CWE-78 · OS Command Injection (page 30)
Page 30 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-39367 | Critical | 9.1 | 2024-04-17 | An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP req… |
CVE-2024-3880 | Medium | 6.3 | 2024-04-16 | A vulnerability has been found in Tenda W30E 1.0.1.25(633) and classified as critical. This vulnerability affects the function formWriteFacMac of the file /gof… |
CVE-2024-2659 | High | 7.2 | 2024-04-15 | A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute system command… |
CVE-2023-4856 | High | 8.8 | 2024-04-15 | A format string vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute arbitrary commands on a specific API endpoi… |
CVE-2023-4855 | High | 7.2 | 2024-04-15 | A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute unauthorized c… |
CVE-2024-3781 | Critical | 9.1 | 2024-04-15 | Command injection vulnerability in the operating system. Improper neutralisation of special elements in Active Directory integration allows the intended comman… |
CVE-2024-26023 | Medium | 4.2 | 2024-04-15 | OS command injection vulnerability in BUFFALO wireless LAN routers allows a logged-in user to execute arbitrary OS commands. |
CVE-2024-1655 | High | 8.8 | 2024-04-15 | Certain ASUS WiFi routers models has an OS Command Injection vulnerability, allowing an authenticated remote attacker to execute arbitrary system commands by s… |
CVE-2024-3739 | Medium | 6.3 | 2024-04-13 | A vulnerability classified as critical was found in cym1102 nginxWebUI up to 3.9.9. This vulnerability affects unknown code of the file /adminPage/main/upload… |
CVE-2024-3721 | Medium | 6.3 | 2024-04-13 | A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /devic… |
CVE-2024-2742 | Medium | 6.4 | 2024-04-11 | Operating system command injection vulnerability in Planet IGS-4215-16T2S, affecting firmware version 1.305b210528. An authenticated attacker could execute arb… |
CVE-2024-2029 | Critical | 9.8 | 2024-04-10 | A command injection vulnerability exists in the `TranscriptEndpoint` of mudler/localai, specifically within the `audioToWav` function used for converting audio… |
CVE-2024-1520 | Critical | 9.8 | 2024-04-10 | An OS Command Injection vulnerability exists in the '/open_code_folder' endpoint of the parisneo/lollms-webui application, due to improper validation of user-s… |
CVE-2024-2243 | High | 7.6 | 2024-04-10 | A vulnerability was found in csmock where a regular user of the OSH service (anyone with a valid Kerberos ticket) can use the vulnerability to disclose the con… |
CVE-2024-24576 | Critical | 10.0 | 2024-04-09 | Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not properly escape argum… |
CVE-2024-22423 | High | 8.3 | 2024-04-09 | yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using `--exec` with `%q`… |
CVE-2024-21756 | High | 8.8 | 2024-04-09 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiS… |
CVE-2024-21755 | High | 8.8 | 2024-04-09 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiS… |
CVE-2023-47540 | Medium | 6.7 | 2024-04-09 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, Forti… |
CVE-2023-6320 | Critical | 9.1 | 2024-04-09 | A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and 6. A series of spe… |
CVE-2023-6319 | Critical | 9.1 | 2024-04-09 | A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS version 4 through 7… |
CVE-2023-6318 | Critical | 9.1 | 2024-04-09 | A command injection vulnerability exists in the processAnalyticsReport method from the com.webos.service.cloudupload service on webOS version 5 through 7. A se… |
CVE-2023-1082 | High | 8.8 | 2024-04-09 | An remote attacker with low privileges can perform a command injection which can lead to root access. |
CVE-2024-30414 | High | 7.5 | 2024-04-07 | Command injection vulnerability in the AccountManager module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-3346 | Medium | 6.3 | 2024-04-05 | A vulnerability was found in Byzoro Smart S80 up to 20240328. It has been declared as critical. This vulnerability affects unknown code of the file /log/webmai… |
