CWE-78 · OS Command Injection (page 31)
Page 31 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-22228 | High | 7.8 | 2024-02-12 | Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_cifssupport utility. An authenticated attacker could potentially… |
CVE-2024-22227 | High | 7.8 | 2024-02-12 | Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_dc utility. An authenticated attacker could potentially exploit t… |
CVE-2024-22225 | High | 7.8 | 2024-02-12 | Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_supportassist utility. An authenticated attacker could potentiall… |
CVE-2024-22224 | High | 7.8 | 2024-02-12 | Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_nas utility. An authenticated attacker could potentially exploit… |
CVE-2024-22223 | High | 7.8 | 2024-02-12 | Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability within its svc_cbr utility. An authenticated malicious user with local acces… |
CVE-2024-22222 | High | 7.8 | 2024-02-12 | Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability within its svc_udoctor utility. An authenticated malicious user with local a… |
CVE-2024-0170 | High | 7.8 | 2024-02-12 | Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_cava utility. An authenticated attacker could potentially exploit… |
CVE-2024-0168 | High | 7.8 | 2024-02-12 | Dell Unity, versions prior to 5.4, contains a Command Injection Vulnerability in svc_oscheck utility. An authenticated attacker could potentially exploit this… |
CVE-2024-0167 | High | 7.8 | 2024-02-12 | Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in the svc_topstats utility. An authenticated attacker could potentially exp… |
CVE-2024-0166 | High | 7.8 | 2024-02-12 | Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_tcpdump utility. An authenticated attacker could potentially expl… |
CVE-2024-0165 | High | 7.8 | 2024-02-12 | Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_acldb_dump utility. An authenticated attacker could potentially e… |
CVE-2024-0164 | High | 7.8 | 2024-02-12 | Dell Unity, versions prior to 5.4, contain an OS Command Injection Vulnerability in its svc_topstats utility. An authenticated attacker could potentially expl… |
CVE-2024-22836 | Critical | 9.8 | 2024-02-08 | An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute s… |
CVE-2024-24091 | Critical | 9.8 | 2024-02-08 | Yealink Meeting Server before v26.0.0.66 was discovered to contain an OS command injection vulnerability via the file upload interface. |
CVE-2023-47618 | High | 7.2 | 2024-02-06 | A post authentication command execution vulnerability exists in the web filtering functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322… |
CVE-2023-47617 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists when configuring the web group member of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230… |
CVE-2023-47209 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322… |
CVE-2023-47167 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists in the GRE policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Re… |
CVE-2023-46683 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists when configuring the wireguard VPN functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0… |
CVE-2023-43482 | High | 7.2 | 2024-02-06 | A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A speci… |
CVE-2023-42664 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 bui… |
CVE-2023-36498 | High | 7.2 | 2024-02-06 | A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 R… |
CVE-2023-46359 | Critical | 9.8 | 2024-02-06 | An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to execute arbi… |
CVE-2024-23109 | Critical | 10.0 | 2024-02-05 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorize… |
CVE-2024-23108 | Critical | 10.0 | 2024-02-05 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorize… |
CVE-2023-5677 | Medium | 6.3 | 2024-02-05 | Brandon Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi did not have a sufficient input validation allowing… |
CVE-2023-47567 | Medium | 4.7 | 2024-02-02 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2023-47566 | Medium | 6.7 | 2024-02-02 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2023-47562 | High | 7.4 | 2024-02-02 | An OS command injection vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated users to execute com… |
CVE-2023-45025 | Critical | 9.0 | 2024-02-02 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2023-41283 | Medium | 5.5 | 2024-02-02 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2023-41282 | Medium | 5.5 | 2024-02-02 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2023-41281 | Medium | 5.5 | 2024-02-02 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2023-39302 | Medium | 6.6 | 2024-02-02 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2023-39297 | High | 8.8 | 2024-02-02 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2023-6078 | High | 8.8 | 2024-02-01 | An OS Command Injection vulnerability exists in BIOVIA Materials Studio products from Release BIOVIA 2021 through Release BIOVIA 2023. Upload of a specially cr… |
