CWE-78 · OS Command Injection (page 28)
Page 28 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-3799 | | 2024-07-10 | Insecure handling of POST header parameter body included in requests being sent to an instance of the open-source project Phoniebox allows an attacker to creat… | |
CVE-2024-3798 | | 2024-07-10 | Insecure handling of GET header parameter file included in requests being sent to an instance of the open-source project Phoniebox allows an attacker to create… | |
CVE-2024-28750 | High | 7.2 | 2024-07-09 | A remote attacker with high privileges may use a deleting file function to inject OS commands. |
CVE-2024-28749 | High | 7.2 | 2024-07-09 | A remote attacker with high privileges may use a writing file function to inject OS commands. |
CVE-2024-28748 | High | 7.2 | 2024-07-09 | A remote attacker with high privileges may use a reading file function to inject OS commands. |
CVE-2024-39202 | High | 8.8 | 2024-07-08 | D-Link DIR-823X firmware - 240126 was discovered to contain a remote command execution (RCE) vulnerability via the dhcpd_startip parameter at /goform/set_lan_s… |
CVE-2023-50383 | High | 7.2 | 2024-07-08 | Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP req… |
CVE-2023-50382 | High | 7.2 | 2024-07-08 | Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP req… |
CVE-2023-50381 | High | 7.2 | 2024-07-08 | Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP req… |
CVE-2024-39943 | Critical | 9.9 | 2024-07-04 | rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload pe… |
CVE-2024-39935 | High | 8.8 | 2024-07-04 | jc21 NGINX Proxy Manager before 2.11.3 allows backend/internal/certificate.js OS command injection by an authenticated user (with certificate management privil… |
CVE-2024-6507 | High | 8.1 | 2024-07-04 | Command injection when ingesting a remote Kaggle dataset due to a lack of input sanitization in the ingest_kaggle() API |
CVE-2024-38471 | Medium | 6.8 | 2024-07-04 | Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by restoring a crafted backup fil… |
CVE-2024-32937 | High | 8.1 | 2024-07-03 | An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1.0.11.79. A special… |
CVE-2024-5672 | High | 7.2 | 2024-07-03 | A high privileged remote attacker can execute arbitrary system commands via GET requests due to improper neutralization of special elements used in an OS comma… |
CVE-2024-20399 | Medium | 6.0 | 2024-07-01 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary commands a… |
CVE-2024-39351 | High | 7.2 | 2024-06-28 | A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the NTP configuration. This al… |
CVE-2023-47802 | High | 7.2 | 2024-06-28 | A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the IP block functionality. Th… |
CVE-2024-37140 | High | 8.8 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection vulnerability in an admin operation. A r… |
CVE-2024-5181 | Critical | 9.8 | 2024-06-26 | A command injection vulnerability exists in the mudler/localai version 2.14.0. The vulnerability arises from the application's handling of the backend paramete… |
CVE-2024-4884 | Critical | 9.8 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The Apm.UI.Areas.APM.Contro… |
CVE-2024-4883 | Critical | 9.8 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This vulnerability allows an unauthenticated… |
CVE-2024-37678 | Medium | 5.3 | 2024-06-24 | Cross Site Scripting vulnerability in Hangzhou Meisoft Information Technology Co., Ltd. Finesoft v.8.0 and before allows a remote attacker to execute arbitrary… |
CVE-2024-4748 | High | 8.8 | 2024-06-24 | The CRUDDIY project is vulnerable to shell command injection via sending a crafted POST request to the application server. The exploitation risk is limited si… |
CVE-2024-37091 | Critical | 9.9 | 2024-06-24 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in StylemixThemes Consulting Elementor Widgets, StylemixTheme… |
CVE-2024-3121 | Low | 3.3 | 2024-06-24 | A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from t… |
