CWE-78 · OS Command Injection (page 26)
Page 26 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-48636 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:0/VID parameter in the SetVLAN… |
CVE-2024-48635 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:2/VID parameter in the SetVLAN… |
CVE-2024-48634 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the key parameter in the SetWLanRadioSecu… |
CVE-2024-48633 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the ExternalPort, InternalPort… |
CVE-2024-48632 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the LocalIPAddress, TCPPorts, an… |
CVE-2024-48631 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SSID parameter in the SetWLanRadioSet… |
CVE-2024-48630 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the MacAddress parameter in the SetMACFil… |
CVE-2024-48629 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the IPAddress parameter in the SetGuestZo… |
CVE-2024-6333 | High | 7.2 | 2024-10-17 | Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products. |
CVE-2005-10003 | Medium | 5.6 | 2024-10-17 | A vulnerability classified as critical has been found in mikexstudios Xcomic up to 0.8.2. This affects an unknown part. The manipulation of the argument cmd le… |
CVE-2024-20461 | Medium | 6.0 | 2024-10-16 | A vulnerability in the CLI of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an authenticated, local attacker with high privileges to… |
CVE-2024-20459 | Medium | 6.5 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Multiplatform Series Analog Telephone Adapter firmware could allow an authenticated, rem… |
CVE-2024-20458 | High | 8.2 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker… |
CVE-2024-22033 | Medium | 6.3 | 2024-10-16 | The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that al… |
CVE-2024-9977 | Medium | 4.7 | 2024-10-15 | A vulnerability, which was classified as critical, was found in MitraStar GPT-2541GNAC BR_g5.6_1.11(WVK.0)b26. Affected is an unknown function of the file /cgi… |
CVE-2024-35519 | High | 8.4 | 2024-10-14 | Netgear EX6120 v1.0.0.68, Netgear EX6100 v1.0.2.28, and Netgear EX3700 v1.0.0.96 are vulnerable to command injection in operating_mode.cgi via the ap_mode para… |
CVE-2024-9139 | High | 7.2 | 2024-10-14 | The affected product permits OS command injection through improperly restricted commands, potentially allowing attackers to execute arbitrary code. |
CVE-2024-9916 | High | 7.3 | 2024-10-13 | A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/mo… |
CVE-2024-8755 | High | 8.4 | 2024-10-11 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.This issue affects: Product Affe… |
CVE-2024-9793 | Medium | 6.3 | 2024-10-10 | A vulnerability classified as critical was found in Tenda AC1206 up to 15.03.06.23. This vulnerability affects the function ate_iwpriv_set/ate_ifconfig_set of… |
CVE-2024-9464 | Medium | 6.5 | 2024-10-09 | An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, res… |
CVE-2024-9463 | High | 7.5 | 2024-10-09 | An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, r… |
CVE-2024-46316 | High | 8.0 | 2024-10-09 | DrayTek Vigor3900 v1.5.1.6 was discovered to contain a command injection vulnerability via the sub_2C920 function at /cgi-bin/mainfunction.cgi. This vulnerabil… |
CVE-2024-45720 | High | 8.2 | 2024-10-09 | On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables (e.g., svn.exe, etc.) may lead to unexpe… |
CVE-2024-9380 | High | 7.2 | 2024-10-08 | An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges… |
CVE-2024-45880 | High | 8.0 | 2024-10-08 | A command injection vulnerability exists in Motorola CX2L router v1.0.2 and below. The vulnerability is present in the SetStationSettings function. The system… |
CVE-2024-21532 | High | 7.3 | 2024-10-08 | All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the branch to be fetched… |
CVE-2024-8926 | High | 8.1 | 2024-10-08 | In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes… |
CVE-2024-45252 | Critical | 9.8 | 2024-10-06 | Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
CVE-2024-45251 | Critical | 9.8 | 2024-10-06 | Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
CVE-2024-9054 | High | 8.8 | 2024-10-04 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Exposure of Sensitive Information to an Unauthorized Actor vulnerab… |
CVE-2024-46486 | High | 8.0 | 2024-10-04 | TP-LINK TL-WDR5620 v2.3 was discovered to contain a remote code execution (RCE) vulnerability via the httpProcDataSrv function. |
CVE-2024-46658 | High | 8.0 | 2024-10-03 | Syrotech SY-GOPON-8OLT-L3 v1.6.0_240629 was discovered to contain an authenticated command injection vulnerability. |
CVE-2024-41585 | Medium | 6.8 | 2024-10-03 | DrayTek Vigor3910 devices through 4.3.2.6 are affected by an OS command injection vulnerability that allows an attacker to leverage the recvCmd binary to escap… |