CVE-2024-1115 | High | 7.3 | 2024-01-31 | A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function dlfile of the file /application/websocket/controlle… |
CVE-2024-24333 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the desc parameter in the setWiFiAclRules function. |
CVE-2024-24332 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the url parameter in the setUrlFilterRules function. |
CVE-2024-24331 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setWiFiScheduleCfg function. |
CVE-2024-24330 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the port or enable parameter in the setRemoteCfg functi… |
CVE-2024-24329 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules functio… |
CVE-2024-24328 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFilterRules function. |
CVE-2024-24327 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pppoePass parameter in the setIpv6Cfg function. |
CVE-2024-24326 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the arpEnable parameter in the setStaticDhcpRules funct… |
CVE-2024-24325 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setParentalRules function. |
CVE-2023-5372 | High | 7.2 | 2024-01-30 | The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(A… |
CVE-2023-49038 | High | 7.2 | 2024-01-29 | Command injection in the ping utility on Buffalo LS210D 1.78-0.03 allows a remote authenticated attacker to inject arbitrary commands onto the NAS as root. |
CVE-2024-0986 | Medium | 4.7 | 2024-01-29 | A vulnerability was found in Issabel PBX 4.0.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php?menu=asterisk_… |
CVE-2024-0921 | Medium | 4.7 | 2024-01-26 | A vulnerability has been found in D-Link DIR-816 A2 1.10CNB04 and classified as critical. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2024-0918 | High | 7.2 | 2024-01-26 | A vulnerability was found in TRENDnet TEW-800MB 1.0.1.0 and classified as critical. Affected by this issue is some unknown functionality of the component POST… |
CVE-2023-38323 | Critical | 9.8 | 2024-01-26 | An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the status path script entry in the configuration file, allowing attackers that have dir… |
CVE-2023-38319 | Critical | 9.8 | 2024-01-26 | An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indi… |
CVE-2023-38318 | Critical | 9.8 | 2024-01-26 | An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the gateway FQDN entry in the configuration file, allowing attackers that have direct or… |
CVE-2023-38317 | Critical | 9.8 | 2024-01-26 | An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the network interface name entry in the configuration file, allowing attackers that have… |
CVE-2024-22372 | Medium | 6.8 | 2024-01-24 | OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS c… |
CVE-2024-22366 | Medium | 6.8 | 2024-01-24 | Active debug code exists in Yamaha wireless LAN access point devices. If a logged-in user who knows how to use the debug function accesses the device's managem… |
CVE-2023-31037 | High | 7.2 | 2024-01-24 | NVIDIA Bluefield 2 and Bluefield 3 DPU BMC contains a vulnerability in ipmitool, where a root user may cause code injection by a network call. A successful ex… |
CVE-2023-6926 | High | 8.4 | 2024-01-23 | There is an OS command injection vulnerability in Crestron AM-300 firmware version 1.4499.00018 which may enable a user of a limited-access SSH session to esc… |
CVE-2024-0778 | High | 8.0 | 2024-01-22 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in Uniview ISC 2500-S up to 20210930. Affected by this issue… |
CVE-2023-49329 | High | 7.2 | 2024-01-19 | Anomali Match before 4.6.2 allows OS Command Injection. An authenticated admin user can inject and execute operating system commands. This arises from improper… |
CVE-2024-0714 | Medium | 6.3 | 2024-01-19 | A vulnerability was found in MiczFlor RPi-Jukebox-RFID up to 2.5.0. It has been rated as critical. Affected by this issue is some unknown functionality of the… |
CVE-2023-51217 | High | 8.8 | 2024-01-18 | An issue discovered in TenghuTOS TWS-200 firmware version:V4.0-201809201424 allows a remote attacker to execute arbitrary code via crafted command on the ping… |
CVE-2024-20277 | Medium | 6.8 | 2024-01-17 | A vulnerability in the web-based management interface of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated… |
CVE-2023-51698 | Critical | 9.6 | 2024-01-12 | Atril is a simple multi-page document viewer. Atril is vulnerable to a critical Command Injection Vulnerability. This vulnerability gives the attacker immediat… |
CVE-2023-49254 | High | 8.8 | 2024-01-12 | Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the "destination" field of the network test tools. Th… |
CVE-2023-52026 | Critical | 9.8 | 2024-01-12 | TOTOlink EX1800T V9.1.0cu.2112_B20220316 was discovered to contain a remote command execution (RCE) vulnerability via the telnet_enabled parameter of the setTe… |
