CWE-77 · Command Injection (page 36)
Page 36 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-6633 | High | 8.8 | 2018-04-12 | The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote a… |
CVE-2014-3114 | Critical | 9.8 | 2018-04-10 | The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to execute arbitrary commands via the cmd p… |
CVE-2017-7161 | High | 8.8 | 2018-04-03 | An issue was discovered in certain Apple products. Safari before 11.0.2 is affected. The issue involves the "WebKit Web Inspector" component. It allows remote… |
CVE-2017-0916 | Critical | 9.8 | 2018-03-21 | Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the system_hook_push queue through web hook component resulting in remote… |
CVE-2017-0915 | Critical | 9.8 | 2018-03-21 | Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService resulting in remote code execution. |
CVE-2018-0224 | Medium | 6.7 | 2018-03-08 | A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authenticated, local atta… |
CVE-2018-0217 | Medium | 6.7 | 2018-03-08 | A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authenticated, local atta… |
CVE-2018-5439 | Critical | 9.8 | 2018-02-19 | A Command Injection issue was discovered in Nortek Linear eMerge E3 series Versions V0.32-07e and prior. A remote attacker may be able to execute arbitrary cod… |
CVE-2016-8523 | High | 8.8 | 2018-02-15 | A Remote Arbitrary Code Execution vulnerability in HPE Smart Storage Administrator version before v2.60.18.0 was found. |
CVE-2017-1720 | Medium | 5.3 | 2018-02-13 | IBM Notes 8.5 and 9.0 could allow a local attacker to execute arbitrary commands by carefully crafting a command line sent via the shared memory IPC. IBM X-For… |
CVE-2016-5397 | High | 8.8 | 2018-02-12 | The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apach… |
CVE-2014-1834 | High | 7.8 | 2018-02-02 | The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to inject arbitrary code by adding a semi-colon in their use… |
CVE-2017-14593 | High | 8.8 | 2018-01-26 | Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a rep… |
CVE-2017-14592 | High | 8.8 | 2018-01-26 | Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repos… |
CVE-2016-0324 | High | 8.8 | 2018-01-12 | IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote authenticated users to execute arbitra… |
CVE-2018-0007 | Critical | 9.8 | 2018-01-10 | An unauthenticated network-based attacker able to send a maliciously crafted LLDP packet to the local segment, through a local segment broadcast, may be able t… |
CVE-2017-15940 | Critical | 9.8 | 2017-12-11 | The web interface packet capture management component in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8… |
CVE-2017-15889 | High | 8.8 | 2017-12-04 | Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to execute arbitrary com… |
CVE-2017-12352 | Medium | 6.7 | 2017-11-30 | A vulnerability in certain system script files that are installed at boot time on Cisco Application Policy Infrastructure Controllers could allow an authentica… |
CVE-2017-12341 | Medium | 6.7 | 2017-11-30 | A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. An attacker would… |
CVE-2017-12339 | Medium | 5.7 | 2017-11-30 | A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. The vulnerability… |
CVE-2017-12335 | Medium | 6.3 | 2017-11-30 | A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. The vulnerability… |
CVE-2017-12330 | Medium | 6.3 | 2017-11-30 | A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. The vulnerability… |
CVE-2017-12329 | Medium | 6.3 | 2017-11-30 | A vulnerability in the CLI of Cisco Firepower Extensible Operating System (FXOS) and NX-OS System Software could allow an authenticated, local attacker to perf… |
CVE-2017-8197 | High | 7.2 | 2017-11-22 | FusionSphere V100R006C00SPC102(NFV) has a command injection vulnerability. An authenticated, remote attacker could craft packets with malicious strings and sen… |
CVE-2017-8193 | High | 8.0 | 2017-11-22 | The FusionSphere OpenStack V100R006C00SPC102(NFV) has a command injection vulnerability. Due to the insufficient input validation on one port, an authenticated… |
