CWE-77 · Command Injection (page 35)
Page 35 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-1779 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the un… |
CVE-2019-1735 | High | 7.8 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges on the u… |
CVE-2019-10640 | High | 7.5 | 2019-05-15 | An issue was discovered in GitLab Community and Enterprise Edition before 11.7.10, 11.8.x before 11.8.6, and 11.9.x before 11.9.4. A regex input validation iss… |
CVE-2019-6689 | High | 7.8 | 2019-04-26 | An issue was discovered in Dillon Kane Tidal Workload Automation Agent 3.2.0.5 (formerly known as Cisco Workload Automation or CWA). The Enterprise Scheduler f… |
CVE-2019-11217 | Critical | 9.8 | 2019-04-24 | The GitController in Jakub Chodounsky Bonobo Git Server before 6.5.0 allows execution of arbitrary commands in the context of the web server via a crafted http… |
CVE-2019-11076 | Critical | 9.8 | 2019-04-23 | Cribl UI 1.5.0 allows remote attackers to run arbitrary commands via an unauthenticated web request. |
CVE-2019-6579 | Critical | 9.8 | 2019-04-17 | A vulnerability has been identified in Spectrum Power 4 (with Web Office Portal). An attacker with network access to the web server on port 80/TCP or 443/TCP c… |
CVE-2019-5424 | High | 8.8 | 2019-04-10 | In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, a privileged user can execute arbitrary shell commands over the SSH CLI interface. This allows to execute s… |
CVE-2019-6552 | Critical | 9.8 | 2019-04-05 | Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple command injection vulnerabilities, caused by a lack of proper validation of user-supplied data, m… |
CVE-2019-5420 | Critical | 9.8 | 2019-03-27 | A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development m… |
CVE-2019-9743 | High | 8.8 | 2019-03-26 | An issue was discovered on PHOENIX CONTACT RAD-80211-XD and RAD-80211-XD/HP-BUS devices. Command injection can occur in the WebHMI component. |
CVE-2019-9059 | High | 7.2 | 2019-03-26 | An issue was discovered in CMS Made Simple 2.2.8. It is possible, with an administrator account, to achieve command injection by modifying the path of the e-ma… |
CVE-2019-7610 | Critical | 9.0 | 2019-03-25 | Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.e… |
CVE-2019-7537 | Critical | 9.8 | 2019-03-21 | An issue was discovered in Donfig 0.3.0. There is a vulnerability in the collect_yaml method in config_obj.py. It can execute arbitrary Python commands, result… |
CVE-2018-3963 | High | 8.0 | 2019-03-21 | An exploitable command injection vulnerability exists in the DHCP daemon configuration of the CUJO Smart Firewall. When adding a new static DHCP address, its c… |
CVE-2019-6275 | High | 8.8 | 2019-03-21 | Command injection vulnerability in firmware_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code. |
CVE-2019-6272 | High | 8.8 | 2019-03-21 | Command injection vulnerability in login_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code. |
CVE-2019-5414 | High | 8.1 | 2019-03-21 | If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of the exec function in… |
CVE-2019-5413 | Critical | 9.8 | 2019-03-21 | An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1. |
CVE-2019-1614 | High | 8.8 | 2019-03-11 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges… |
CVE-2019-1613 | Medium | 6.7 | 2019-03-11 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1612 | Medium | 4.2 | 2019-03-11 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1611 | Medium | 6.7 | 2019-03-11 | A vulnerability in the CLI of Cisco NX-OS Software and Cisco FXOS Software could allow an authenticated, local attacker to execute arbitrary commands on the un… |
CVE-2019-1610 | Medium | 6.7 | 2019-03-11 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1609 | Medium | 6.7 | 2019-03-08 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1608 | Medium | 6.7 | 2019-03-08 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1607 | Medium | 6.7 | 2019-03-08 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1606 | High | 7.8 | 2019-03-08 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2018-20236 | High | 8.8 | 2019-03-08 | There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. A remote attacker could send a… |
CVE-2019-3920 | High | 8.8 | 2019-03-05 | The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to authenticated command injection via crafted HTTP request sent by a… |
CVE-2019-3919 | High | 8.8 | 2019-03-05 | The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to command injection via crafted HTTP request sent by a remote, authen… |
CVE-2013-2516 | High | 8.8 | 2019-02-15 | Vulnerability in FileUtils v0.7, Ruby Gem Fileutils <= v0.7 Command Injection vulnerability in user supplied url variable that is passed to the shell. |
CVE-2016-1000282 | Critical | 9.8 | 2019-02-05 | Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injectio… |
CVE-2019-1000018 | High | 7.8 | 2019-02-04 | rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission… |
CVE-2019-3913 | Medium | 4.9 | 2019-01-30 | Command manipulation in LabKey Server Community Edition before 18.3.0-61806.763 allows an authenticated remote attacker to unmount any drive on the system lead… |