CVE-2023-3454 | High | 8.6 | 2024-04-04 | Remote code execution (RCE) vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow an attacker to execute arbitrary code and use this to g… |
CVE-2024-29167 | High | 7.2 | 2024-04-04 | SVR-116 firmware version 1.6.0.30028871 allows a remote authenticated attacker with an administrative privilege to execute arbitrary OS commands by sending a s… |
CVE-2024-26258 | High | 7.1 | 2024-04-04 | OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with credentials to execute arbitrary OS commands by sendi… |
CVE-2024-25568 | High | 8.8 | 2024-04-04 | OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent unauthenticated attacker to execute arbitrary OS commands by sendin… |
CVE-2024-1180 | High | 8.0 | 2024-04-03 | TP-Link Omada ER605 Access Control Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbit… |
CVE-2023-25699 | Critical | 9.0 | 2024-04-03 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in VideoWhisper.Com VideoWhisper Live Streaming Integr… |
CVE-2024-2389 | Critical | 10.0 | 2024-04-02 | In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. An unauthenticated user can gain ent… |
CVE-2023-51572 | Critical | 9.8 | 2024-04-01 | Voltronic Power ViewPower Pro getMacAddressByIp Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar… |
CVE-2024-29640 | Critical | 9.8 | 2024-03-29 | An issue in aliyundrive-webdav v.2.3.3 and before allows a remote attacker to execute arbitrary code via a crafted payload to the sid parameter in the action_q… |
CVE-2024-30645 | High | 8.0 | 2024-03-29 | Tenda AC15V1.0 V15.03.20_multi has a command injection vulnerability via the deviceName parameter. |
CVE-2024-30247 | Critical | 10.0 | 2024-03-29 | NextcloudPi is a ready to use image for Virtual Machines, Raspberry Pi, Odroid HC1, Rock64 and other boards. A command injection vulnerability in NextCloudPi a… |
CVE-2024-25955 | High | 7.2 | 2024-03-28 | Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could potentially exploit this vulnerability lea… |
CVE-2024-25946 | High | 7.2 | 2024-03-28 | Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could potentially exploit this vulnerability lea… |
CVE-2023-6437 | Critical | 9.8 | 2024-03-28 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TP-Link TP-Link EX20v AX1800, Tp-Link Archer C5v AC… |
CVE-2024-28015 | Critical | 9.8 | 2024-03-28 | Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3… |
CVE-2024-2910 | Medium | 6.3 | 2024-03-26 | A vulnerability, which was classified as critical, has been found in Ruijie RG-EG350 up to 20240318. Affected by this issue is the function vpnAction of the fi… |
CVE-2024-2909 | High | 8.8 | 2024-03-26 | A vulnerability classified as critical was found in Ruijie RG-EG350 up to 20240318. Affected by this vulnerability is the function setAction of the file /itbox… |
CVE-2024-27521 | High | 8.0 | 2024-03-26 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote command execution (RCE) vulnerability via multiple parameters in th… |
CVE-2024-2897 | Medium | 6.3 | 2024-03-26 | A vulnerability classified as critical has been found in Tenda AC7 15.03.06.44. Affected is the function formWriteFacMac of the file /goform/WriteFacMac. The m… |
CVE-2024-28048 | Critical | 9.8 | 2024-03-26 | OS command injection vulnerability exists in ffBull ver.4.11, which may allow a remote unauthenticated attacker to execute an arbitrary OS command with the pri… |
CVE-2024-28033 | High | 7.3 | 2024-03-26 | OS command injection vulnerability exists in WebProxy 1.7.8 and 1.7.9, which may allow a remote unauthenticated attacker to execute an arbitrary OS command wit… |
CVE-2024-29189 | High | 7.4 | 2024-03-26 | PyAnsys Geometry is a Python client library for the Ansys Geometry service and other CAD Ansys products. On file src/ansys/geometry/core/connection/product_ins… |
CVE-2024-25002 | High | 8.8 | 2024-03-25 | Command Injection in the diagnostics interface of the Bosch Network Synchronizer allows unauthorized users full access to the device. |
CVE-2024-24899 | High | 7.2 | 2024-03-25 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-zeus on Linux allows Command Injecti… |