CVE-2017-8188 | High | 7.2 | 2017-11-22 | FusionSphere OpenStack V100R006C00SPC102(NFV)has a command injection vulnerability. Due to lack of validation, an attacker with high privilege may inject malic… |
CVE-2017-8135 | High | 8.8 | 2017-11-22 | The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP… |
CVE-2017-8134 | High | 8.8 | 2017-11-22 | The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP… |
CVE-2017-8133 | High | 8.8 | 2017-11-22 | Huawei iManager NetEco with software V600R008C00 and V600R008C10 has a command injection vulnerability. An authenticated, remote attacker could exploit this vu… |
CVE-2017-8132 | High | 8.8 | 2017-11-22 | The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP… |
CVE-2017-8131 | High | 8.8 | 2017-11-22 | The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP… |
CVE-2017-2736 | High | 7.2 | 2017-11-22 | VCM5010 with software versions earlier before V100R002C50SPC100 has a command injection vulnerability. This is due to insufficient validation of user's input… |
CVE-2017-2719 | High | 8.8 | 2017-11-22 | FusionSphere OpenStack with software V100R006C00 and V100R006C10RC2 has two command injection vulnerabilities due to the insufficient input validation on one p… |
CVE-2017-2718 | High | 8.8 | 2017-11-22 | FusionSphere OpenStack with software V100R006C00 and V100R006C10RC2 has two command injection vulnerabilities due to the insufficient input validation on one p… |
CVE-2017-2692 | High | 7.8 | 2017-11-22 | The Keyguard application in ALE-L02C635B140 and earlier versions,ALE-L02C636B140 and earlier versions,ALE-L21C10B150 and earlier versions,ALE-L21C185B200 and e… |
CVE-2017-13071 | Critical | 9.8 | 2017-11-22 | QNAP has already patched this vulnerability. This security concern allows a remote attacker to run arbitrary commands on the QNAP Video Station 5.1.3 (for QTS… |
CVE-2017-12305 | Medium | 6.7 | 2017-11-16 | A vulnerability in the debug interface of Cisco IP Phone 8800 series could allow an authenticated, local attacker to execute arbitrary commands, aka Debug Shel… |
CVE-2008-7319 | Critical | 9.8 | 2017-11-07 | The Net::Ping::External extension through 0.15 for Perl does not properly sanitize arguments (e.g., invalid hostnames) containing shell metacharacters before u… |
CVE-2017-12094 | High | 7.4 | 2017-11-07 | An exploitable vulnerability exists in the WiFi Channel parsing of Circle with Disney running firmware 2.0.1. A specially crafted SSID can cause the device to… |
CVE-2017-12277 | High | 8.8 | 2017-11-02 | A vulnerability in the Smart Licensing Manager service of the Cisco Firepower 4100 Series Next-Generation Firewall (NGFW) and Firepower 9300 Security Appliance… |
CVE-2014-1203 | Critical | 9.8 | 2017-10-24 | The get_login_ip_config_file function in Eyou Mail System before 3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the doma… |
CVE-2014-3741 | Critical | 9.8 | 2017-10-23 | The printDirect function in lib/printer.js in the node-printer module 0.0.1 and earlier for Node.js allows remote attackers to execute arbitrary commands via u… |
CVE-2013-7377 | High | 8.1 | 2017-10-23 | The codem-transcode module before 0.5.0 for Node.js, when ffprobe is enabled, allows remote attackers to execute arbitrary commands via a POST request to /prob… |
CVE-2015-7806 | Critical | 9.8 | 2017-10-17 | Eval injection vulnerability in the fm_saveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allows remote attackers… |
CVE-2014-9118 | High | 8.8 | 2017-10-17 | The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary commands via shell metacharacters in the ip… |
CVE-2016-4922 | High | 8.4 | 2017-10-13 | Certain combinations of Junos OS CLI commands and arguments have been found to be exploitable in a way that can allow unauthorized access to the operating syst… |
CVE-2013-6924 | Critical | 9.8 | 2017-10-11 | Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to execute arbitrary commands via shell metacharacters in the ip parameter… |
CVE-2008-7315 | Critical | 9.8 | 2017-10-10 | UI-Dialog 1.09 and earlier allows remote attackers to execute arbitrary commands. |
CVE-2017-13069 | Critical | 9.8 | 2017-10-06 | QNAP discovered a number of command injection vulnerabilities found in Music Station versions 4.8.6 (for QTS 4.2.x), 5.0.7 (for QTS 4.3.x), and earlier. If exp… |
CVE-2015-7841 | Critical | 9.8 | 2017-10-03 | The login page of the server on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00S… |
CVE-2015-6971 | High | 7.8 | 2017-10-03 | Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0013 allows local users to submit commands to the System Update service (SUService.exe)… |
CVE-2017-1407 | High | 8.8 | 2017-09-28 | IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending… |
CVE-2015-5704 | High | 7.8 | 2017-09-25 | scripts/licensecheck.pl in devscripts before 2.15.7 allows local users to execute arbitrary shell commands. |
CVE-2017-14081 | High | 8.8 | 2017-09-22 | Proxy command injection vulnerabilities in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to execute arbitrary cod… |
CVE-2017-1352 | Medium | 5.5 | 2017-09-12 | IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to inject commands into work orders that could be executed by another user that downl… |
CVE-2017-6794 | Medium | 6.7 | 2017-09-07 | A vulnerability in the CLI command-parsing code of Cisco Meeting Server could allow an authenticated, local attacker to perform command injection and escalate… |
CVE-2015-2210 | High | 7.8 | 2017-09-06 | The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into the window source to… |
CVE-2015-2857 | Critical | 9.8 | 2017-08-22 | Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauth_token parameter. |
CVE-2017-6327 | High | 8.8 | 2017-08-11 | The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain… |
CVE-2017-12756 | High | 7.2 | 2017-08-09 | Command inject in transfer from another server in extplorer 2.1.9 and prior allows attacker to inject command via the userfile[0] parameter. |
CVE-2017-11392 | High | 8.8 | 2017-08-03 | Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vul… |
CVE-2017-11391 | High | 8.8 | 2017-08-03 | Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vul… |
CVE-2014-8903 | High | 8.8 | 2017-08-02 | IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5iFix10 and 6.0.5 before 6.0.5.6 allows remote authenticated users to load arbitrar… |
CVE-2017-9980 | Critical | 9.8 | 2017-07-21 | In Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, the "PING" (aka tag_ipPing) feature within the web interface allows performing command injectio… |
CVE-2017-7977 | Critical | 9.8 | 2017-07-19 | The Screensavercc component in eLux RP before 5.5.0 allows attackers to bypass intended configuration restrictions and execute arbitrary commands with root pri… |
CVE-2017-2349 | Critical | 9.9 | 2017-07-17 | A command injection vulnerability in the IDP feature of Juniper Networks Junos OS on SRX series devices potentially allows a user with login access to the devi… |
CVE-2017-4054 | High | 8.8 | 2017-07-12 | Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote authenticated users to execute a… |
CVE-2017-4984 | Critical | 9.8 | 2017-06-19 | In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, an unauthenticated remote attacker may be able to elevate… |
CVE-2017-7876 | Critical | 10.0 | 2017-06-15 | This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. QNAP have already fixed the issue in QTS… |
CVE-2016-6655 | Critical | 9.8 | 2017-06-13 | An issue was discovered in Cloud Foundry Foundation Cloud Foundry release versions prior to v245 and cf-mysql-release versions prior to v31. A command injectio… |
CVE-2017-4918 | Critical | 9.8 | 2017-06-08 | VMware Horizon View Client (2.x, 3.x and 4.x prior to 4.5.0) contains a command injection vulnerability in the service startup script. Successful exploitation… |
CVE-2015-9059 | Critical | 9.8 | 2017-05-28 | picocom before 2.0 has a command injection vulnerability in the 'send and receive file' command because the command line is executed by /bin/sh unsafely. |
CVE-2015-4046 | High | 7.2 | 2017-05-23 | The asset discovery scanner in AlienVault OSSIM before 5.0.1 allows remote authenticated users to execute arbitrary commands via the assets array parameter to… |
CVE-2017-6650 | High | 7.8 | 2017-05-22 | A vulnerability in the Telnet CLI command of Cisco NX-OS System Software 7.1 through 7.3 running on Cisco Nexus Series Switches could allow an authenticated, l… |
