CWE-77 · Command Injection (page 36)
Page 36 of 39 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-0729 | Critical | 9.8 | 2019-12-04 | This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend upd… |
CVE-2019-15595 | High | 8.8 | 2019-11-26 | A privilege escalation exists in UniFi Video Controller =<3.10.6 that would allow an attacker on the local machine to run arbitrary commands. |
CVE-2019-18647 | High | 7.2 | 2019-11-14 | The Untangle NG firewall 14.2.0 is vulnerable to an authenticated command injection when logged in as an admin user. |
CVE-2019-9467 | Medium | 6.7 | 2019-11-13 | In the Bootloader, there is a possible kernel command injection due to missing command sanitization. This could lead to a local elevation of privilege with Sys… |
CVE-2019-18780 | Critical | 9.8 | 2019-11-05 | An arbitrary command injection vulnerability in the Cluster Server component of Veritas InfoScale allows an unauthenticated remote attacker to execute arbitrar… |
CVE-2018-19031 | High | 8.8 | 2019-11-04 | A command injection vulnerability exists when the authorized user passes crafted parameter to background process in the router. This affects 360 router series… |
CVE-2019-15588 | High | 7.2 | 2019-11-01 | There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All… |
CVE-2019-3421 | High | 8.0 | 2019-10-31 | The 7520V3V1.0.0B09P27 version, and all earlier versions of ZTE product ZX297520V3 are impacted by a Command Injection vulnerability. Unauthorized users can ex… |
CVE-2018-16417 | High | 7.5 | 2019-10-30 | Aruba Instant 4.x prior to 6.4.4.8-4.2.4.12, 6.5.x prior to 6.5.4.11, 8.3.x prior to 8.3.0.6, and 8.4.x prior to 8.4.0.1 allows Command injection. |
CVE-2019-18188 | High | 7.5 | 2019-10-28 | Trend Micro Apex One could be exploited by an attacker utilizing a command injection vulnerability to extract files from an arbitrary zip file to a specific fo… |
CVE-2019-8088 | Critical | 9.8 | 2019-10-25 | Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2019-15051 | High | 8.8 | 2019-10-10 | An issue was discovered in Softing uaGate (SI, MB, 840D) firmware through 1.71.00.1225. A CGI script is vulnerable to command injection via a maliciously craft… |
CVE-2019-1584 | Critical | 9.8 | 2019-10-09 | A security vulnerability exists in Zingbox Inspector version 1.293 and earlier, that allows for remote code execution if the Inspector were sent a malicious co… |
CVE-2019-12736 | Critical | 9.8 | 2019-10-02 | JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the user for the LDAP protocol, leading to command injection. |
CVE-2019-8073 | Critical | 9.8 | 2019-09-27 | ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Command Injection via Vulnerable component vulnerability. Successful ex… |
CVE-2019-11279 | High | 8.8 | 2019-09-26 | CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user c… |
CVE-2019-11278 | High | 8.8 | 2019-09-26 | CF UAA versions prior to 74.1.0, allow external input to be directly queried against. A remote malicious user with 'client.write' and 'groups.update' can craft… |
CVE-2019-12661 | Medium | 6.7 | 2019-09-25 | A vulnerability in a Virtualization Manager (VMAN) related CLI command of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitra… |
CVE-2019-12651 | High | 8.8 | 2019-09-25 | Multiple vulnerabilities in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands wi… |
CVE-2019-12650 | High | 8.8 | 2019-09-25 | Multiple vulnerabilities in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands wi… |
CVE-2019-13552 | High | 8.8 | 2019-09-18 | In WebAccess versions 8.4.1 and prior, multiple command injection vulnerabilities are caused by a lack of proper validation of user-supplied data and may allow… |
CVE-2019-16305 | High | 8.8 | 2019-09-14 | In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection. A crafted link can trigger a popup asking whether the user wants to run Mo… |
CVE-2019-9254 | High | 7.8 | 2019-09-05 | In readArgumentList of zygote.java in Android 10, there is a possible command injection due to improper input validation. This could lead to local escalation o… |
CVE-2019-7989 | High | 8.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary c… |
CVE-2019-7968 | Critical | 9.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary c… |
CVE-2019-8060 | Critical | 9.8 | 2019-08-20 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-12104 | High | 8.8 | 2019-08-14 | The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by several post-authentication command injection vulnerab… |
CVE-2019-12805 | High | 8.8 | 2019-08-09 | NCSOFT Game Launcher, NC Launcher2 2.4.1.691 and earlier versions have a vulnerability in the custom protocol handler that could allow remote attacker to execu… |
CVE-2019-14745 | High | 7.8 | 2019-08-07 | In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to ex… |
CVE-2017-18442 | Medium | 5.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246). |
