | High | 7.8 | 2021-04-22 | NFX Series devices using Juniper Networks Junos OS are susceptible to a local code execution vulnerability thereby allowing an attacker to elevate their privil… |
CVE-2021-20527 | High | 7.2 | 2021-04-19 | IBM Resilient SOAR V38.0 could allow a privileged user to create create malicious scripts that could be executed as another user. IBM X-Force ID: 198759. |
CVE-2021-20991 | Critical | 9.8 | 2021-04-19 | In Fibaro Home Center 2 and Lite devices with firmware version 4.540 and older an authenticated user can run commands as root user using a command injection vu… |
CVE-2020-2509 | Critical | 9.8 | 2021-04-17 | A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary command… |
CVE-2020-27227 | Critical | 9.8 | 2021-04-13 | An exploitable unatuhenticated command injection exists in the OpenClinic GA 5.173.3. Specially crafted web requests can cause commands to be executed on the s… |
CVE-2021-29154 | High | 7.8 | 2021-04-08 | BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the ke… |
CVE-2020-25217 | High | 7.2 | 2021-03-29 | Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allows Command Injection as root in its administrative web interface. |
CVE-2020-10580 | High | 8.8 | 2021-03-25 | A command injection on the /admin/broadcast.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote authenticated attackers to execute… |
CVE-2021-1443 | Medium | 5.5 | 2021-03-24 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the unde… |
CVE-2021-1384 | Medium | 6.5 | 2021-03-24 | A vulnerability in Cisco IOx application hosting environment of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands into the… |
CVE-2021-1382 | Medium | 6.0 | 2021-03-24 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root p… |
CVE-2021-22864 | High | 8.8 | 2021-03-23 | A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled con… |
CVE-2021-29079 | Critical | 9.6 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854… |
CVE-2021-29078 | Critical | 9.6 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854… |
CVE-2021-29077 | Critical | 9.6 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBW30 before 2.6.2.2, RBS40V before 2.6.2.4, RBK852 befo… |
CVE-2021-29076 | Critical | 9.6 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854… |
CVE-2021-29072 | High | 8.4 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 befor… |
CVE-2021-29071 | Critical | 9.6 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 befor… |
CVE-2021-29070 | High | 8.4 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 befor… |
CVE-2021-29069 | High | 7.3 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects XR450 before 2.3.2.114, XR500 before 2.3.2.114, and WNR2000v5… |
CVE-2021-26275 | Critical | 9.8 | 2021-03-19 | The eslint-fixer package through 0.1.5 for Node.js allows command injection via shell metacharacters to the fix function. NOTE: This vulnerability only affects… |
CVE-2020-8298 | Critical | 9.8 | 2021-03-04 | fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the `copy`, `copySync`, `remove`, and `removeSync` meth… |
CVE-2020-10519 | High | 8.8 | 2021-03-03 | A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled con… |
CVE-2021-3148 | Critical | 9.8 | 2021-02-27 | An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injectio… |
CVE-2020-28243 | High | 7.8 | 2021-02-27 | An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows f… |
CVE-2020-7848 | High | 8.0 | 2021-02-17 | The EFM ipTIME C200 IP Camera is affected by a Command Injection vulnerability in /login.cgi?logout=1 script. To exploit this vulnerability, an attacker can se… |
CVE-2020-27867 | Medium | 6.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2… |
CVE-2020-27864 | High | 8.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 firmware version 1.04B03 WiFi exten… |
CVE-2020-27862 | High | 8.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DVA-2800 and DSL-2888A routers. Authenticati… |
CVE-2021-27185 | Critical | 9.8 | 2021-02-10 | The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec. |
CVE-2020-13117 | Critical | 9.8 | 2021-02-09 | Wavlink WN575A4, WN579X3, and WN530G3A devices through 2020-05-15 allow unauthenticated remote users to inject commands via the key parameter in a login reques… |
