CWE-77 · Command Injection (page 34)
Page 34 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-12430 | High | 8.8 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.11. A specially crafted payload would allow an authenticated malicious user to execute co… |
CVE-2020-3176 | Medium | 6.7 | 2020-03-04 | A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affect… |
CVE-2019-15609 | Critical | 9.8 | 2020-02-28 | The kill-port-process package version < 2.2.0 is vulnerable to a Command Injection vulnerability. |
CVE-2019-5323 | High | 7.2 | 2020-02-27 | There are command injection vulnerabilities present in the AirWave application. Certain input fields controlled by an administrative user are not properly sani… |
CVE-2020-3924 | Medium | 6.4 | 2020-02-27 | DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET do not properly verify patch files. Attackers can inject a specific command into a pat… |
CVE-2020-1790 | High | 8.8 | 2020-02-18 | GaussDB 200 with version of 6.5.1 have a command injection vulnerability. The software constructs part of a command using external input from users, but the so… |
CVE-2020-1811 | High | 8.8 | 2020-02-18 | GaussDB 200 with version of 6.5.1 have a command injection vulnerability. Due to insufficient input validation, remote attackers with low permissions could exp… |
CVE-2020-3760 | Critical | 9.8 | 2020-02-13 | Adobe Digital Editions versions 4.5.10 and below have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2019-4635 | Low | 2.7 | 2020-01-28 | IBM Security Secret Server 10.7 could allow a privileged user to perform unauthorized command injection due to imporoper input neutralization of special elemen… |
CVE-2019-16005 | High | 7.2 | 2020-01-26 | A vulnerability in the web-based management interface of Cisco Webex Video Mesh could allow an authenticated, remote attacker to execute arbitrary commands on… |
CVE-2019-12629 | High | 7.2 | 2020-01-26 | A vulnerability in the WebUI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject and execute arbitrary commands with vmanage u… |
CVE-2019-17361 | Critical | 9.8 | 2020-01-17 | In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacke… |
CVE-2019-15010 | High | 8.8 | 2020-01-15 | Bitbucket Server and Bitbucket Data Center versions starting from version 3.0.0 before version 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 be… |
CVE-2014-4982 | Critical | 9.8 | 2020-01-10 | LPAR2RRD ≤ 4.53 and ≤ 3.5 has arbitrary command injection on the application server. |
CVE-2019-17148 | High | 7.8 | 2020-01-07 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop version 14.1.3 (45485). An at… |
CVE-2019-8255 | Critical | 9.8 | 2019-12-19 | Brackets versions 1.14 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2019-15575 | High | 7.5 | 2019-12-18 | A command injection exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope. |
CVE-2018-0730 | Critical | 9.8 | 2019-12-04 | This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend upda… |
CVE-2018-0729 | Critical | 9.8 | 2019-12-04 | This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend upd… |
CVE-2019-15595 | High | 8.8 | 2019-11-26 | A privilege escalation exists in UniFi Video Controller =<3.10.6 that would allow an attacker on the local machine to run arbitrary commands. |
CVE-2019-18647 | High | 7.2 | 2019-11-14 | The Untangle NG firewall 14.2.0 is vulnerable to an authenticated command injection when logged in as an admin user. |
CVE-2019-9467 | Medium | 6.7 | 2019-11-13 | In the Bootloader, there is a possible kernel command injection due to missing command sanitization. This could lead to a local elevation of privilege with Sys… |
CVE-2019-18780 | Critical | 9.8 | 2019-11-05 | An arbitrary command injection vulnerability in the Cluster Server component of Veritas InfoScale allows an unauthenticated remote attacker to execute arbitrar… |
CVE-2018-19031 | High | 8.8 | 2019-11-04 | A command injection vulnerability exists when the authorized user passes crafted parameter to background process in the router. This affects 360 router series… |
CVE-2019-15588 | High | 7.2 | 2019-11-01 | There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All… |
CVE-2019-3421 | High | 8.0 | 2019-10-31 | The 7520V3V1.0.0B09P27 version, and all earlier versions of ZTE product ZX297520V3 are impacted by a Command Injection vulnerability. Unauthorized users can ex… |
CVE-2018-16417 | High | 7.5 | 2019-10-30 | Aruba Instant 4.x prior to 6.4.4.8-4.2.4.12, 6.5.x prior to 6.5.4.11, 8.3.x prior to 8.3.0.6, and 8.4.x prior to 8.4.0.1 allows Command injection. |
CVE-2019-18188 | High | 7.5 | 2019-10-28 | Trend Micro Apex One could be exploited by an attacker utilizing a command injection vulnerability to extract files from an arbitrary zip file to a specific fo… |
CVE-2019-8088 | Critical | 9.8 | 2019-10-25 | Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2019-15051 | High | 8.8 | 2019-10-10 | An issue was discovered in Softing uaGate (SI, MB, 840D) firmware through 1.71.00.1225. A CGI script is vulnerable to command injection via a maliciously craft… |
CVE-2019-1584 | Critical | 9.8 | 2019-10-09 | A security vulnerability exists in Zingbox Inspector version 1.293 and earlier, that allows for remote code execution if the Inspector were sent a malicious co… |
CVE-2019-12736 | Critical | 9.8 | 2019-10-02 | JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the user for the LDAP protocol, leading to command injection. |
CVE-2019-8073 | Critical | 9.8 | 2019-09-27 | ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Command Injection via Vulnerable component vulnerability. Successful ex… |
CVE-2019-11279 | High | 8.8 | 2019-09-26 | CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user c… |
CVE-2019-11278 | High | 8.8 | 2019-09-26 | CF UAA versions prior to 74.1.0, allow external input to be directly queried against. A remote malicious user with 'client.write' and 'groups.update' can craft… |
CVE-2019-12661 | Medium | 6.7 | 2019-09-25 | A vulnerability in a Virtualization Manager (VMAN) related CLI command of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitra… |
CVE-2019-12651 | High | 8.8 | 2019-09-25 | Multiple vulnerabilities in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands wi… |
CVE-2019-12650 | High | 8.8 | 2019-09-25 | Multiple vulnerabilities in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands wi… |
CVE-2019-13552 | High | 8.8 | 2019-09-18 | In WebAccess versions 8.4.1 and prior, multiple command injection vulnerabilities are caused by a lack of proper validation of user-supplied data and may allow… |
CVE-2019-16305 | High | 8.8 | 2019-09-14 | In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection. A crafted link can trigger a popup asking whether the user wants to run Mo… |
CVE-2019-9254 | High | 7.8 | 2019-09-05 | In readArgumentList of zygote.java in Android 10, there is a possible command injection due to improper input validation. This could lead to local escalation o… |
CVE-2019-7989 | High | 8.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary c… |
CVE-2019-7968 | Critical | 9.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary c… |
CVE-2019-8060 | Critical | 9.8 | 2019-08-20 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-12104 | High | 8.8 | 2019-08-14 | The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by several post-authentication command injection vulnerab… |
CVE-2019-12805 | High | 8.8 | 2019-08-09 | NCSOFT Game Launcher, NC Launcher2 2.4.1.691 and earlier versions have a vulnerability in the custom protocol handler that could allow remote attacker to execu… |
CVE-2019-14745 | High | 7.8 | 2019-08-07 | In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to ex… |
CVE-2017-18442 | Medium | 5.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246). |
CVE-2017-18400 | High | 7.8 | 2019-08-02 | cPanel before 68.0.15 allows local root code execution via cpdavd (SEC-333). |
CVE-2016-10849 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82). |
CVE-2016-10843 | High | 8.1 | 2019-08-01 | cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API (SEC-76). |
CVE-2019-1010174 | Critical | 9.8 | 2019-07-25 | CImg The CImg Library v.2.3.3 and earlier is affected by: command injection. The impact is: RCE. The component is: load_network() function. The attack vector i… |
CVE-2019-7850 | Critical | 9.8 | 2019-07-18 | Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. Successful exploitation could lead to Arbitrary Code E… |
CVE-2016-10762 | High | 7.5 | 2019-07-18 | The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used. |
CVE-2019-1923 | Medium | 6.6 | 2019-07-17 | A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vu… |
CVE-2019-11535 | Critical | 9.8 | 2019-07-17 | Unsanitized user input in the web interface for Linksys WiFi extender products (RE6400 and RE6300 through 1.2.04.022) allows for remote command execution. An a… |
CVE-2019-5446 | High | 7.2 | 2019-07-10 | Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root. |
CVE-2019-1893 | High | 7.8 | 2019-07-06 | A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to execute arbitrary commands on the under… |
CVE-2019-6622 | High | 7.2 | 2019-07-02 | On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.5, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4, an undisclosed iControl REST worker is vulnerable to command i… |
CVE-2017-8413 | High | 8.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for b… |
CVE-2017-8411 | High | 8.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by… |
CVE-2017-8404 | Critical | 9.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by… |
CVE-2017-8408 | Critical | 9.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by… |
CVE-2019-13152 | High | 8.8 | 2019-07-02 | An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the IP… |