CVE-2024-45519 | Critical | 10.0 | 2024-10-02 | The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allow… |
CVE-2024-9441 | Critical | 9.8 | 2024-10-02 | The Linear eMerge e3-Series through version 1.00-07 is vulnerable to an OS command injection vulnerability. A remote and unauthenticated attacker can execute a… |
CVE-2024-47608 | Critical | 9.8 | 2024-10-01 | Logicytics is designed to harvest and collect data for forensic analysis. Logicytics has a basic vuln affecting compromised devices from shell injections. This… |
CVE-2024-21531 | Medium | 5.3 | 2024-10-01 | All versions of the package git-shallow-clone are vulnerable to Command injection due to missing sanitization or mitigation flags in the process variable of th… |
CVE-2024-23961 | Medium | 6.8 | 2024-09-28 | Alpine Halo9 UPDM_wemCmdUpdFSpeDecomp Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute… |
CVE-2024-23924 | Medium | 6.8 | 2024-09-28 | Alpine Halo9 UPDM_wemCmdCreatSHA256Hash Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execut… |
CVE-2024-33368 | High | 8.8 | 2024-09-27 | An issue in Plasmoapp RPShare Fabric mod v.1.0.0 allows a remote attacker to execute arbitrary code via the build method in DonwloadPromptScreen |
CVE-2024-46628 | Critical | 9.8 | 2024-09-26 | Tenda G3 Router firmware v15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the usbPartitionName parameter in the formSetUS… |
CVE-2024-9166 | | 2024-09-26 | The device enables an unauthorized attacker to execute system commands with elevated privileges. This exploit is facilitated through the use of the 'getcommand… | |
CVE-2024-46330 | High | 7.4 | 2024-09-26 | VONETS VAP11G-300 v3.3.23.6.9 was discovered to contain a command injection vulnerability via the iptablesWebsFilterRun object. |
CVE-2024-46329 | High | 8.0 | 2024-09-26 | VONETS VAP11G-300 v3.3.23.6.9 was discovered to contain a command injection vulnerability via the SystemCommand object. |
CVE-2024-44678 | High | 8.0 | 2024-09-25 | Gigastone TR1 Travel Router R101 v1.0.2 is vulnerable to Command Injection. This allows an authenticated attacker to execute arbitrary commands on the device b… |
CVE-2024-9076 | Medium | 4.7 | 2024-09-22 | A vulnerability was found in DedeCMS up to 5.7.115. It has been rated as critical. This issue affects some unknown processing of the file /dede/article_string_… |
CVE-2024-9004 | Medium | 6.3 | 2024-09-19 | A vulnerability classified as critical has been found in D-Link DAR-7000 up to 20240912. Affected is an unknown function of the file /view/DBManage/Backup_Serv… |
CVE-2024-9001 | Medium | 6.3 | 2024-09-19 | A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. This vulnerability affects the function setTracerouteCfg of the file… |
CVE-2023-47105 | High | 8.6 | 2024-09-18 | exec.CommandContext in Chaosblade 0.3 through 1.7.3, when server mode is used, allows OS command execution via the cmd parameter without authentication. |
CVE-2024-43778 | High | 8.8 | 2024-09-18 | OS command injection vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to exe… |
CVE-2024-8957 | High | 7.2 | 2024-09-17 | PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr config… |
CVE-2024-45798 | Critical | 9.9 | 2024-09-17 | arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. The `arduino-esp32` CI is vulnerable to m… |
CVE-2024-45682 | High | 8.8 | 2024-09-17 | There is a command injection vulnerability that may allow an attacker to inject malicious input on the device's operating system. |
CVE-2024-42503 | High | 7.2 | 2024-09-17 | Authenticated command execution vulnerability exist in the ArubaOS command line interface (CLI). Successful exploitation of this vulnerabilities result in the… |
CVE-2024-42502 | High | 7.2 | 2024-09-17 | Authenticated command injection vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability result in the ability… |
CVE-2024-45698 | Critical | 9.8 | 2024-09-16 | Certain models of D-Link wireless routers do not properly validate user input in the telnet service, allowing unauthenticated remote attackers to use hard-code… |
CVE-2024-8869 | Medium | 5.0 | 2024-09-15 | A vulnerability classified as critical has been found in TOTOLINK A720R 4.1.5. Affected is the function exportOvpn. The manipulation leads to os command inject… |
CVE-2024-8281 | High | 7.2 | 2024-09-13 | An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection throu… |
CVE-2024-8280 | High | 7.2 | 2024-09-13 | An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection or ca… |
CVE-2024-8279 | High | 7.2 | 2024-09-13 | A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injecti… |
CVE-2024-8278 | High | 7.2 | 2024-09-13 | A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injecti… |
CVE-2024-8686 | High | 7.2 | 2024-09-11 | A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary… |
CVE-2024-20483 | High | 7.2 | 2024-09-11 | Multiple vulnerabilities in Cisco Routed PON Controller Software, which runs as a docker container on hardware that is supported by Cisco IOS XR Software, coul… |
CVE-2024-20398 | High | 8.8 | 2024-09-11 | A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to obtain read/write file system access on the underlying oper… |
CVE-2024-6091 | Critical | 9.8 | 2024-09-11 | A vulnerability in significant-gravitas/autogpt version 0.5.1 allows an attacker to bypass the shell commands denylist settings. The issue arises when the deny… |
CVE-2024-8190 | High | 7.2 | 2024-09-10 | An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain rem… |
CVE-2024-8504 | High | 8.8 | 2024-09-10 | An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. This attack can be chained with CVE-20… |
CVE-2024-7699 | High | 8.8 | 2024-09-10 | An low privileged remote attacker can execute OS commands with root privileges due to improper neutralization of special elements in user data. |
CVE-2024-43387 | High | 8.8 | 2024-09-10 | A low privileged remote attacker can read and write files as root due to improper neutralization of special elements in the variable EMAIL_RELAY_PASSWORD in mG… |
CVE-2024-43386 | High | 8.8 | 2024-09-10 | A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable… |
CVE-2024-43385 | High | 8.8 | 2024-09-10 | A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable… |
CVE-2024-44072 | Medium | 5.7 | 2024-09-10 | OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a spec… |
CVE-2024-6342 | Critical | 9.8 | 2024-09-10 | **UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542… |
CVE-2024-44333 | High | 8.8 | 2024-09-09 | D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400G+V2 v24.04.18D1 ar… |
CVE-2024-8574 | Medium | 6.3 | 2024-09-08 | A vulnerability has been found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220 and classified as critical. This vulnerability affects the function setParentalRules… |
CVE-2024-44845 | High | 8.8 | 2024-09-06 | DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the value parameter in the filter_string function. |
CVE-2024-44844 | High | 8.8 | 2024-09-06 | DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the name parameter in the run_command function. |
CVE-2024-38641 | High | 7.8 | 2024-09-06 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local net… |
CVE-2024-21906 | Medium | 4.7 | 2024-09-06 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2024-21903 | Medium | 6.6 | 2024-09-06 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2024-21898 | High | 8.8 | 2024-09-06 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2023-47563 | High | 7.4 | 2024-09-06 | An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to execute com… |
CVE-2023-39300 | High | 7.2 | 2024-09-06 | An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execu… |
CVE-2023-34979 | Medium | 6.6 | 2024-09-06 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2023-34974 | High | 8.8 | 2024-09-06 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2024-8517 | Critical | 9.8 | 2024-09-06 | SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating syste… |
CVE-2024-7591 | Critical | 10.0 | 2024-09-05 | Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection.This issue affects: * LoadMaster: 7.2.40.0 and above * ECS: All ve… |
CVE-2024-20469 | Medium | 6.0 | 2024-09-04 | A vulnerability in specific CLI commands in Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to perform command injection atta… |
CVE-2024-43405 | High | 7.4 | 2024-09-04 | Nuclei is a vulnerability scanner powered by YAML based templates. Starting in version 3.0.0 and prior to version 3.3.2, a vulnerability in Nuclei's template s… |
CVE-2024-43402 | High | 8.1 | 2024-09-04 | Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, w… |
CVE-2024-7261 | Critical | 9.8 | 2024-09-03 | The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC5… |
CVE-2024-7203 | High | 7.2 | 2024-09-03 | A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.60 through V5.38 and USG FLEX series firmware versions from… |
CVE-2024-42060 | High | 7.2 | 2024-09-03 | A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4… |
CVE-2024-42059 | High | 7.2 | 2024-09-03 | A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V5.00 through V5.38, USG FLEX series firmware versions from V5… |
CVE-2024-42057 | High | 8.1 | 2024-09-03 | A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions fr… |
CVE-2024-8234 | High | 7.5 | 2024-08-30 | ** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the functions formSysCmd(), formUpgradeCert(), and formDelcert() in the Zyxel NWA1100-N fi… |
CVE-2024-43804 | High | 8.8 | 2024-08-29 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any authenticated user on t… |
CVE-2024-20289 | Medium | 4.4 | 2024-08-28 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to execute arbitrary commands on the underlying… |
CVE-2024-8214 | Medium | 6.3 | 2024-08-27 | A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-… |