CVE-2021-26576 | High | 7.8 | 2021-02-08 | The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a command injection vulnerability in libifc.so uploads… |
CVE-2021-25172 | High | 7.8 | 2021-02-08 | The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a command injection vulnerability in libifc.so websetd… |
CVE-2020-2507 | Critical | 9.8 | 2021-02-03 | The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerability could allow remote attackers to run… |
CVE-2021-0364 | Medium | 6.7 | 2021-02-03 | In mobile_log_d, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution… |
CVE-2021-0363 | Medium | 6.7 | 2021-02-03 | In mobile_log_d, there is a possible command injection due to a missing bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2021-0358 | Medium | 6.7 | 2021-02-03 | In netdiag, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution priv… |
CVE-2021-0356 | Medium | 6.7 | 2021-02-03 | In netdiag, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution priv… |
CVE-2020-8101 | Medium | 6.9 | 2021-02-02 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in HTTP interface of ADT LifeShield DIY HD Video Doorbell all… |
CVE-2021-1299 | High | 8.8 | 2021-01-20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which… |
CVE-2021-1298 | High | 8.8 | 2021-01-20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which… |
CVE-2021-1263 | High | 7.8 | 2021-01-20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which… |
CVE-2021-1262 | High | 7.8 | 2021-01-20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which… |
CVE-2021-1261 | High | 7.8 | 2021-01-20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which… |
CVE-2021-1260 | High | 7.8 | 2021-01-20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which… |
CVE-2020-4688 | High | 7.8 | 2021-01-20 | IBM Security Guardium 10.6 and 11.2 could allow a local attacker to execute arbitrary commands on the system as an unprivileged user, caused by command injecti… |
CVE-2020-14102 | High | 7.2 | 2021-01-13 | There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaom… |
CVE-2020-2508 | High | 7.2 | 2021-01-11 | A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary command… |
CVE-2020-17504 | High | 7.2 | 2021-01-08 | The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the ad… |
CVE-2020-17503 | High | 7.2 | 2021-01-08 | The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the ad… |
CVE-2020-17502 | High | 7.2 | 2021-01-08 | Barco TransForm N before 3.8 allows Command Injection (issue 2 of 4). The NDN-210 has a web administration panel which is made available over https. There is a… |
CVE-2020-17500 | Critical | 9.8 | 2021-01-07 | Barco TransForm NDN-210 Lite, NDN-210 Pro, NDN-211 Lite, and NDN-211 Pro before 3.8 allows Command Injection (issue 1 of 4). The NDN-210 has a web administrati… |
CVE-2018-19418 | High | 7.8 | 2021-01-07 | Foxit PDF ActiveX before 5.5.1 allows remote code execution via command injection because of the lack of a security permission control. |
CVE-2018-14067 | Critical | 9.8 | 2020-12-31 | Green Packet WiMax DV-360 2.10.14-g1.0.6.1 devices allow Command Injection, with unauthenticated remote command execution, via a crafted payload to the HTTPS p… |
CVE-2020-35798 | Critical | 9.3 | 2020-12-30 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects R6400v2 before 1.0.4.84, R6700v3 before 1.0.4.84, R6900P… |
CVE-2020-35794 | High | 8.4 | 2020-12-30 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBS40V before 2.6.1.4, RBK752 before 3.2.15.25, RBR750 before… |
CVE-2020-35793 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.58, R7500v2 before 1.0.3.46, R7800 before 1… |
CVE-2020-35792 | High | 8.3 | 2020-12-30 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R7500v2 before 1.0.3.48, R8900 before 1.0.5.2, R9000 before 1… |
CVE-2020-35791 | Medium | 6.4 | 2020-12-30 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R7800 before 1.0.2.68, R8900 before 1.0.5.2, and R9000 before… |
CVE-2020-35790 | Medium | 6.4 | 2020-12-30 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.56, R7800 before 1.0.2.68, R8900 before 1.0… |
CVE-2020-35777 | High | 8.4 | 2020-12-30 | NETGEAR DGN2200v1 devices before v1.0.0.58 are affected by command injection. |
CVE-2020-25847 | High | 8.8 | 2020-12-29 | This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in… |