CVE-2018-19015 | High | 7.3 | 2019-01-28 | An attacker could inject commands to launch programs and create, write, and read files on CX-Supervisor (Versions 3.42 and prior) through a specially crafted p… |
CVE-2019-6986 | High | 7.5 | 2019-01-28 | SPARQL Injection in VIVO Vitro v1.10.0 allows a remote attacker to execute arbitrary SPARQL via the uri parameter, leading to a regular expression denial of se… |
CVE-2019-1646 | High | 7.8 | 2019-01-24 | A vulnerability in the local CLI of the Cisco SD-WAN Solution could allow an authenticated, local attacker to escalate privileges and modify device configurati… |
CVE-2018-19013 | Medium | 5.0 | 2019-01-22 | An attacker could inject commands to delete files and/or delete the contents of a file on CX-Supervisor (Versions 3.42 and prior) through a specially crafted p… |
CVE-2018-5412 | High | 7.8 | 2019-01-10 | Imperva SecureSphere running v12.0.0.50 is vulnerable to local arbitrary code execution, escaping sealed-mode. |
CVE-2018-5403 | High | 8.1 | 2019-01-10 | Imperva SecureSphere gateway (GW) running v13, for both pre-First Time Login or post-First Time Login (FTL), if the attacker knows the basic authentication pas… |
CVE-2017-15403 | High | 7.3 | 2019-01-09 | Insufficient data validation in crosh could lead to a command injection under chronos privileges in Networking in Google Chrome on Chrome OS prior to 61.0.3163… |
CVE-2019-0541 | High | 8.8 | 2019-01-08 | A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerabili… |
CVE-2018-17172 | Critical | 9.8 | 2019-01-03 | The web application on Xerox AltaLink B80xx before 100.008.028.05200, C8030/C8035 before 100.001.028.05200, C8045/C8055 before 100.002.028.05200, and C8070 bef… |
CVE-2018-19911 | High | 7.5 | 2018-12-06 | FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system (or api/bg_sys… |
CVE-2018-14746 | Critical | 9.8 | 2018-11-28 | Command Injection vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions… |
CVE-2018-14893 | High | 8.8 | 2018-11-27 | A system command injection vulnerability in zyshclient in ZyXEL NSA325 V2 version 4.81 allows attackers to execute system commands via the web application API. |
CVE-2018-16462 | Critical | 10.0 | 2018-10-30 | A command injection vulnerability in the apex-publish-static-files npm module version <2.0.1 which allows arbitrary shell command execution through a malicious… |
CVE-2018-16461 | Critical | 9.8 | 2018-10-30 | A command injection vulnerability in libnmapp package for versions <0.4.16 allows arbitrary commands to be executed via arguments to the range options. |
CVE-2016-10729 | High | 7.8 | 2018-10-24 | An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The "runtar" setuid root binary does not… |
CVE-2018-17445 | Critical | 9.8 | 2018-10-23 | A Command Injection issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4. |
CVE-2018-14649 | Critical | 9.8 | 2018-10-09 | It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is done by setting debug=… |
CVE-2018-0481 | Medium | 6.7 | 2018-10-05 | A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an… |
CVE-2018-0477 | Medium | 6.7 | 2018-10-05 | A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an… |
CVE-2018-0454 | High | 8.8 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Cloud Services Platform 2100 could allow an authenticated, remote attacker to perform command in… |
CVE-2018-0433 | High | 7.8 | 2018-10-05 | A vulnerability in the command-line interface (CLI) in the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary commands that… |
CVE-2018-0431 | High | 8.8 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to… |
CVE-2018-0430 | High | 8.8 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to… |
CVE-2018-0424 | High | 8.8 | 2018-10-05 | A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco… |
CVE-2014-10075 | Critical | 9.8 | 2018-10-05 | The karo gem 2.3.8 for Ruby allows Remote command injection via the host field. |
CVE-2018-1000802 | Critical | 9.8 | 2018-09-18 | Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')… |
CVE-2018-0718 | Critical | 9.8 | 2018-09-14 | Command injection vulnerability in Music Station 5.1.2 and earlier versions in QNAP QTS 4.3.3 and 4.3.4 could allow remote attackers to run arbitrary commands… |
CVE-2018-16460 | Critical | 9.8 | 2018-09-07 | A command Injection in ps package versions <1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID. |
CVE-2016-9044 | High | 8.8 | 2018-09-07 | An exploitable command execution vulnerability exists in Information Builders WebFOCUS Business Intelligence Portal 8.1 . A specially crafted web parameter can… |
CVE-2018-3786 | Critical | 9.8 | 2018-08-24 | A command injection vulnerability in egg-scripts <v2.8.1 allows arbitrary shell command execution through a maliciously crafted command line argument. |
CVE-2018-15356 | High | 8.8 | 2018-08-17 | An authenticated attacker can execute arbitrary code using command ejection in Eltex ESP-200 firmware version 1.2.0. |
CVE-2018-0427 | High | 8.8 | 2018-08-15 | A vulnerability in the CronJob scheduler API of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to perform a comm… |
CVE-2018-0714 | Critical | 9.8 | 2018-08-13 | Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531, QTS 4.3.3 build 20180528, QTS 4.3.4 build 20180528 an… |