CVE-2017-6649 | High | 7.8 | 2017-05-22 | A vulnerability in the CLI of Cisco NX-OS System Software 7.1 through 7.3 running on Cisco Nexus Series Switches could allow an authenticated, local attacker t… |
CVE-2017-6048 | High | 8.8 | 2017-05-19 | A Command Injection issue was discovered in Satel Iberia SenNet Data Logger and Electricity Meters: SenNet Optimal DataLogger V5.37c-1.43c and prior, SenNet So… |
CVE-2016-10329 | Critical | 9.8 | 2017-05-12 | Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharac… |
CVE-2015-8257 | High | 8.8 | 2017-05-02 | The devtools.sh script in AXIS network cameras allows remote authenticated users to execute arbitrary commands via shell metacharacters in the app parameter to… |
CVE-2017-2324 | Medium | 5.3 | 2017-04-24 | A command injection vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a network-based maliciou… |
CVE-2016-1555 | Critical | 9.8 | 2017-04-21 | (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP2… |
CVE-2017-7722 | Critical | 10.0 | 2017-04-12 | In SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4, a menu system is encountered when the SSH service is accessed with "cmc" and "password" (the def… |
CVE-2017-7689 | Critical | 9.8 | 2017-04-11 | A Command Injection vulnerability in Schneider Electric homeLYnk Controller exists in all versions before 1.5.0. |
CVE-2016-4989 | High | 7.0 | 2017-04-11 | setroubleshoot allows local users to bypass an intended container protection mechanism and execute arbitrary commands by (1) triggering an SELinux denial with… |
CVE-2016-4446 | High | 7.0 | 2017-04-11 | The allow_execstack plugin for setroubleshoot allows local users to execute arbitrary commands by triggering an execstack SELinux denial with a crafted filenam… |
CVE-2016-4445 | High | 7.0 | 2017-04-11 | The fix_lookup_id function in sealert in setroubleshoot before 3.2.23 allows local users to execute arbitrary commands as root by triggering an SELinux denial… |
CVE-2016-4444 | High | 7.0 | 2017-04-11 | The allow_execmod plugin for setroubleshoot before 3.2.23 allows local users to execute arbitrary commands by triggering an execmod SELinux denial with a craft… |
CVE-2016-10322 | High | 8.8 | 2017-04-10 | Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HT… |
CVE-2016-6534 | High | 7.5 | 2017-04-10 | Opmantek NMIS before 4.3.7c has command injection via man, finger, ping, trace, and nslookup in the tools.pl CGI script. Versions before 8.5.12G might be affec… |
CVE-2016-5067 | High | 8.8 | 2017-04-10 | Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Hayes AT command injection. |
CVE-2016-5065 | Critical | 9.8 | 2017-04-10 | Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Embedded_Ace_Set_Task.cgi command injection. |
CVE-2016-10312 | Critical | 9.8 | 2017-04-03 | Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4)… |
CVE-2016-8801 | High | 7.2 | 2017-04-02 | Huawei OceanStor 5600 V3 with V300R003C00C10 and earlier versions allows attackers with administrator privilege to inject a command into a specific command's p… |
CVE-2014-9114 | High | 7.8 | 2017-03-31 | Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code. |
CVE-2014-5009 | Critical | 9.8 | 2017-03-31 | Snoopy allows remote attackers to execute arbitrary commands. NOTE: this vulnerability exists due to an incomplete fix for CVE-2014-5008. |
CVE-2014-5008 | Critical | 9.8 | 2017-03-31 | Snoopy allows remote attackers to execute arbitrary commands. |
CVE-2008-7313 | Critical | 9.8 | 2017-03-31 | The _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands. NOTE: this issue exists dues to an incomplete fix for CVE-2008-479… |
CVE-2017-6184 | Medium | 4.7 | 2017-03-30 | In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injectio… |
CVE-2017-6183 | High | 7.2 | 2017-03-30 | In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's configuration utilities for adding (and detecting) Active Directory servers was vulner… |
CVE-2016-4929 | High | 8.8 | 2017-03-20 | Command injection vulnerability in Junos Space before 15.2R2 allows attackers to execute arbitrary code as a root user. |