CVE-2024-37626 | High | 8.8 | 2024-06-20 | A command injection issue in TOTOLINK A6000R V1.0.1-B20201211.2000 firmware allows a remote attacker to execute arbitrary code via the iface parameter in the v… |
CVE-2024-6187 | Medium | 6.3 | 2024-06-20 | A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. This vulnerability affects unknown code of the file /view/vpn/autovpn/sub_commi… |
CVE-2024-6186 | Medium | 6.3 | 2024-06-20 | A vulnerability, which was classified as critical, was found in Ruijie RG-UAC 1.0. This affects an unknown part of the file /view/userAuthentication/SSO/commit… |
CVE-2024-6185 | Medium | 6.3 | 2024-06-20 | A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC 1.0. Affected by this issue is the function get_ip_addr_details of the file… |
CVE-2024-6184 | Medium | 6.3 | 2024-06-20 | A vulnerability classified as critical was found in Ruijie RG-UAC 1.0. Affected by this vulnerability is an unknown functionality of the file /view/systemConfi… |
CVE-2024-6048 | Critical | 9.8 | 2024-06-17 | Openfind's MailGates and MailAudit fail to properly filter user input when analyzing email attachments. An unauthenticated remote attacker can exploit this vul… |
CVE-2024-6047 | Critical | 9.8 | 2024-06-17 | Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerabilit… |
CVE-2024-31162 | High | 7.2 | 2024-06-14 | The specific function parameter of ASUS Download Master does not properly filter user input. An unauthenticated remote attacker with administrative privileges… |
CVE-2024-27172 | Critical | 9.8 | 2024-06-14 | Remote Command program allows an attacker to get Remote Code Execution. As for the affected products/models/versions, see the reference URL. |
CVE-2024-4696 | High | 7.5 | 2024-06-13 | A privilege escalation vulnerability was reported in Lenovo Service Bridge prior to version 5.0.2.17 that could allow operating system commands to be executed… |
CVE-2024-36103 | Medium | 6.8 | 2024-06-12 | OS command injection vulnerability in WRC-X5400GS-B v1.0.10 and earlier, and WRC-X5400GSA-B v1.0.10 and earlier allows a network-adjacent attacker with an admi… |
CVE-2024-36360 | Critical | 9.8 | 2024-06-11 | OS command injection vulnerability exists in awkblog v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier. If a remote unauthenticated att… |
CVE-2024-35306 | Critical | 9.8 | 2024-06-10 | OS Command injection in Ajax PHP files via HTTP Request, allows to execute system commands by exploiting variables. This issue affects Pandora FMS: from 700 th… |
CVE-2024-35304 | Critical | 9.8 | 2024-06-10 | System command injection through Netflow function due to improper input validation, allowing attackers to execute arbitrary system commands. This issue affects… |
CVE-2024-5785 | High | 8.0 | 2024-06-10 | Command injection vulnerability in Comtrend router WLD71-T1_v2.0.201820, affecting the GRG-4280us version. This vulnerability could allow an authenticated user… |
CVE-2024-4577 | Critical | 9.8 | 2024-06-09 | In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain… |
CVE-2024-5585 | High | 7.7 | 2024-06-09 | In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spa… |
CVE-2024-2359 | Critical | 9.8 | 2024-06-06 | A vulnerability in the parisneo/lollms-webui version 9.3 allows attackers to bypass intended access restrictions and execute arbitrary code. The issue arises f… |
CVE-2024-1881 | Critical | 9.8 | 2024-06-06 | AutoGPT, a component of significant-gravitas/autogpt, is vulnerable to an improper neutralization of special elements used in an OS command ('OS Command Inject… |
CVE-2024-1880 | High | 7.8 | 2024-06-06 | An OS command injection vulnerability exists in the MacOS Text-To-Speech class MacOSTTS of the significant-gravitas/autogpt project, affecting versions up to v… |
CVE-2024-3104 | Critical | 9.8 | 2024-06-06 | A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables. Attackers can exploit this vulner… |
CVE-2024-30368 | High | 8.8 | 2024-06-06 | A10 Thunder ADC CsrRequestView Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2024-36394 | Critical | 9.1 | 2024-06-06 | SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