CVE-2017-18400 | High | 7.8 | 2019-08-02 | cPanel before 68.0.15 allows local root code execution via cpdavd (SEC-333). |
CVE-2016-10849 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82). |
CVE-2016-10843 | High | 8.1 | 2019-08-01 | cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API (SEC-76). |
CVE-2019-1010174 | Critical | 9.8 | 2019-07-25 | CImg The CImg Library v.2.3.3 and earlier is affected by: command injection. The impact is: RCE. The component is: load_network() function. The attack vector i… |
CVE-2019-7850 | Critical | 9.8 | 2019-07-18 | Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. Successful exploitation could lead to Arbitrary Code E… |
CVE-2016-10762 | High | 7.5 | 2019-07-18 | The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used. |
CVE-2019-1923 | Medium | 6.6 | 2019-07-17 | A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vu… |
CVE-2019-11535 | Critical | 9.8 | 2019-07-17 | Unsanitized user input in the web interface for Linksys WiFi extender products (RE6400 and RE6300 through 1.2.04.022) allows for remote command execution. An a… |
CVE-2019-5446 | High | 7.2 | 2019-07-10 | Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root. |
CVE-2019-1893 | High | 7.8 | 2019-07-06 | A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to execute arbitrary commands on the under… |
CVE-2019-6622 | High | 7.2 | 2019-07-02 | On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.5, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4, an undisclosed iControl REST worker is vulnerable to command i… |
CVE-2017-8413 | High | 8.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for b… |
CVE-2017-8411 | High | 8.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by… |
CVE-2017-8404 | Critical | 9.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by… |
CVE-2017-8408 | Critical | 9.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by… |
CVE-2019-13152 | High | 8.8 | 2019-07-02 | An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the IP… |
CVE-2019-13150 | High | 8.8 | 2019-07-02 | An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication). The comman… |
CVE-2019-13148 | High | 8.8 | 2019-07-02 | An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the UDP… |
CVE-2019-13024 | High | 8.8 | 2019-07-01 | Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "… |
CVE-2019-1624 | High | 8.8 | 2019-06-20 | A vulnerability in the vManage web-based UI (Web UI) in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands th… |
CVE-2019-1623 | Medium | 6.7 | 2019-06-20 | A vulnerability in the CLI configuration shell of Cisco Meeting Server could allow an authenticated, local attacker to inject arbitrary commands as the root us… |
CVE-2017-8333 | High | 8.8 | 2019-06-18 | An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of adding ne… |
CVE-2017-8331 | High | 8.8 | 2019-06-18 | An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of adding ne… |
CVE-2018-19450 | High | 7.8 | 2019-06-17 | A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) 5.4.0.1031 when parsing a launch action. An attacker can leverage t… |
CVE-2018-19445 | High | 7.8 | 2019-06-17 | A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the JavaScript API app.launchURL is us… |
CVE-2017-9384 | High | 8.8 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device… |
CVE-2017-9388 | High | 8.8 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device… |
CVE-2019-7839 | Critical | 9.8 | 2019-06-12 | ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a command injection vulnerability. Successful exploitation coul… |
CVE-2017-18378 | High | 8.4 | 2019-06-11 | In NETGEAR ReadyNAS Surveillance before 1.4.3-17 x86 and before 1.1.4-7 ARM, $_GET['uploaddir'] is not escaped and is passed to system() through $tmp_upload_di… |
CVE-2017-18377 | Critical | 9.8 | 2019-06-11 | An issue was discovered on Wireless IP Camera (P2P) WIFICAM cameras. There is Command Injection in the set_ftp.cgi script via shell metacharacters in the pwd v… |
CVE-2016-10760 | Critical | 9.8 | 2019-06-11 | On Seowon Intech routers, there is a Command Injection vulnerability in diagnostic.cgi via shell metacharacters in the ping_ipaddr parameter. |
CVE-2013-7471 | Critical | 9.8 | 2019-06-11 | An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, DIR-300 rev. B, and… |
CVE-2010-5330 | Critical | 9.8 | 2019-06-11 | On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demo… |
CVE-2009-5157 | High | 8.8 | 2019-06-11 | On Linksys WAG54G2 1.00.10 devices, there is authenticated command injection via shell metacharacters in the setup.cgi c4_ping_ipaddr variable. |
CVE-2009-5156 | Critical | 9.8 | 2019-06-11 | An issue was discovered on ASMAX AR-804gu 66.34.1 devices. There is Command Injection via the cgi-bin/script query string. |
CVE-2019-12786 | High | 8.8 | 2019-06-10 | An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a command injection in HNAP1 SetWanSettings via an XML injection of… |