CVE-2019-13150 | High | 8.8 | 2019-07-02 | An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication). The comman… |
CVE-2019-13148 | High | 8.8 | 2019-07-02 | An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the UDP… |
CVE-2019-13024 | High | 8.8 | 2019-07-01 | Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "… |
CVE-2019-1624 | High | 8.8 | 2019-06-20 | A vulnerability in the vManage web-based UI (Web UI) in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands th… |
CVE-2019-1623 | Medium | 6.7 | 2019-06-20 | A vulnerability in the CLI configuration shell of Cisco Meeting Server could allow an authenticated, local attacker to inject arbitrary commands as the root us… |
CVE-2017-8333 | High | 8.8 | 2019-06-18 | An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of adding ne… |
CVE-2017-8331 | High | 8.8 | 2019-06-18 | An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of adding ne… |
CVE-2018-19450 | High | 7.8 | 2019-06-17 | A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) 5.4.0.1031 when parsing a launch action. An attacker can leverage t… |
CVE-2018-19445 | High | 7.8 | 2019-06-17 | A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the JavaScript API app.launchURL is us… |
CVE-2017-9384 | High | 8.8 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device… |
CVE-2017-9388 | High | 8.8 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device… |
CVE-2019-7839 | Critical | 9.8 | 2019-06-12 | ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a command injection vulnerability. Successful exploitation coul… |
CVE-2017-18378 | High | 8.4 | 2019-06-11 | In NETGEAR ReadyNAS Surveillance before 1.4.3-17 x86 and before 1.1.4-7 ARM, $_GET['uploaddir'] is not escaped and is passed to system() through $tmp_upload_di… |
CVE-2017-18377 | Critical | 9.8 | 2019-06-11 | An issue was discovered on Wireless IP Camera (P2P) WIFICAM cameras. There is Command Injection in the set_ftp.cgi script via shell metacharacters in the pwd v… |
CVE-2016-10760 | Critical | 9.8 | 2019-06-11 | On Seowon Intech routers, there is a Command Injection vulnerability in diagnostic.cgi via shell metacharacters in the ping_ipaddr parameter. |
CVE-2013-7471 | Critical | 9.8 | 2019-06-11 | An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, DIR-300 rev. B, and… |
CVE-2010-5330 | Critical | 9.8 | 2019-06-11 | On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demo… |
CVE-2009-5157 | High | 8.8 | 2019-06-11 | On Linksys WAG54G2 1.00.10 devices, there is authenticated command injection via shell metacharacters in the setup.cgi c4_ping_ipaddr variable. |
CVE-2009-5156 | Critical | 9.8 | 2019-06-11 | An issue was discovered on ASMAX AR-804gu 66.34.1 devices. There is Command Injection via the cgi-bin/script query string. |
CVE-2019-12786 | High | 8.8 | 2019-06-10 | An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a command injection in HNAP1 SetWanSettings via an XML injection of… |
CVE-2018-19451 | High | 7.8 | 2019-06-07 | A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when using the Open File action on a Field… |
CVE-2018-20523 | Medium | 5.3 | 2019-06-07 | Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection. In other words, a third-part… |
CVE-2019-5390 | Critical | 9.8 | 2019-06-05 | A remote command injection vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
CVE-2019-6739 | High | 8.8 | 2019-06-03 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Malwarebytes Antimalware 3.6.1.2711. User interaction is re… |
CVE-2019-12591 | Medium | 6.8 | 2019-06-03 | NETGEAR Insight Cloud with firmware before Insight 5.6 allows remote authenticated users to achieve command injection. |
CVE-2019-10854 | High | 8.8 | 2019-05-23 | Computrols CBAS 18.0.0 allows Authenticated Command Injection. |
CVE-2018-7826 | High | 8.8 | 2019-05-22 | A Command Injection vulnerability exists in the web-based GUI of the 1st Gen Pelco Sarix Enhanced Camera that could allow a remote attacker to execute arbitrar… |
CVE-2018-7825 | High | 8.8 | 2019-05-22 | A Command Injection vulnerability exists in the web-based GUI of the 1st Gen PelcoSarix Enhanced Camera that could allow a remote attacker to execute arbitrary… |
CVE-2019-1780 | Medium | 6.7 | 2019-05-16 | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execu… |
CVE-2019-1795 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the un… |
CVE-2019-1791 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands wi… |
CVE-2019-1790 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with valid administrator credentials to execute arbitrary comma… |
CVE-2019-1784 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating… |
CVE-2019-1783 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands on… |
CVE-2019-1782 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the un… |
CVE-2019-1781 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the un… |