CWE-78 · OS Command Injection (page 24)
Page 24 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-9140 | Critical | 9.8 | 2025-01-03 | Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140. This vulnerability allows OS… |
CVE-2024-56137 | Medium | 6.8 | 2025-01-02 | MaxKB, which stands for Max Knowledge Base, is an open source knowledge base question-answering system based on a large language model and retrieval-augmented… |
CVE-2024-12828 | High | 8.8 | 2024-12-30 | Webmin CGI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installation… |
CVE-2024-54181 | High | 7.2 | 2024-12-30 | IBM WebSphere Automation 1.7.5 could allow a remote privileged user, who has authorized access to the swagger UI, to execute arbitrary code. Using specially cr… |
CVE-2024-47919 | Critical | 9.8 | 2024-12-30 | Tiki Wiki CMS – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
CVE-2024-47918 | Medium | 6.1 | 2024-12-30 | Tiki Wiki CMS – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) |
CVE-2024-12987 | High | 7.3 | 2024-12-27 | A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/m… |
CVE-2024-12986 | High | 7.3 | 2024-12-27 | A vulnerability, which was classified as critical, has been found in DrayTek Vigor2960 and Vigor300B 1.5.1.3/1.5.1.4. This issue affects some unknown processin… |
CVE-2024-12856 | High | 7.2 | 2024-12-27 | The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. At least firmware version 2.0 allows aut… |
CVE-2024-12985 | Medium | 6.3 | 2024-12-27 | A vulnerability classified as critical was found in Overtek OT-E801G OTE801G65.1.1.0. This vulnerability affects unknown code of the file /diag_ping.cmd?action… |
CVE-2024-53256 | High | 7.8 | 2024-12-23 | Rizin is a UNIX-like reverse engineering framework and command-line toolset. `rizin.c` still had an old snippet of code which suffered a command injection due… |
CVE-2024-54082 | High | 7.2 | 2024-12-23 | home 5G HR02 and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the configuration restore function. An arbitrary OS command may be execu… |
CVE-2024-45721 | High | 7.2 | 2024-12-23 | home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the HOST name configuration screen. An arbitrary… |
CVE-2020-13712 | High | 7.8 | 2024-12-20 | A command injection is possible through the user interface, allowing arbitrary command execution as the root user. oMG2000 running MGOS 3.15.1 or earlier is a… |
CVE-2024-28767 | Medium | 6.8 | 2024-12-20 | IBM Security Directory Integrator 7.2.0 through 7.2.0.13 and 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on… |
CVE-2024-12829 | High | 8.8 | 2024-12-20 | Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2021-26115 | High | 7.8 | 2024-12-19 | An OS command injection (CWE-78) vulnerability in FortiWAN version 4.5.7 and below Command Line Interface may allow a local, authenticated and unprivileged att… |
CVE-2023-23356 | Medium | 5.5 | 2024-12-19 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attack… |
CVE-2024-12686 | Medium | 6.6 | 2024-12-18 | A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileg… |
CVE-2024-48889 | High | 7.2 | 2024-12-18 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiManager version 7.6.0, version 7.4… |
CVE-2024-53688 | High | 7.2 | 2024-12-18 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in AE1021 firmware versions 2.0.10 and earlier and AE10… |
CVE-2024-31668 | Critical | 9.1 | 2024-12-17 | rizin before v0.6.3 is vulnerable to Improper Neutralization of Special Elements via meta_set function in librz/analysis/meta. |
CVE-2024-53376 | High | 8.8 | 2024-12-16 | CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field to the websites/subm… |
CVE-2024-11858 | High | 8.6 | 2024-12-15 | A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation when handling Pebble Application files. M… |
CVE-2024-48008 | Medium | 5.3 | 2024-12-13 | Dell RecoverPoint for Virtual Machines 6.0.x contains a OS Command Injection vulnerability. An Low privileged remote attacker could potentially exploit this vu… |
CVE-2024-22461 | High | 8.8 | 2024-12-13 | Dell RecoverPoint for Virtual Machines 6.0.x contains an OS Command injection vulnerability. A low privileged remote attacker could potentially exploit this vu… |
CVE-2024-52058 | High | 7.8 | 2024-12-13 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in RTI Connext Professional (System Designer) allows O… |
CVE-2024-54008 | High | 7.2 | 2024-12-10 | An authenticated Remote Code Execution (RCE) vulnerability exists in the AirWave CLI. Successful exploitation of this vulnerability could allow a remote authen… |
CVE-2024-28138 | High | 7.3 | 2024-12-10 | An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msg_events.php" script as the ww… |