CVE-2024-24892 | High | 8.1 | 2024-03-25 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Privilege Management vulnerability in openEuler migration-… |
CVE-2024-24890 | High | 7.8 | 2024-03-25 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler gala-gopher on Linux allows Command Injec… |
CVE-2024-2854 | Medium | 6.3 | 2024-03-24 | A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the function formSetSambaConf of the file /goform/setsambacfg. The… |
CVE-2024-2853 | Medium | 6.3 | 2024-03-24 | A vulnerability was found in Tenda AC10U 15.03.06.48/15.03.06.49. It has been rated as critical. This issue affects the function formSetSambaConf of the file /… |
CVE-2024-2851 | Medium | 6.3 | 2024-03-24 | A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi. It has been classified as critical. This affects the function formSetSambaConf of the file… |
CVE-2021-33633 | High | 7.3 | 2024-03-23 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-ceres on Linux allows Command Inject… |
CVE-2024-29185 | Critical | 9.0 | 2024-03-22 | FreeScout is a self-hosted help desk and shared mailbox. Versions prior to 1.8.128 are vulnerable to OS Command Injection in the /public/tools.php source file… |
CVE-2024-2448 | High | 8.4 | 2024-03-22 | An OS command injection vulnerability has been identified in LoadMaster. An authenticated UI user with any permission settings may be able to inject commands… |
CVE-2024-2812 | Medium | 6.3 | 2024-03-22 | A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi. It has been classified as critical. This affects the function formWriteFacMac of the file /… |
CVE-2024-2162 | High | 8.8 | 2024-03-21 | An OS Command Injection vulnerability in Kiloview NDI allows a low-privileged user to execute arbitrary code remotely on the device with high privileges. This… |
CVE-2024-2707 | Medium | 6.3 | 2024-03-20 | A vulnerability has been found in Tenda AC10U 15.03.06.49 and classified as critical. This vulnerability affects the function formWriteFacMac of the file /gofo… |
CVE-2023-44092 | High | 7.6 | 2024-03-19 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Pandora FMS on all allows OS Command Injection. Thi… |
CVE-2024-27772 | High | 8.8 | 2024-03-18 | Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-78: 'OS Command Injection' may allow RCE |
CVE-2024-28125 | Critical | 9.8 | 2024-03-18 | FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. Note: A contributor of FitNesse has claimed that this is not a v… |
CVE-2024-28254 | High | 8.8 | 2024-03-15 | OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team c… |
CVE-2024-27920 | High | 7.4 | 2024-03-15 | projectdiscovery/nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL. A significant security oversight was identified in Nuc… |
CVE-2023-51699 | Medium | 4.0 | 2024-03-15 | Fluid is an open source Kubernetes-native Distributed Dataset Orchestrator and Accelerator for data-intensive applications. An OS command injection vulnerabili… |
CVE-2024-2415 | High | 7.8 | 2024-03-13 | Command injection vulnerability in Movistar 4G router affecting version ES_WLD71-T1_v2.0.201820. This vulnerability allows an authenticated user to execute com… |
CVE-2024-28187 | High | 7.2 | 2024-03-11 | SOY CMS is an open source CMS (content management system) that allows you to build blogs and online shops. SOY CMS versions prior to 3.14.2 are vulnerable to a… |
CVE-2024-2353 | High | 8.8 | 2024-03-10 | A vulnerability, which was classified as critical, has been found in Totolink X6000R 9.4.0cu.852_20230719. This issue affects the function setDiagnosisCfg of t… |
CVE-2023-34980 | Medium | 5.9 | 2024-03-08 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2024-0815 | High | 8.8 | 2024-03-07 | Command injection in paddle.utils.download._wget_download (bypass filter) in paddlepaddle/paddle 2.6.0 |
CVE-2023-47415 | High | 7.5 | 2024-03-07 | Cypress Solutions CTM-200 v2.7.1.5600 and below was discovered to contain an OS command injection vulnerability via the cli_text parameter. |
CVE-2024-20335 | Medium | 6.5 | 2024-03-06 | A vulnerability in the web-based management interface of Cisco Small Business 100, 300, and 500 Series Wireless APs could allow an authenticated, remote attack… |