CVE-2018-19451 | High | 7.8 | 2019-06-07 | A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when using the Open File action on a Field… |
CVE-2018-20523 | Medium | 5.3 | 2019-06-07 | Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection. In other words, a third-part… |
CVE-2019-5390 | Critical | 9.8 | 2019-06-05 | A remote command injection vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
CVE-2019-6739 | High | 8.8 | 2019-06-03 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Malwarebytes Antimalware 3.6.1.2711. User interaction is re… |
CVE-2019-12591 | Medium | 6.8 | 2019-06-03 | NETGEAR Insight Cloud with firmware before Insight 5.6 allows remote authenticated users to achieve command injection. |
CVE-2019-10854 | High | 8.8 | 2019-05-23 | Computrols CBAS 18.0.0 allows Authenticated Command Injection. |
CVE-2018-7826 | High | 8.8 | 2019-05-22 | A Command Injection vulnerability exists in the web-based GUI of the 1st Gen Pelco Sarix Enhanced Camera that could allow a remote attacker to execute arbitrar… |
CVE-2018-7825 | High | 8.8 | 2019-05-22 | A Command Injection vulnerability exists in the web-based GUI of the 1st Gen PelcoSarix Enhanced Camera that could allow a remote attacker to execute arbitrary… |
CVE-2019-1780 | Medium | 6.7 | 2019-05-16 | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execu… |
CVE-2019-1795 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the un… |
CVE-2019-1791 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands wi… |
CVE-2019-1790 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with valid administrator credentials to execute arbitrary comma… |
CVE-2019-1784 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating… |
CVE-2019-1783 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands on… |
CVE-2019-1782 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the un… |
CVE-2019-1781 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the un… |
CVE-2019-1779 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the un… |
CVE-2019-1735 | High | 7.8 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges on the u… |
CVE-2019-10640 | High | 7.5 | 2019-05-15 | An issue was discovered in GitLab Community and Enterprise Edition before 11.7.10, 11.8.x before 11.8.6, and 11.9.x before 11.9.4. A regex input validation iss… |
CVE-2019-6689 | High | 7.8 | 2019-04-26 | An issue was discovered in Dillon Kane Tidal Workload Automation Agent 3.2.0.5 (formerly known as Cisco Workload Automation or CWA). The Enterprise Scheduler f… |
CVE-2019-11217 | Critical | 9.8 | 2019-04-24 | The GitController in Jakub Chodounsky Bonobo Git Server before 6.5.0 allows execution of arbitrary commands in the context of the web server via a crafted http… |
CVE-2019-11076 | Critical | 9.8 | 2019-04-23 | Cribl UI 1.5.0 allows remote attackers to run arbitrary commands via an unauthenticated web request. |
CVE-2019-6579 | Critical | 9.8 | 2019-04-17 | A vulnerability has been identified in Spectrum Power 4 (with Web Office Portal). An attacker with network access to the web server on port 80/TCP or 443/TCP c… |
CVE-2019-5424 | High | 8.8 | 2019-04-10 | In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, a privileged user can execute arbitrary shell commands over the SSH CLI interface. This allows to execute s… |
CVE-2019-6552 | Critical | 9.8 | 2019-04-05 | Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple command injection vulnerabilities, caused by a lack of proper validation of user-supplied data, m… |
CVE-2019-5420 | Critical | 9.8 | 2019-03-27 | A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development m… |
CVE-2019-9743 | High | 8.8 | 2019-03-26 | An issue was discovered on PHOENIX CONTACT RAD-80211-XD and RAD-80211-XD/HP-BUS devices. Command injection can occur in the WebHMI component. |
CVE-2019-9059 | High | 7.2 | 2019-03-26 | An issue was discovered in CMS Made Simple 2.2.8. It is possible, with an administrator account, to achieve command injection by modifying the path of the e-ma… |
CVE-2019-7610 | Critical | 9.0 | 2019-03-25 | Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.e… |
CVE-2019-7537 | Critical | 9.8 | 2019-03-21 | An issue was discovered in Donfig 0.3.0. There is a vulnerability in the collect_yaml method in config_obj.py. It can execute arbitrary Python commands, result… |
CVE-2018-3963 | High | 8.0 | 2019-03-21 | An exploitable command injection vulnerability exists in the DHCP daemon configuration of the CUJO Smart Firewall. When adding a new static DHCP address, its c… |
CVE-2019-6275 | High | 8.8 | 2019-03-21 | Command injection vulnerability in firmware_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code. |
CVE-2019-6272 | High | 8.8 | 2019-03-21 | Command injection vulnerability in login_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code. |
CVE-2019-5414 | High | 8.1 | 2019-03-21 | If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of the exec function in… |