CVE-2024-12358 | Medium | 6.3 | 2024-12-09 | A vulnerability was found in WeiYe-Jing datax-web 2.1.1. It has been classified as critical. This affects an unknown part of the file /api/job/add/. The manipu… |
CVE-2024-47115 | High | 7.8 | 2024-12-07 | IBM AIX 7.2, 7.3 and VIOS 3.1 and 4.1 could allow a local user to execute arbitrary commands on the system due to improper neutralization of input. |
CVE-2024-52320 | Critical | 9.8 | 2024-12-06 | The affected product is vulnerable to a command injection. An unauthenticated attacker could send commands through a malicious HTTP request which could result… |
CVE-2024-50393 | Critical | 9.8 | 2024-12-06 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attack… |
CVE-2024-50388 | Critical | 9.8 | 2024-12-06 | An OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to exe… |
CVE-2024-48863 | Critical | 9.8 | 2024-12-06 | A command injection vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers to execute arbitrary… |
CVE-2024-47133 | High | 7.2 | 2024-12-05 | UD-LT1 firmware Ver.2.1.9 and earlier and UD-LT1/EX firmware Ver.2.1.9 and earlier allow a remote authenticated attacker with an administrative account to exec… |
CVE-2024-51465 | High | 8.8 | 2024-12-04 | IBM App Connect Enterprise Certified Container 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, and 12.3 could allow a remote authenticated attacker to execute arbitrary co… |
CVE-2024-9200 | High | 7.2 | 2024-12-03 | A post-authentication command injection vulnerability in the "host" parameter of the diagnostic function in Zyxel VMG4005-B50A firmware versions through V5.15(… |
CVE-2024-53940 | High | 8.8 | 2024-12-02 | An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. Certain /cgi-bin/luci/admin endpoints are vulner… |
CVE-2024-53939 | High | 8.8 | 2024-12-02 | An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. The /cgi-bin/luci/admin/opsw/Dual_freq_un_apple… |
CVE-2024-53375 | High | 8.0 | 2024-12-02 | An Authenticated Remote Code Execution (RCE) vulnerability affects the TP-Link Archer router series. A vulnerability exists in the "tmp_get_sites" function of… |
CVE-2024-53992 | | 2024-12-02 | unzip-bot is a Telegram bot to extract various types of archives. Users could exploit unsanitized inputs to inject malicious commands that are executed through… | |
CVE-2024-49803 | Critical | 9.8 | 2024-11-29 | IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a… |
CVE-2024-11983 | High | 7.2 | 2024-11-29 | Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject ar… |
CVE-2024-11482 | Critical | 9.8 | 2024-11-29 | A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, execu… |
CVE-2024-10896 | Medium | 5.4 | 2024-11-28 | The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo and Slider settings, which could allow high privilege users such a… |
CVE-2024-51228 | Medium | 6.8 | 2024-11-27 | An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1420 and TOTOLINK-CX… |
CVE-2024-31976 | High | 8.0 | 2024-11-27 | EnGenius EWS356-FIR 1.1.30 and earlier devices allow a remote attacker to execute arbitrary OS commands via the Controller connectivity parameter. |
CVE-2024-9461 | High | 7.2 | 2024-11-26 | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to… |
CVE-2024-50377 | Medium | 6.5 | 2024-11-26 | A CWE-798 "Use of Hard-coded Credentials" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<… |
CVE-2024-50376 | High | 7.3 | 2024-11-26 | A CWE-79 "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" was discovered affecting the following devices manufactured by… |
CVE-2024-50375 | Critical | 9.8 | 2024-11-26 | A CWE-306 "Missing Authentication for Critical Function" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EK… |
CVE-2024-50374 | Critical | 9.8 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50373 | Critical | 9.8 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50372 | Critical | 9.8 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50371 | Critical | 9.8 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50370 | Critical | 9.8 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50369 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50368 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50367 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50366 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50365 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50364 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50363 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50362 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50361 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50360 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50359 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-53899 | High | 7.8 | 2024-11-24 | virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly wh… |