CVE-2024-5421 | | 2024-06-04 | Missing input validation and OS command integration of the input in the utnserver Pro, utnserver ProMAX, INU-100 web-interface allows authenticated command inj… | |
CVE-2024-4253 | Critical | 9.1 | 2024-06-04 | A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises… |
CVE-2024-29973 | Critical | 9.8 | 2024-06-04 | ** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and… |
CVE-2024-29972 | Critical | 9.8 | 2024-06-04 | ** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17… |
CVE-2024-32850 | Critical | 9.8 | 2024-05-31 | Improper neutralization of special elements used in a command ('Command Injection') exists in SkyBridge MB-A100/MB-A110 firmware Ver. 4.2.2 and earlier and Sky… |
CVE-2024-2421 | Critical | 9.8 | 2024-05-30 | LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and including 5.6.1, which allo… |
CVE-2024-5411 | High | 8.8 | 2024-05-28 | Missing input validation and OS command integration of the input in the ORing IAP-420 web-interface allows authenticated command injection.This issue affects I… |
CVE-2024-5403 | High | 7.2 | 2024-05-27 | ASKEY 5G NR Small Cell fails to properly filter user input for certain functionality, allowing remote attackers with administrator privilege to execute arbitra… |
CVE-2024-5400 | High | 8.8 | 2024-05-27 | Openfind Mail2000 does not properly filter parameters of specific CGI. Remote attackers with regular privileges can exploit this vulnerability to execute arbit… |
CVE-2024-5399 | High | 7.2 | 2024-05-27 | Openfind Mail2000 does not properly filter parameters of specific API. Remote attackers with administrative privileges can exploit this vulnerability to execut… |
CVE-2024-5340 | Medium | 4.7 | 2024-05-25 | A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been rated as critical. Affected by this issue is some unknown functionality of the file /vie… |
CVE-2024-5339 | Medium | 4.7 | 2024-05-25 | A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the… |
CVE-2024-5338 | Medium | 4.7 | 2024-05-25 | A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been classified as critical. Affected is an unknown function of the file /view/vpn/autovpn/on… |
CVE-2024-5337 | Medium | 4.7 | 2024-05-25 | A vulnerability was found in Ruijie RG-UAC up to 20240516 and classified as critical. This issue affects some unknown processing of the file /view/systemConfig… |
CVE-2024-5336 | Medium | 4.7 | 2024-05-25 | A vulnerability has been found in Ruijie RG-UAC up to 20240516 and classified as critical. This vulnerability affects the function addVlan of the file /view/ne… |
CVE-2024-5297 | High | 8.8 | 2024-05-23 | D-Link D-View executeWmicCmd Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on aff… |
CVE-2024-5295 | High | 8.8 | 2024-05-23 | D-Link G416 flupl self Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on… |
CVE-2024-5291 | High | 8.8 | 2024-05-23 | D-Link DIR-2150 GetDeviceSettings Target Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute… |
CVE-2024-5227 | High | 7.5 | 2024-05-23 | TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute ar… |
CVE-2024-31843 | Medium | 4.1 | 2024-05-23 | An issue was discovered in Italtel Embrace 1.6.4. The Web application does not properly check the parameters sent as input before they are processed on the ser… |
CVE-2024-5241 | Medium | 4.7 | 2024-05-23 | A vulnerability was found in Huashi Private Cloud CDN Live Streaming Acceleration Server up to 20240520. It has been classified as critical. Affected is an unk… |
CVE-2024-33529 | High | 7.2 | 2024-05-21 | ILIAS 7 before 7.30 and ILIAS 8 before 8.11 as well as ILIAS 9.0 allow remote authenticated attackers with administrative privileges to execute operating syste… |
CVE-2023-3939 | Critical | 10.0 | 2024-05-21 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in ZkTeco-based OEM devices allows OS Command Inject… |
CVE-2024-0401 | High | 7.2 | 2024-05-20 | ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary op… |
CVE-2024-20326 | High | 7.8 | 2024-05-16 | A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to rea… |
CVE-2024-30314 | High | 7.8 | 2024-05-16 | Dreamweaver Desktop versions 21.3 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vul… |
CVE-2024-3126 | High | 8.4 | 2024-05-16 | A command injection vulnerability exists in the 'run_xtts_api_server' function of the parisneo/lollms-webui application, specifically within the 'lollms_xtts.p… |
CVE-2024-4965 | Medium | 6.3 | 2024-05-16 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000-40 V31R02B1413C and classified as critical. This issue affects some unknown proces… |
CVE-2023-6321 | High | 7.2 | 2024-05-15 | A command injection vulnerability exists in the IOCTL that manages OTA updates. A specially crafted command can lead to command execution as the root user. An… |
CVE-2024-31482 | Medium | 5.3 | 2024-05-14 | An unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service accessed via the PAPI protocol. Successful exploitation of this… |
CVE-2024-31481 | Medium | 5.3 | 2024-05-14 | Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabiliti… |
CVE-2024-31480 | Medium | 5.3 | 2024-05-14 | Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabiliti… |
CVE-2024-31479 | Medium | 5.3 | 2024-05-14 | Unauthenticated Denial of Service (DoS) vulnerabilities exist in the Central Communications service accessed via the PAPI protocol. Successful exploitation of… |
CVE-2024-31478 | Medium | 5.3 | 2024-05-14 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exists in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these… |
CVE-2024-31477 | High | 7.2 | 2024-05-14 | Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ab… |
CVE-2024-31476 | High | 7.2 | 2024-05-14 | Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ab… |
CVE-2024-31473 | Critical | 9.8 | 2024-05-14 | There is a command injection vulnerability in the underlying deauthentication service that could lead to unauthenticated remote code execution by sending speci… |
CVE-2024-31472 | Critical | 9.8 | 2024-05-14 | There are command injection vulnerabilities in the underlying Soft AP Daemon service that could lead to unauthenticated remote code execution by sending specia… |
CVE-2024-31471 | Critical | 9.8 | 2024-05-14 | There is a command injection vulnerability in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending… |
CVE-2024-32351 | High | 8.8 | 2024-05-14 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mru" parameter in the… |
CVE-2024-1628 | High | 8.4 | 2024-05-14 | OS command injection vulnerabilities in GE HealthCare ultrasound devices |
CVE-2024-4816 | Medium | 6.3 | 2024-05-14 | A vulnerability, which was classified as critical, was found in Ruijie RG-UAC up to 20240506. This affects an unknown part of the file /view/networkConfig/GRE/… |
CVE-2024-4815 | Medium | 6.3 | 2024-05-14 | A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240506. Affected by this issue is some unknown functionality of the… |
CVE-2024-4814 | Medium | 6.3 | 2024-05-14 | A vulnerability classified as critical was found in Ruijie RG-UAC up to 20240506. Affected by this vulnerability is an unknown functionality of the file /view/… |
CVE-2024-4813 | Medium | 6.3 | 2024-05-14 | A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240506. Affected is an unknown function of the file /view/networkConfig/physical… |
CVE-2024-34921 | High | 8.8 | 2024-05-14 | TOTOLINK X5000R v9.1.0cu.2350_B20230313 was discovered to contain a command injection via the disconnectVPN function. |
CVE-2024-34210 | High | 7.3 | 2024-05-14 | TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the CloudACMunualUpdate function via the FileN… |
CVE-2024-34205 | High | 7.3 | 2024-05-14 | TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the download_firmware function. |
CVE-2024-2662 | High | 7.2 | 2024-05-14 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to command injection in all versions up to, and inclu… |
CVE-2023-47709 | Critical | 9.1 | 2024-05-14 | IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially… |
CVE-2022-43654 | High | 8.8 | 2024-05-07 | NETGEAR CAX30S SSO Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on aff… |