CWE-77 · Command Injection (page 35)
Page 35 of 39 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-9688 | High | 7.8 | 2020-07-17 | Adobe Download Manager version 2.0.0.518 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2020-14505 | Critical | 9.8 | 2020-07-15 | Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command injection”) vulnerability. Successful e… |
CVE-2020-11084 | Medium | 6.4 | 2020-07-14 | In iPear, the manual execution of the eval() function can lead to command injection. Only PCs where commands are manually executed via "For Developers" are aff… |
CVE-2020-8186 | Critical | 9.8 | 2020-07-10 | A command injection vulnerability in the `devcert` module may lead to remote code execution when users of the module pass untrusted input to the `certificateFo… |
CVE-2020-8188 | High | 8.8 | 2020-07-02 | We have recently released new version of UniFi Protect firmware v1.13.3 and v1.14.10 for Unifi Cloud Key Gen2 Plus and UniFi Dream Machine Pro/UNVR respectivel… |
CVE-2020-5601 | High | 8.8 | 2020-06-30 | Chrome Extension for e-Tax Reception System Ver1.0.0.0 allows remote attackers to execute an arbitrary command via unspecified vectors. |
CVE-2020-9583 | Critical | 9.8 | 2020-06-26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Succes… |
CVE-2020-9582 | Critical | 9.8 | 2020-06-26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Succes… |
CVE-2020-9578 | Critical | 9.8 | 2020-06-26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Succes… |
CVE-2020-9576 | Critical | 9.8 | 2020-06-26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Succes… |
CVE-2020-14472 | Critical | 9.8 | 2020-06-24 | On Draytek Vigor3900, Vigor2960, and Vigor 300B devices before 1.5.1.1, there are some command-injection vulnerabilities in the mainfunction.cgi file. |
CVE-2020-10561 | Critical | 9.8 | 2020-06-24 | An issue was discovered on Xiaomi Mi Jia ink-jet printer < 3.4.6_0138. Injecting parameters to ippserver through the web management background, resulting in co… |
CVE-2020-12782 | Critical | 9.8 | 2020-06-23 | Openfind MailGates contains a Command Injection flaw, when receiving email with specific strings, malicious code in the mail attachment will be triggered and g… |
CVE-2020-4059 | High | 7.3 | 2020-06-18 | In mversion before 2.0.0, there is a command injection vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnera… |
CVE-2020-14442 | High | 8.8 | 2020-06-18 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753… |
CVE-2020-14441 | High | 8.8 | 2020-06-18 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753… |
CVE-2020-14440 | High | 8.8 | 2020-06-18 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753… |
CVE-2020-14439 | High | 8.8 | 2020-06-18 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753… |
CVE-2020-14438 | High | 8.8 | 2020-06-18 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753… |
CVE-2020-14437 | High | 8.8 | 2020-06-18 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753… |
CVE-2020-14436 | High | 8.8 | 2020-06-18 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753… |
CVE-2020-14435 | High | 8.8 | 2020-06-18 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects SRK60 before 2.5.2.104, SRS60 before 2.5.2.104, SRR60 be… |
CVE-2020-14434 | Medium | 6.8 | 2020-06-18 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S befo… |
CVE-2020-14433 | Medium | 6.8 | 2020-06-18 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBK842 befor… |
CVE-2020-3279 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3278 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3277 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3276 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3275 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3274 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-4432 | High | 7.5 | 2020-06-10 | Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate knowledge of the sy… |
CVE-2020-5299 | Medium | 4.0 | 2020-06-03 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, any users with the ability to modify any data that could eventually… |
CVE-2020-3224 | High | 8.8 | 2020-06-03 | A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to in… |
CVE-2020-3219 | High | 8.8 | 2020-06-03 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject and execute arbitrary commands with administrati… |
CVE-2020-3212 | High | 7.2 | 2020-06-03 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the… |
CVE-2020-3211 | High | 7.2 | 2020-06-03 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the… |
CVE-2020-3210 | Medium | 6.7 | 2020-06-03 | A vulnerability in the CLI parsers of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series C… |
CVE-2020-3207 | Medium | 6.7 | 2020-06-03 | A vulnerability in the processing of boot options of specific Cisco IOS XE Software switches could allow an authenticated, local attacker with root shell acces… |
CVE-2020-11079 | High | 8.6 | 2020-05-28 | node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the libr… |
CVE-2020-8171 | Critical | 9.8 | 2020-05-26 | We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prio… |
CVE-2020-11073 | High | 7.9 | 2020-05-13 | In Autoswitch Python Virtualenv before version 0.16.0, a user who enters a directory with a malicious `.venv` file could run arbitrary code without any user in… |
CVE-2019-5623 | Critical | 9.8 | 2020-04-29 | Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-77: Improper Neutralization of Special Elements used in a Command ('Comma… |
CVE-2019-16011 | High | 7.8 | 2020-04-29 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with roo… |
CVE-2019-17101 | Medium | 5.7 | 2020-04-23 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in firmware versions prior to x.xx of Netatmo Smart Indoor Ca… |
CVE-2019-20761 | High | 8.0 | 2020-04-16 | NETGEAR R7800 devices before 1.0.2.62 are affected by command injection by an authenticated user. |
CVE-2019-20757 | Medium | 6.8 | 2020-04-16 | NETGEAR R7800 devices before 1.0.2.62 are affected by command injection by an authenticated user. |
CVE-2019-20745 | Medium | 6.8 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WAC505 before 5.0.10.2 and WAC510 before 5.0.10.2. |
CVE-2019-20732 | Medium | 6.7 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6220 before 1.0.0.40, D7000v2 before 1.0.0.74, D8500 before 1… |
CVE-2019-20727 | Medium | 6.8 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6100 before 1.0.0.63, R7800 before 1.0.2.52, R8900 before 1.0… |
CVE-2019-20726 | Medium | 6.8 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.75, D6000 before 1.0.0.75, D6100 before 1.0… |
CVE-2019-20724 | Medium | 6.8 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.75, D6000 before 1.0.0.75, D6100 before 1.0… |
CVE-2019-20722 | Medium | 6.8 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.44, DM200 before 1.0.0.58, R7500v2 before 1… |
CVE-2019-20718 | Medium | 6.8 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6220 before 1.0.0.48, D6400 before 1.0.0.82, D7000v2 before 1… |
CVE-2019-20711 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, and XR500 before… |
CVE-2019-20710 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, and XR500 before… |
CVE-2019-20709 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, and XR500 before… |
CVE-2019-20708 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, and XR500 before… |
CVE-2019-20707 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R7800 before 1.0.2.60 and XR500 before 2.3.2.32. |
CVE-2019-20706 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R7800 before 1.0.2.60 and XR500 before 2.3.2.32. |
CVE-2019-20705 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, and XR500 before… |
CVE-2019-20704 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, and XR500 before… |
CVE-2019-20703 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, and XR500 before… |
CVE-2019-20702 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, and XR500 before… |
CVE-2019-20701 | High | 8.0 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, and XR500 before… |
CVE-2019-20689 | Medium | 6.8 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6000 before 1.0.0.75, D6100 before 1.0.0.63, EX2700 before 1… |
CVE-2019-20688 | Medium | 6.8 | 2020-04-16 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.75, D6000 before 1.0.0.75, D6100 before 1.0… |
CVE-2019-20680 | High | 8.0 | 2020-04-15 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7000v2 before 1.0.0.53, R6220 before 1.1.0.80, R6260 before 1… |
CVE-2019-20659 | High | 7.2 | 2020-04-15 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6400v2 before 1.0.4.84, R6700 before 1.0.2.8, R6700v3 before… |
CVE-2019-20655 | High | 7.8 | 2020-04-15 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects XR500 before 2.3.2.56 and XR700 before 1.0.1.20. |
CVE-2019-20651 | Medium | 6.7 | 2020-04-15 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WAC505 before 8.2.1.16 and WAC510 before 8.2.1.16. |
CVE-2020-11789 | Critical | 9.8 | 2020-04-15 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects R6400v2 before 1.0.4.84, R6700 before 1.0.2.8, R6700v3 b… |
CVE-2020-11770 | High | 8.8 | 2020-04-15 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6220 before 1.0.0.52, D6400 before 1.0.0.86, D7000v2 before 1… |
CVE-2020-10514 | High | 8.8 | 2020-04-15 | iCatch DVR firmware before 20200103 do not validate function parameter properly, resulting attackers executing arbitrary command. |
CVE-2019-14868 | High | 7.4 | 2020-04-02 | In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environm… |
CVE-2018-11106 | Critical | 9.8 | 2020-04-01 | NETGEAR has released fixes for a pre-authentication command injection in request_handler.php security vulnerability on the following product models: WC7500, ru… |
CVE-2019-9507 | High | 8.3 | 2020-03-30 | The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to command injection because the application incorrectly neutralizes code synta… |
CVE-2020-10826 | Critical | 9.8 | 2020-03-26 | /cgi-bin/activate.cgi on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve command injection via a remote HTT… |
CVE-2020-6811 | High | 8.8 | 2020-03-25 | The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user use… |
CVE-2020-3266 | High | 7.8 | 2020-03-19 | A vulnerability in the CLI of Cisco SD-WAN Solution software could allow an authenticated, local attacker to inject arbitrary commands that are executed with r… |
CVE-2019-16012 | High | 8.1 | 2020-03-19 | A vulnerability in the web UI of Cisco SD-WAN Solution vManage software could allow an authenticated, remote attacker to conduct SQL injection attacks on an af… |
CVE-2019-12921 | Medium | 6.5 | 2020-03-18 | In GraphicsMagick before 1.3.32, the text filename component allows remote attackers to read arbitrary files via a crafted image because of TranslateTextEx for… |
CVE-2020-1980 | High | 7.8 | 2020-03-11 | A shell command injection vulnerability in the PAN-OS CLI allows a local authenticated user to escape the restricted shell and escalate privileges. This issue… |
CVE-2019-12430 | High | 8.8 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.11. A specially crafted payload would allow an authenticated malicious user to execute co… |
CVE-2020-3176 | Medium | 6.7 | 2020-03-04 | A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affect… |
CVE-2019-15609 | Critical | 9.8 | 2020-02-28 | The kill-port-process package version < 2.2.0 is vulnerable to a Command Injection vulnerability. |
CVE-2019-5323 | High | 7.2 | 2020-02-27 | There are command injection vulnerabilities present in the AirWave application. Certain input fields controlled by an administrative user are not properly sani… |
CVE-2020-3924 | Medium | 6.4 | 2020-02-27 | DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET do not properly verify patch files. Attackers can inject a specific command into a pat… |
CVE-2020-1790 | High | 8.8 | 2020-02-18 | GaussDB 200 with version of 6.5.1 have a command injection vulnerability. The software constructs part of a command using external input from users, but the so… |
CVE-2020-1811 | High | 8.8 | 2020-02-18 | GaussDB 200 with version of 6.5.1 have a command injection vulnerability. Due to insufficient input validation, remote attackers with low permissions could exp… |
CVE-2020-3760 | Critical | 9.8 | 2020-02-13 | Adobe Digital Editions versions 4.5.10 and below have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2019-4635 | Low | 2.7 | 2020-01-28 | IBM Security Secret Server 10.7 could allow a privileged user to perform unauthorized command injection due to imporoper input neutralization of special elemen… |
CVE-2019-16005 | High | 7.2 | 2020-01-26 | A vulnerability in the web-based management interface of Cisco Webex Video Mesh could allow an authenticated, remote attacker to execute arbitrary commands on… |
CVE-2019-12629 | High | 7.2 | 2020-01-26 | A vulnerability in the WebUI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject and execute arbitrary commands with vmanage u… |
CVE-2019-17361 | Critical | 9.8 | 2020-01-17 | In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacke… |
CVE-2019-15010 | High | 8.8 | 2020-01-15 | Bitbucket Server and Bitbucket Data Center versions starting from version 3.0.0 before version 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 be… |
CVE-2014-4982 | Critical | 9.8 | 2020-01-10 | LPAR2RRD ≤ 4.53 and ≤ 3.5 has arbitrary command injection on the application server. |
CVE-2019-17148 | High | 7.8 | 2020-01-07 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop version 14.1.3 (45485). An at… |
CVE-2019-8255 | Critical | 9.8 | 2019-12-19 | Brackets versions 1.14 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2019-15575 | High | 7.5 | 2019-12-18 | A command injection exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope. |
CVE-2018-0730 | Critical | 9.8 | 2019-12-04 | This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend upda… |