CVE-2024-52034 | Critical | 10.0 | 2024-11-22 | An OS Command Injection vulnerability exists within myPRO Manager. A parameter within a command can be exploited by an unauthenticated remote attacker to injec… |
CVE-2024-47407 | Critical | 10.0 | 2024-11-22 | A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arb… |
CVE-2024-8360 | Medium | 6.8 | 2024-11-22 | Visteon Infotainment REFLASH_DDU_ExtractFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to e… |
CVE-2024-8359 | Medium | 6.8 | 2024-11-22 | Visteon Infotainment REFLASH_DDU_FindFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to exec… |
CVE-2024-8358 | Medium | 6.8 | 2024-11-22 | Visteon Infotainment UPDATES_ExtractFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execu… |
CVE-2024-8809 | High | 8.8 | 2024-11-22 | Cohesive Networks VNS3 Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-8808 | High | 8.8 | 2024-11-22 | Cohesive Networks VNS3 Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-8807 | Critical | 9.8 | 2024-11-22 | Cohesive Networks VNS3 Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-8806 | Critical | 9.8 | 2024-11-22 | Cohesive Networks VNS3 Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-6247 | Medium | 6.8 | 2024-11-22 | Wyze Cam v3 Wi-Fi SSID OS Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary co… |
CVE-2024-5720 | High | 8.8 | 2024-11-22 | Logsign Unified SecOps Platform Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2024-5719 | High | 8.8 | 2024-11-22 | Logsign Unified SecOps Platform Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2024-5717 | High | 8.8 | 2024-11-22 | Logsign Unified SecOps Platform Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2024-52723 | Critical | 9.8 | 2024-11-22 | In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering. An attacker can achieve arb… |
CVE-2024-48861 | High | 7.8 | 2024-11-22 | An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local network attackers… |
CVE-2024-48860 | Critical | 9.8 | 2024-11-22 | An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow remote attackers to exe… |
CVE-2024-38644 | High | 8.8 | 2024-11-22 | An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticated attackers t… |
CVE-2023-24467 | High | 8.8 | 2024-11-22 | Possible Command Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0000. |
CVE-2024-31408 | High | 8.0 | 2024-11-22 | OS command injection vulnerability exists in AIPHONE IX SYSTEM and IXG SYSTEM. A network-adjacent authenticated attacker may execute an arbitrary OS command wi… |
CVE-2024-52803 | High | 7.5 | 2024-11-21 | LLama Factory enables fine-tuning of large language models. A critical remote OS command injection vulnerability has been identified in the LLama Factory train… |
CVE-2024-29224 | Critical | 9.8 | 2024-11-21 | An OS command injection vulnerability exists in the NAT parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command execution. An… |
CVE-2024-28892 | Critical | 9.8 | 2024-11-21 | An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command execution. A… |
CVE-2024-28027 | High | 7.2 | 2024-11-21 | Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially craft… |
CVE-2024-28026 | High | 7.2 | 2024-11-21 | Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially craft… |
CVE-2024-28025 | High | 7.2 | 2024-11-21 | Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially craft… |
CVE-2024-21786 | High | 7.2 | 2024-11-21 | An OS command injection vulnerability exists in the web interface configuration upload functionality of MC Technologies MC LR Router 2.10.5. A specially crafte… |
CVE-2024-7517 | High | 7.8 | 2024-11-21 | A command injection vulnerability in Brocade Fabric OS before 9.2.0c, and 9.2.1 through 9.2.1a on IP extension platforms could allow a local authenticated atta… |
CVE-2024-51151 | Critical | 9.8 | 2024-11-21 | D-Link DI-8200 16.07.26A1 is vulnerable to remote command execution in the msp_info_htm function via the flag parameter and cmd parameter. |
CVE-2024-48895 | High | 8.8 | 2024-11-20 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Rakuten Turbo 5G firmware version V1.3.18 and earlie… |
CVE-2024-51503 | High | 8.0 | 2024-11-19 | A security agent manual scan command injection vulnerability in the Trend Micro Deep Security 20 Agent could allow an attacker to escalate privileges and execu… |
CVE-2024-11003 | High | 7.8 | 2024-11-19 | Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a l… |