CVE-2024-20328 | Medium | 5.3 | 2024-03-01 | A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service ac… |
CVE-2024-1624 | Critical | 9.4 | 2024-03-01 | An OS Command Injection vulnerability affecting documentation server on 3DEXPERIENCE from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x, SIMU… |
CVE-2024-27516 | Critical | 9.8 | 2024-02-29 | Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive info… |
CVE-2024-25579 | Medium | 6.8 | 2024-02-28 | OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS c… |
CVE-2023-25925 | High | 8.5 | 2024-02-28 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow a remote authenticated attacker to execute arbitrary commands on the sy… |
CVE-2024-1683 | High | 7.3 | 2024-02-23 | A DLL injection vulnerability exists where an authenticated, low-privileged local attacker could modify application files on the TIE Secure Relay host, which… |
CVE-2024-25851 | High | 8.0 | 2024-02-22 | Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the config_sequence parameter in other_para of cgitest.cgi. |
CVE-2023-51450 | Medium | 5.6 | 2024-02-22 | baserCMS is a website development framework. Prior to version 5.0.9, there is an OS Command Injection vulnerability in the site search feature of baserCMS. Ver… |
CVE-2024-1212 | Critical | 10.0 | 2024-02-21 | Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution. |
CVE-2023-6398 | High | 7.2 | 2024-02-20 | A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX… |
CVE-2024-1297 | High | 7.2 | 2024-02-20 | Loomio version 2.22.0 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to OS Command Injection. |
CVE-2023-6260 | Critical | 9.0 | 2024-02-19 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Brivo ACS100, ACS300 allows OS Command Injection, B… |
CVE-2024-25626 | High | 8.8 | 2024-02-19 | Yocto Project is an open source collaboration project that helps developers create custom Linux-based systems regardless of the hardware architecture. In Yocto… |
CVE-2022-48624 | High | 7.8 | 2024-02-19 | close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. |
CVE-2024-25468 | High | 7.5 | 2024-02-17 | An issue in TOTOLINK X5000R V.9.1.0u.6369_B20230113 allows a remote attacker to cause a denial of service via the host_time parameter of the NTPSyncWithHost co… |
CVE-2024-22426 | High | 7.2 | 2024-02-16 | Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains an OS Command injection vulnerability. An unauthenticated remote attacker could potentially expl… |
CVE-2024-20720 | Critical | 9.1 | 2024-02-15 | Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Comm… |
CVE-2023-32462 | Critical | 9.8 | 2024-02-15 | Dell OS10 Networking Switches running 10.5.2.x and above contain an OS command injection vulnerability when using remote user authentication. A remote unauthe… |
CVE-2024-26260 | Critical | 9.8 | 2024-02-15 | The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system… |
CVE-2024-1367 | High | 7.2 | 2024-02-14 | A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify… |
CVE-2024-21782 | Medium | 6.7 | 2024-02-14 | BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy (scp) utility but do not have access to Advanced shell (ba… |
CVE-2024-23789 | High | 8.8 | 2024-02-14 | Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arb… |
CVE-2024-23812 | High | 8.0 | 2024-02-13 | A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application incorrectly neutralizes special elements when creating a r… |
CVE-2024-22445 | High | 7.2 | 2024-02-13 | Dell PowerProtect Data Manager, version 19.15 and prior versions, contain an OS command injection vulnerability. A remote high privileged attacker could poten… |
CVE-2024-22132 | High | 7.4 | 2024-02-13 | SAP IDES ECC-systems contain code that permits the execution of arbitrary program code of user's choice.An attacker can therefore control the behaviour of the… |
CVE-2023-50358 | Medium | 5.8 | 2024-02-13 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2023-47218 | Medium | 5.8 | 2024-02-13 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |