CWE-77 · Command Injection (page 34)
Page 34 of 39 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-1384 | Medium | 6.5 | 2021-03-24 | A vulnerability in Cisco IOx application hosting environment of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands into the… |
CVE-2021-1382 | Medium | 6.0 | 2021-03-24 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root p… |
CVE-2021-22864 | High | 8.8 | 2021-03-23 | A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled con… |
CVE-2021-29079 | Critical | 9.6 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854… |
CVE-2021-29078 | Critical | 9.6 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854… |
CVE-2021-29077 | Critical | 9.6 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBW30 before 2.6.2.2, RBS40V before 2.6.2.4, RBK852 befo… |
CVE-2021-29076 | Critical | 9.6 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854… |
CVE-2021-29072 | High | 8.4 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 befor… |
CVE-2021-29071 | Critical | 9.6 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 befor… |
CVE-2021-29070 | High | 8.4 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 befor… |
CVE-2021-29069 | High | 7.3 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects XR450 before 2.3.2.114, XR500 before 2.3.2.114, and WNR2000v5… |
CVE-2021-26275 | Critical | 9.8 | 2021-03-19 | The eslint-fixer package through 0.1.5 for Node.js allows command injection via shell metacharacters to the fix function. NOTE: This vulnerability only affects… |
CVE-2020-8298 | Critical | 9.8 | 2021-03-04 | fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the `copy`, `copySync`, `remove`, and `removeSync` meth… |
CVE-2020-10519 | High | 8.8 | 2021-03-03 | A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled con… |
CVE-2021-3148 | Critical | 9.8 | 2021-02-27 | An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injectio… |
CVE-2020-28243 | High | 7.8 | 2021-02-27 | An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows f… |
CVE-2020-7848 | High | 8.0 | 2021-02-17 | The EFM ipTIME C200 IP Camera is affected by a Command Injection vulnerability in /login.cgi?logout=1 script. To exploit this vulnerability, an attacker can se… |
CVE-2020-27867 | Medium | 6.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2… |
CVE-2020-27864 | High | 8.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 firmware version 1.04B03 WiFi exten… |
CVE-2020-27862 | High | 8.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DVA-2800 and DSL-2888A routers. Authenticati… |
CVE-2021-27185 | Critical | 9.8 | 2021-02-10 | The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec. |
CVE-2020-13117 | Critical | 9.8 | 2021-02-09 | Wavlink WN575A4, WN579X3, and WN530G3A devices through 2020-05-15 allow unauthenticated remote users to inject commands via the key parameter in a login reques… |
CVE-2021-26576 | High | 7.8 | 2021-02-08 | The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a command injection vulnerability in libifc.so uploads… |
CVE-2021-25172 | High | 7.8 | 2021-02-08 | The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a command injection vulnerability in libifc.so websetd… |
CVE-2020-2507 | Critical | 9.8 | 2021-02-03 | The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerability could allow remote attackers to run… |
CVE-2021-0364 | Medium | 6.7 | 2021-02-03 | In mobile_log_d, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution… |
CVE-2021-0363 | Medium | 6.7 | 2021-02-03 | In mobile_log_d, there is a possible command injection due to a missing bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2021-0358 | Medium | 6.7 | 2021-02-03 | In netdiag, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution priv… |
CVE-2021-0356 | Medium | 6.7 | 2021-02-03 | In netdiag, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution priv… |
CVE-2020-8101 | Medium | 6.9 | 2021-02-02 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in HTTP interface of ADT LifeShield DIY HD Video Doorbell all… |
CVE-2021-1299 | High | 8.8 | 2021-01-20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which… |
CVE-2021-1298 | High | 8.8 | 2021-01-20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which… |
CVE-2021-1263 | High | 7.8 | 2021-01-20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which… |
CVE-2021-1262 | High | 7.8 | 2021-01-20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which… |
CVE-2021-1261 | High | 7.8 | 2021-01-20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which… |
CVE-2021-1260 | High | 7.8 | 2021-01-20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which… |
CVE-2020-4688 | High | 7.8 | 2021-01-20 | IBM Security Guardium 10.6 and 11.2 could allow a local attacker to execute arbitrary commands on the system as an unprivileged user, caused by command injecti… |
CVE-2020-14102 | High | 7.2 | 2021-01-13 | There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaom… |
CVE-2020-2508 | High | 7.2 | 2021-01-11 | A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary command… |
CVE-2020-17504 | High | 7.2 | 2021-01-08 | The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the ad… |
CVE-2020-17503 | High | 7.2 | 2021-01-08 | The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the ad… |
CVE-2020-17502 | High | 7.2 | 2021-01-08 | Barco TransForm N before 3.8 allows Command Injection (issue 2 of 4). The NDN-210 has a web administration panel which is made available over https. There is a… |
CVE-2020-17500 | Critical | 9.8 | 2021-01-07 | Barco TransForm NDN-210 Lite, NDN-210 Pro, NDN-211 Lite, and NDN-211 Pro before 3.8 allows Command Injection (issue 1 of 4). The NDN-210 has a web administrati… |
CVE-2018-19418 | High | 7.8 | 2021-01-07 | Foxit PDF ActiveX before 5.5.1 allows remote code execution via command injection because of the lack of a security permission control. |
CVE-2018-14067 | Critical | 9.8 | 2020-12-31 | Green Packet WiMax DV-360 2.10.14-g1.0.6.1 devices allow Command Injection, with unauthenticated remote command execution, via a crafted payload to the HTTPS p… |
CVE-2020-35798 | Critical | 9.3 | 2020-12-30 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects R6400v2 before 1.0.4.84, R6700v3 before 1.0.4.84, R6900P… |
CVE-2020-35794 | High | 8.4 | 2020-12-30 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBS40V before 2.6.1.4, RBK752 before 3.2.15.25, RBR750 before… |
CVE-2020-35793 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.58, R7500v2 before 1.0.3.46, R7800 before 1… |
CVE-2020-35792 | High | 8.3 | 2020-12-30 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R7500v2 before 1.0.3.48, R8900 before 1.0.5.2, R9000 before 1… |
CVE-2020-35791 | Medium | 6.4 | 2020-12-30 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R7800 before 1.0.2.68, R8900 before 1.0.5.2, and R9000 before… |
CVE-2020-35790 | Medium | 6.4 | 2020-12-30 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.56, R7800 before 1.0.2.68, R8900 before 1.0… |
CVE-2020-35777 | High | 8.4 | 2020-12-30 | NETGEAR DGN2200v1 devices before v1.0.0.58 are affected by command injection. |
CVE-2020-25847 | High | 8.8 | 2020-12-29 | This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in… |
CVE-2020-29299 | High | 7.2 | 2020-12-27 | Certain Zyxel products allow command injection by an admin via an input string to chg_exp_pwd during a password-change action. This affects VPN On-premise befo… |
CVE-2020-26273 | Medium | 5.2 | 2020-12-16 | osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. In osquery before version 4.6.0, by using sqlite's ATTACH verb… |
CVE-2020-24634 | Critical | 9.8 | 2020-12-11 | An attacker is able to remotely inject arbitrary commands by sending especially crafted packets destined to the PAPI (Aruba Networks AP Management protocol) UD… |
CVE-2019-7198 | Critical | 9.8 | 2020-12-10 | This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in… |
CVE-2020-9116 | High | 7.2 | 2020-12-01 | Huawei FusionCompute versions 6.5.1 and 8.0.0 have a command injection vulnerability. An authenticated, remote attacker can craft specific request to exploit t… |
CVE-2020-9115 | High | 7.2 | 2020-12-01 | ManageOne versions 6.5.1.1.B010, 6.5.1.1.B020, 6.5.1.1.B030, 6.5.1.1.B040, ,6.5.1.1.B050, 8.0.0 and 8.0.1 have a command injection vulnerability. An attacker w… |
CVE-2019-19875 | Critical | 9.8 | 2020-11-27 | An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Arbitrary commands could be injected (using Python scripts) via the AprolCluster… |
CVE-2019-19874 | Critical | 9.8 | 2020-11-27 | An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Some web scripts in the web interface allowed injection and execution of arbitrar… |
CVE-2019-19872 | Critical | 9.8 | 2020-11-27 | An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. The AprolLoader could be used to inject and execute arbitrary unintended commands… |
CVE-2020-2492 | High | 7.2 | 2020-11-16 | If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. QTS version… |
CVE-2020-2490 | High | 7.2 | 2020-11-16 | If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. QTS version… |
CVE-2020-9127 | Medium | 6.7 | 2020-11-13 | Some Huawei products have a command injection vulnerability. Due to insufficient input validation, an attacker with high privilege may inject some malicious co… |
CVE-2020-23639 | Critical | 9.8 | 2020-11-02 | A command injection vulnerability exists in Moxa Inc VPort 461 Series Firmware Version 3.4 or lower that could allow a remote attacker to execute arbitrary com… |
CVE-2018-19950 | Critical | 9.8 | 2020-11-02 | If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Music Stat… |
CVE-2020-7384 | High | 7.0 | 2020-10-29 | Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary com… |
CVE-2018-19949 | Critical | 9.8 | 2020-10-28 | If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QT… |
CVE-2019-14719 | High | 7.8 | 2020-10-23 | Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow multiple arbitrary command injections, as demonstrated by the file manager. |
CVE-2020-11496 | Medium | 6.7 | 2020-10-19 | Sprecher SPRECON-E firmware prior to 8.64b might allow local attackers with access to engineering data to insert arbitrary code. This firmware lacks the valida… |
CVE-2020-9862 | High | 7.8 | 2020-10-16 | A command injection issue existed in Web Inspector. This issue was addressed with improved escaping. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4… |
CVE-2020-4636 | High | 7.2 | 2020-10-16 | IBM Resilient OnPrem 38.2 could allow a privileged user to inject malicious commands through Python3 scripting. IBM X-Force ID: 185503. |
CVE-2020-26929 | High | 7.3 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6220 before 1.1.0.100 and R6230 before 1.1.0.100. |
CVE-2020-26922 | Medium | 6.4 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WC7500 before 6.5.5.24, WC7600 before 6.5.5.24, WC7600v2 befor… |
CVE-2020-26920 | High | 8.8 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects SRK60 before 2.5.3.110, SRR60 before 2.5.3.110, and SRS6… |
CVE-2020-26914 | Medium | 6.7 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, JR6150 before 1… |
CVE-2020-26910 | High | 8.4 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before… |
CVE-2020-26909 | High | 8.8 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7800 before 1.0.1.58 and R7500v2 before 1.0.3.48. |
CVE-2020-26907 | Critical | 9.6 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.16.6, RBR850 before 3.2.16.6, and RBS8… |
CVE-2020-26902 | Critical | 9.6 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750… |
CVE-2020-15228 | Low | 3.5 | 2020-10-01 | In the `@actions/core` npm module before version 1.2.6,`addPath` and `exportVariable` functions communicate with the Actions Runner over stdout by generating a… |
CVE-2020-0130 | High | 7.8 | 2020-09-17 | In screencap, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege in a system process with… |
CVE-2020-11698 | Critical | 9.8 | 2020-09-17 | An issue was discovered in Titan SpamTitan 7.07. Improper input sanitization of the parameter community on the page snmp-x.php would allow a remote attacker to… |
CVE-2020-24561 | Critical | 9.1 | 2020-09-15 | A command injection vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow an attacker to execute arbitrary code on an affected system. An attack… |
CVE-2020-14100 | Critical | 9.8 | 2020-09-11 | In Xiaomi router R3600 ROM version<1.0.66, filters in the set_WAN6 interface can be bypassed, causing remote code execution. The router administrator can gain… |
CVE-2020-14342 | Medium | 4.4 | 2020-09-09 | It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker… |
CVE-2020-11117 | Critical | 9.8 | 2020-09-08 | u'In the lbd service, an external user can issue a specially crafted debug command to overwrite arbitrary files with arbitrary content resulting in remote code… |
CVE-2020-9199 | Medium | 6.8 | 2020-09-03 | B2368-22 V100R001C00;B2368-57 V100R001C00;B2368-66 V100R001C00 have a command injection vulnerability. An attacker with high privileges may exploit this vulner… |
CVE-2020-25079 | High | 8.8 | 2020-09-02 | An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injecti… |
CVE-2020-25067 | Critical | 9.6 | 2020-09-01 | NETGEAR R8300 devices before 1.0.2.134 are affected by command injection by an unauthenticated attacker. |
CVE-2020-10518 | High | 8.8 | 2020-08-27 | A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled con… |
CVE-2020-15642 | High | 8.8 | 2020-08-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of installations of Marvell QConvergeConsole 5.5.0.64. Although… |
CVE-2019-11853 | Low | 3.9 | 2020-08-21 | Several potential command injections vulnerabilities exist in the AT command interface of ALEOS before 4.11.0, and 4.9.4. |
CVE-2020-8233 | High | 8.8 | 2020-08-17 | A command injection vulnerability exists in EdgeSwitch firmware <v1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over t… |
CVE-2020-8211 | Critical | 9.8 | 2020-08-17 | Improper input validation in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix X… |
CVE-2020-9242 | High | 8.8 | 2020-08-17 | FusionCompute 8.0.0 have a command injection vulnerability. The software does not sufficiently validate certain parameters post from user, successful exploit c… |
CVE-2020-7697 | Critical | 9.8 | 2020-07-29 | This affects all versions of package mock2easy. a malicious user could inject commands through the _data variable: Affected Area require('../server/getJsonByCu… |
CVE-2020-13919 | Critical | 9.8 | 2020-07-28 | emfd/libemf in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to achieve command injection via a crafted HTTP request. This affects… |
CVE-2020-13917 | Critical | 9.8 | 2020-07-28 | rkscli in Ruckus Wireless Unleashed through 200.7.10.92 allows a remote attacker to achieve command injection and jailbreak the CLI via a crafted CLI command… |