CVE-2020-29299 | High | 7.2 | 2020-12-27 | Certain Zyxel products allow command injection by an admin via an input string to chg_exp_pwd during a password-change action. This affects VPN On-premise befo… |
CVE-2020-26273 | Medium | 5.2 | 2020-12-16 | osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. In osquery before version 4.6.0, by using sqlite's ATTACH verb… |
CVE-2020-24634 | Critical | 9.8 | 2020-12-11 | An attacker is able to remotely inject arbitrary commands by sending especially crafted packets destined to the PAPI (Aruba Networks AP Management protocol) UD… |
CVE-2019-7198 | Critical | 9.8 | 2020-12-10 | This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in… |
CVE-2020-9116 | High | 7.2 | 2020-12-01 | Huawei FusionCompute versions 6.5.1 and 8.0.0 have a command injection vulnerability. An authenticated, remote attacker can craft specific request to exploit t… |
CVE-2020-9115 | High | 7.2 | 2020-12-01 | ManageOne versions 6.5.1.1.B010, 6.5.1.1.B020, 6.5.1.1.B030, 6.5.1.1.B040, ,6.5.1.1.B050, 8.0.0 and 8.0.1 have a command injection vulnerability. An attacker w… |
CVE-2019-19875 | Critical | 9.8 | 2020-11-27 | An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Arbitrary commands could be injected (using Python scripts) via the AprolCluster… |
CVE-2019-19874 | Critical | 9.8 | 2020-11-27 | An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Some web scripts in the web interface allowed injection and execution of arbitrar… |
CVE-2019-19872 | Critical | 9.8 | 2020-11-27 | An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. The AprolLoader could be used to inject and execute arbitrary unintended commands… |
CVE-2020-2492 | High | 7.2 | 2020-11-16 | If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. QTS version… |
CVE-2020-2490 | High | 7.2 | 2020-11-16 | If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. QTS version… |
CVE-2020-9127 | Medium | 6.7 | 2020-11-13 | Some Huawei products have a command injection vulnerability. Due to insufficient input validation, an attacker with high privilege may inject some malicious co… |
CVE-2020-23639 | Critical | 9.8 | 2020-11-02 | A command injection vulnerability exists in Moxa Inc VPort 461 Series Firmware Version 3.4 or lower that could allow a remote attacker to execute arbitrary com… |
CVE-2018-19950 | Critical | 9.8 | 2020-11-02 | If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Music Stat… |
CVE-2020-7384 | High | 7.0 | 2020-10-29 | Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary com… |
CVE-2018-19949 | Critical | 9.8 | 2020-10-28 | If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QT… |
CVE-2019-14719 | High | 7.8 | 2020-10-23 | Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow multiple arbitrary command injections, as demonstrated by the file manager. |
CVE-2020-11496 | Medium | 6.7 | 2020-10-19 | Sprecher SPRECON-E firmware prior to 8.64b might allow local attackers with access to engineering data to insert arbitrary code. This firmware lacks the valida… |
CVE-2020-9862 | High | 7.8 | 2020-10-16 | A command injection issue existed in Web Inspector. This issue was addressed with improved escaping. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4… |
CVE-2020-4636 | High | 7.2 | 2020-10-16 | IBM Resilient OnPrem 38.2 could allow a privileged user to inject malicious commands through Python3 scripting. IBM X-Force ID: 185503. |
CVE-2020-26929 | High | 7.3 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6220 before 1.1.0.100 and R6230 before 1.1.0.100. |
CVE-2020-26922 | Medium | 6.4 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WC7500 before 6.5.5.24, WC7600 before 6.5.5.24, WC7600v2 befor… |
CVE-2020-26920 | High | 8.8 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects SRK60 before 2.5.3.110, SRR60 before 2.5.3.110, and SRS6… |
CVE-2020-26914 | Medium | 6.7 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, JR6150 before 1… |
CVE-2020-26910 | High | 8.4 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before… |
CVE-2020-26909 | High | 8.8 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7800 before 1.0.1.58 and R7500v2 before 1.0.3.48. |
CVE-2020-26907 | Critical | 9.6 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.16.6, RBR850 before 3.2.16.6, and RBS8… |
CVE-2020-26902 | Critical | 9.6 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750… |