CVE-2024-23061 | Critical | 9.8 | 2024-01-11 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the minute parameter in the setScheduleCfg function. |
CVE-2024-23060 | Critical | 9.8 | 2024-01-11 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDmzCfg function. |
CVE-2024-23059 | Critical | 9.8 | 2024-01-11 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the username parameter in the setDdnsCfg function. |
CVE-2024-23058 | Critical | 9.8 | 2024-01-11 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pass parameter in the setTr069Cfg function. |
CVE-2024-23057 | Critical | 9.8 | 2024-01-11 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the tz parameter in the setNtpCfg function. |
CVE-2024-22942 | Critical | 9.8 | 2024-01-11 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the hostName parameter in the setWanCfg function. |
CVE-2023-51984 | Critical | 9.8 | 2024-01-11 | D-Link DIR-822+ V1.0.2 was found to contain a command injection in SetStaticRouteSettings function. allows remote attackers to execute arbitrary commands via s… |
CVE-2023-52029 | Critical | 9.8 | 2024-01-11 | TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the setDiagnosisCfg function. |
CVE-2023-52028 | Critical | 9.8 | 2024-01-11 | TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the setTracerouteCfg function. |
CVE-2024-21833 | High | 8.8 | 2024-01-11 | Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands. The affected device, w… |
CVE-2024-21821 | High | 8.0 | 2024-01-11 | Multiple TP-LINK products allow a network-adjacent authenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS command… |
CVE-2024-21773 | High | 8.8 | 2024-01-11 | Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS comma… |
CVE-2023-51123 | Critical | 9.8 | 2024-01-10 | An issue discovered in D-Link dir815 v.1.01SSb08.bin allows a remote attacker to execute arbitrary code via a crafted POST request to the service parameter in… |
CVE-2023-49235 | Critical | 9.8 | 2024-01-09 | An issue was discovered in libremote_dbg.so on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Filtering of debug information is mishandled during use of popen. Con… |
CVE-2023-35964 | High | 7.8 | 2024-01-08 | Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary… |
CVE-2023-35963 | High | 7.8 | 2024-01-08 | Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary… |
CVE-2023-35962 | High | 7.8 | 2024-01-08 | Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary… |
CVE-2023-35961 | High | 7.8 | 2024-01-08 | Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary… |
CVE-2023-35960 | High | 7.8 | 2024-01-08 | Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary… |
CVE-2023-35959 | High | 7.8 | 2024-01-08 | Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary… |
CVE-2023-29048 | High | 8.8 | 2024-01-08 | A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users an… |
CVE-2024-0299 | High | 7.3 | 2024-01-08 | A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been declared as critical. Affected by this vulnerability is the function setTracero… |
CVE-2024-0298 | High | 7.3 | 2024-01-08 | A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been classified as critical. Affected is the function setDiagnosisCfg of the file /c… |
CVE-2024-0297 | High | 7.3 | 2024-01-08 | A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. This issue affects the function UploadFirmwareFile of the file /… |
CVE-2024-0296 | High | 7.3 | 2024-01-08 | A vulnerability has been found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. This vulnerability affects the function NTPSyncWithHost of… |
CVE-2024-0295 | High | 7.3 | 2024-01-08 | A vulnerability, which was classified as critical, was found in Totolink LR1200GB 9.1.0u.6619_B20230130. This affects the function setWanCfg of the file /cgi-b… |
CVE-2024-0294 | High | 7.3 | 2024-01-08 | A vulnerability, which was classified as critical, has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected by this issue is the function setUssd of… |
CVE-2024-0293 | Medium | 6.3 | 2024-01-08 | A vulnerability classified as critical was found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected by this vulnerability is the function setUploadSetting of… |
CVE-2024-0292 | Medium | 6.3 | 2024-01-08 | A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected is the function setOpModeCfg of the file /cgi-bin/cs… |
CVE-2023-47560 | High | 7.4 | 2024-01-05 | An OS command injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to execute commands… |
CVE-2023-41289 | Medium | 6.3 | 2024-01-05 | An OS command injection vulnerability has been reported to affect QcalAgent. If exploited, the vulnerability could allow authenticated users to execute command… |
CVE-2023-41288 | High | 8.8 | 2024-01-05 | An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to execute commands via a ne… |
CVE-2023-39294 | Medium | 6.6 | 2024-01-05 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |