CWE-77 · Command Injection (page 33)
Page 33 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15228 | Low | 3.5 | 2020-10-01 | In the `@actions/core` npm module before version 1.2.6,`addPath` and `exportVariable` functions communicate with the Actions Runner over stdout by generating a… |
CVE-2020-0130 | High | 7.8 | 2020-09-17 | In screencap, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege in a system process with… |
CVE-2020-11698 | Critical | 9.8 | 2020-09-17 | An issue was discovered in Titan SpamTitan 7.07. Improper input sanitization of the parameter community on the page snmp-x.php would allow a remote attacker to… |
CVE-2020-24561 | Critical | 9.1 | 2020-09-15 | A command injection vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow an attacker to execute arbitrary code on an affected system. An attack… |
CVE-2020-14100 | Critical | 9.8 | 2020-09-11 | In Xiaomi router R3600 ROM version<1.0.66, filters in the set_WAN6 interface can be bypassed, causing remote code execution. The router administrator can gain… |
CVE-2020-14342 | Medium | 4.4 | 2020-09-09 | It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker… |
CVE-2020-11117 | Critical | 9.8 | 2020-09-08 | u'In the lbd service, an external user can issue a specially crafted debug command to overwrite arbitrary files with arbitrary content resulting in remote code… |
CVE-2020-9199 | Medium | 6.8 | 2020-09-03 | B2368-22 V100R001C00;B2368-57 V100R001C00;B2368-66 V100R001C00 have a command injection vulnerability. An attacker with high privileges may exploit this vulner… |
CVE-2020-25079 | High | 8.8 | 2020-09-02 | An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injecti… |
CVE-2020-25067 | Critical | 9.6 | 2020-09-01 | NETGEAR R8300 devices before 1.0.2.134 are affected by command injection by an unauthenticated attacker. |
CVE-2020-10518 | High | 8.8 | 2020-08-27 | A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled con… |
CVE-2020-15642 | High | 8.8 | 2020-08-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of installations of Marvell QConvergeConsole 5.5.0.64. Although… |
CVE-2019-11853 | Low | 3.9 | 2020-08-21 | Several potential command injections vulnerabilities exist in the AT command interface of ALEOS before 4.11.0, and 4.9.4. |
CVE-2020-8233 | High | 8.8 | 2020-08-17 | A command injection vulnerability exists in EdgeSwitch firmware <v1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over t… |
CVE-2020-8211 | Critical | 9.8 | 2020-08-17 | Improper input validation in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix X… |
CVE-2020-9242 | High | 8.8 | 2020-08-17 | FusionCompute 8.0.0 have a command injection vulnerability. The software does not sufficiently validate certain parameters post from user, successful exploit c… |
CVE-2020-7697 | Critical | 9.8 | 2020-07-29 | This affects all versions of package mock2easy. a malicious user could inject commands through the _data variable: Affected Area require('../server/getJsonByCu… |
CVE-2020-13919 | Critical | 9.8 | 2020-07-28 | emfd/libemf in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to achieve command injection via a crafted HTTP request. This affects… |
CVE-2020-13917 | Critical | 9.8 | 2020-07-28 | rkscli in Ruckus Wireless Unleashed through 200.7.10.92 allows a remote attacker to achieve command injection and jailbreak the CLI via a crafted CLI command… |
CVE-2020-9688 | High | 7.8 | 2020-07-17 | Adobe Download Manager version 2.0.0.518 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2020-14505 | Critical | 9.8 | 2020-07-15 | Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command injection”) vulnerability. Successful e… |
CVE-2020-11084 | Medium | 6.4 | 2020-07-14 | In iPear, the manual execution of the eval() function can lead to command injection. Only PCs where commands are manually executed via "For Developers" are aff… |
CVE-2020-8186 | Critical | 9.8 | 2020-07-10 | A command injection vulnerability in the `devcert` module may lead to remote code execution when users of the module pass untrusted input to the `certificateFo… |
CVE-2020-8188 | High | 8.8 | 2020-07-02 | We have recently released new version of UniFi Protect firmware v1.13.3 and v1.14.10 for Unifi Cloud Key Gen2 Plus and UniFi Dream Machine Pro/UNVR respectivel… |
CVE-2020-5601 | High | 8.8 | 2020-06-30 | Chrome Extension for e-Tax Reception System Ver1.0.0.0 allows remote attackers to execute an arbitrary command via unspecified vectors. |
CVE-2020-9583 | Critical | 9.8 | 2020-06-26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Succes… |
CVE-2020-9582 | Critical | 9.8 | 2020-06-26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Succes… |
CVE-2020-9578 | Critical | 9.8 | 2020-06-26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Succes… |
CVE-2020-9576 | Critical | 9.8 | 2020-06-26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Succes… |
CVE-2020-14472 | Critical | 9.8 | 2020-06-24 | On Draytek Vigor3900, Vigor2960, and Vigor 300B devices before 1.5.1.1, there are some command-injection vulnerabilities in the mainfunction.cgi file. |
CVE-2020-10561 | Critical | 9.8 | 2020-06-24 | An issue was discovered on Xiaomi Mi Jia ink-jet printer < 3.4.6_0138. Injecting parameters to ippserver through the web management background, resulting in co… |
CVE-2020-12782 | Critical | 9.8 | 2020-06-23 | Openfind MailGates contains a Command Injection flaw, when receiving email with specific strings, malicious code in the mail attachment will be triggered and g… |
CVE-2020-4059 | High | 7.3 | 2020-06-18 | In mversion before 2.0.0, there is a command injection vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnera… |
CVE-2020-14442 | High | 8.8 | 2020-06-18 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753… |
CVE-2020-14441 | High | 8.8 | 2020-06-18 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753… |
CVE-2020-14440 | High | 8.8 | 2020-06-18 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753… |
CVE-2020-14439 | High | 8.8 | 2020-06-18 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753… |
CVE-2020-14438 | High | 8.8 | 2020-06-18 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753… |
CVE-2020-14437 | High | 8.8 | 2020-06-18 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753… |
CVE-2020-14436 | High | 8.8 | 2020-06-18 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753… |
CVE-2020-14435 | High | 8.8 | 2020-06-18 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects SRK60 before 2.5.2.104, SRS60 before 2.5.2.104, SRR60 be… |
CVE-2020-14434 | Medium | 6.8 | 2020-06-18 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S befo… |
CVE-2020-14433 | Medium | 6.8 | 2020-06-18 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBK842 befor… |
CVE-2020-3279 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3278 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3277 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3276 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3275 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3274 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-4432 | High | 7.5 | 2020-06-10 | Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate knowledge of the sy… |
CVE-2020-5299 | Medium | 4.0 | 2020-06-03 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, any users with the ability to modify any data that could eventually… |
CVE-2020-3224 | High | 8.8 | 2020-06-03 | A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to in… |
CVE-2020-3219 | High | 8.8 | 2020-06-03 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject and execute arbitrary commands with administrati… |
CVE-2020-3212 | High | 7.2 | 2020-06-03 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the… |
CVE-2020-3211 | High | 7.2 | 2020-06-03 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the… |
CVE-2020-3210 | Medium | 6.7 | 2020-06-03 | A vulnerability in the CLI parsers of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series C… |
CVE-2020-3207 | Medium | 6.7 | 2020-06-03 | A vulnerability in the processing of boot options of specific Cisco IOS XE Software switches could allow an authenticated, local attacker with root shell acces… |
CVE-2020-11079 | High | 8.6 | 2020-05-28 | node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the libr… |
CVE-2020-8171 | Critical | 9.8 | 2020-05-26 | We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prio… |
CVE-2020-11073 | High | 7.9 | 2020-05-13 | In Autoswitch Python Virtualenv before version 0.16.0, a user who enters a directory with a malicious `.venv` file could run arbitrary code without any user in… |
CVE-2019-5623 | Critical | 9.8 | 2020-04-29 | Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-77: Improper Neutralization of Special Elements used in a Command ('Comma… |
CVE-2019-16011 | High | 7.8 | 2020-04-29 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with roo… |
CVE-2019-17101 | Medium | 5.7 | 2020-04-23 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in firmware versions prior to x.xx of Netatmo Smart Indoor Ca… |
CVE-2019-20761 | High | 8.0 | 2020-04-16 | NETGEAR R7800 devices before 1.0.2.62 are affected by command injection by an authenticated user. |
CVE-2019-20757 | Medium | 6.8 | 2020-04-16 | NETGEAR R7800 devices before 1.0.2.62 are affected by command injection by an authenticated user. |
CVE-2019-20745 | Medium | 6.8 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WAC505 before 5.0.10.2 and WAC510 before 5.0.10.2. |
CVE-2019-20732 | Medium | 6.7 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6220 before 1.0.0.40, D7000v2 before 1.0.0.74, D8500 before 1… |
CVE-2019-20727 | Medium | 6.8 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6100 before 1.0.0.63, R7800 before 1.0.2.52, R8900 before 1.0… |
CVE-2019-20726 | Medium | 6.8 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.75, D6000 before 1.0.0.75, D6100 before 1.0… |
CVE-2019-20724 | Medium | 6.8 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.75, D6000 before 1.0.0.75, D6100 before 1.0… |
CVE-2019-20722 | Medium | 6.8 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.44, DM200 before 1.0.0.58, R7500v2 before 1… |
CVE-2019-20718 | Medium | 6.8 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6220 before 1.0.0.48, D6400 before 1.0.0.82, D7000v2 before 1… |
CVE-2019-20711 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, and XR500 before… |
CVE-2019-20710 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, and XR500 before… |
CVE-2019-20709 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, and XR500 before… |
CVE-2019-20708 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, and XR500 before… |
CVE-2019-20707 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R7800 before 1.0.2.60 and XR500 before 2.3.2.32. |
CVE-2019-20706 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R7800 before 1.0.2.60 and XR500 before 2.3.2.32. |
CVE-2019-20705 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, and XR500 before… |
CVE-2019-20704 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, and XR500 before… |
CVE-2019-20703 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, and XR500 before… |
CVE-2019-20702 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, and XR500 before… |
CVE-2019-20701 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, and XR500 before… |
CVE-2019-20689 | Medium | 6.8 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6000 before 1.0.0.75, D6100 before 1.0.0.63, EX2700 before 1… |
CVE-2019-20688 | Medium | 6.8 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.75, D6000 before 1.0.0.75, D6100 before 1.0… |
CVE-2019-20680 | High | 8.0 | 2020-04-15 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7000v2 before 1.0.0.53, R6220 before 1.1.0.80, R6260 before 1… |
CVE-2019-20659 | High | 7.2 | 2020-04-15 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6400v2 before 1.0.4.84, R6700 before 1.0.2.8, R6700v3 before… |
CVE-2019-20655 | High | 7.8 | 2020-04-15 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects XR500 before 2.3.2.56 and XR700 before 1.0.1.20. |
CVE-2019-20651 | Medium | 6.7 | 2020-04-15 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WAC505 before 8.2.1.16 and WAC510 before 8.2.1.16. |
CVE-2020-11789 | Critical | 9.8 | 2020-04-15 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects R6400v2 before 1.0.4.84, R6700 before 1.0.2.8, R6700v3 b… |
CVE-2020-11770 | High | 8.8 | 2020-04-15 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6220 before 1.0.0.52, D6400 before 1.0.0.86, D7000v2 before 1… |
CVE-2020-10514 | High | 8.8 | 2020-04-15 | iCatch DVR firmware before 20200103 do not validate function parameter properly, resulting attackers executing arbitrary command. |
CVE-2019-14868 | High | 7.4 | 2020-04-02 | In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environm… |
CVE-2018-11106 | Critical | 9.8 | 2020-04-01 | NETGEAR has released fixes for a pre-authentication command injection in request_handler.php security vulnerability on the following product models: WC7500, ru… |
CVE-2019-9507 | High | 8.3 | 2020-03-30 | The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to command injection because the application incorrectly neutralizes code synta… |
CVE-2020-10826 | Critical | 9.8 | 2020-03-26 | /cgi-bin/activate.cgi on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve command injection via a remote HTT… |
CVE-2020-6811 | High | 8.8 | 2020-03-25 | The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user use… |
CVE-2020-3266 | High | 7.8 | 2020-03-19 | A vulnerability in the CLI of Cisco SD-WAN Solution software could allow an authenticated, local attacker to inject arbitrary commands that are executed with r… |
CVE-2019-16012 | High | 8.1 | 2020-03-19 | A vulnerability in the web UI of Cisco SD-WAN Solution vManage software could allow an authenticated, remote attacker to conduct SQL injection attacks on an af… |
CVE-2019-12921 | Medium | 6.5 | 2020-03-18 | In GraphicsMagick before 1.3.32, the text filename component allows remote attackers to read arbitrary files via a crafted image because of TranslateTextEx for… |