CVE-2018-3779 | Critical | 9.8 | 2018-08-10 | active-support ruby gem 5.2.0 could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoor. An attacker cou… |
CVE-2018-9866 | Critical | 9.8 | 2018-08-03 | A vulnerability in lack of validation of user-supplied parameters pass to XML-RPC calls on SonicWall Global Management System (GMS) virtual appliance's, allow… |
CVE-2016-8628 | High | 7.6 | 2018-07-31 | Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variabl… |
CVE-2018-3772 | Critical | 9.8 | 2018-07-30 | Concatenating unsanitized user input in the `whereis` npm module < 0.4.1 allowed an attacker to execute arbitrary commands. The `whereis` module is deprecated… |
CVE-2018-0351 | High | 7.8 | 2018-07-18 | A vulnerability in the command-line tcpdump utility in the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary commands that… |
CVE-2018-0350 | High | 8.8 | 2018-07-18 | A vulnerability in the VPN subsystem configuration in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that… |
CVE-2018-0348 | High | 7.2 | 2018-07-18 | A vulnerability in the CLI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root… |
CVE-2018-0347 | High | 7.8 | 2018-07-18 | A vulnerability in the Zero Touch Provisioning (ZTP) subsystem of the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary co… |
CVE-2018-0344 | High | 7.2 | 2018-07-18 | A vulnerability in the vManage dashboard for the configuration and management service of the Cisco SD-WAN Solution could allow an authenticated, remote attacke… |
CVE-2018-0341 | High | 8.8 | 2018-07-16 | A vulnerability in the web-based UI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware before 11.2(1) could allow an authenticated, remo… |
CVE-2016-6558 | Critical | 9.8 | 2018-07-13 | A command injection vulnerability exists in apply.cgi on the ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, web interface specifica… |
CVE-2018-8306 | Medium | 5.5 | 2018-07-11 | A command injection vulnerability exists in the Microsoft Wireless Display Adapter (MWDA) when the Microsoft Wireless Display Adapter does not properly manage… |
CVE-2018-7785 | Critical | 9.8 | 2018-07-03 | In Schneider Electric U.motion Builder software versions prior to v1.3.4, a remote command injection allows authentication bypass. |
CVE-2018-1244 | High | 8.8 | 2018-07-02 | Dell EMC iDRAC7/iDRAC8, versions prior to 2.60.60.60, and iDRAC9 versions prior to 3.21.21.21 contain a command injection vulnerability in the SNMP agent. A re… |
CVE-2018-1212 | High | 8.8 | 2018-07-02 | The web-based diagnostics console in Dell EMC iDRAC6 (Monolithic versions prior to 2.91 and Modular all versions) contains a command injection vulnerability. A… |
CVE-2018-12465 | Critical | 9.1 | 2018-06-29 | An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated… |
CVE-2018-0712 | Critical | 9.8 | 2018-06-21 | Command injection vulnerability in LDAP Server in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20180402, QTS 4.3.4 build 20180413 and their earlier versions… |
CVE-2018-5428 | High | 8.8 | 2018-06-20 | The version control adapters component of TIBCO Data Virtualization (formerly known as Cisco Information Server) contains vulnerabilities that may allow for ar… |
CVE-2011-4182 | High | 7.3 | 2018-06-12 | Missing escaping of ESSID values in sysconfig of SUSE Linux Enterprise allows attackers controlling an access point to cause execute arbitrary code. Affected r… |
CVE-2014-5220 | High | 7.8 | 2018-06-08 | The mdcheck script of the mdadm package for openSUSE 13.2 prior to version 3.3.1-5.14.1 does not properly sanitize device names, which allows local attackers t… |
CVE-2017-12078 | High | 7.2 | 2018-06-08 | Command injection vulnerability in EZ-Internet in Synology Router Manager (SRM) before 1.1.6-6931 allows remote authenticated users to execute arbitrary comman… |
CVE-2017-12075 | High | 7.2 | 2018-06-08 | Command injection vulnerability in EZ-Internet in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to execute arbitrary co… |
CVE-2017-16100 | Critical | 9.8 | 2018-06-07 | dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible. |
CVE-2018-3746 | Critical | 9.8 | 2018-06-01 | The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on the victim's machine. |
CVE-2016-7076 | Medium | 6.4 | 2018-05-29 | sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a… |
CVE-2018-1111 | High | 7.5 | 2018-05-17 | DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script i… |
CVE-2018-0324 | Medium | 6.7 | 2018-05-17 | A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, high-privileged, local attacker to perform a c… |
CVE-2014-5014 | Critical | 9.8 | 2018-04-25 | The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters… |
CVE-2017-2833 | High | 7.5 | 2018-04-24 | An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52… |
CVE-2017-2832 | High | 7.2 | 2018-04-24 | An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52… |
CVE-2014-8888 | Critical | 9.8 | 2018-04-12 | The remote administration interface in D-Link DIR-815 devices with firmware before 2.03.B02 allows remote attackers to execute arbitrary commands via vectors r… |
CVE-2014-6120 | Critical | 9.8 | 2018-04-12 | IBM Rational AppScan Source 8.0 through 8.0.0.2 and 8.5 through 8.5.0.1 and Security AppScan Source 8.6 through 8.6.0.2, 8.7 through 8.7.0.1, 8.8, 9.0 through… |