CWE-78 · OS Command Injection (page 34)
Page 34 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-39935 | High | 8.0 | 2023-09-06 | Archer C5400 firmware versions prior to 'Archer C5400(JP)_V2_230506' allows a network-adjacent authenticated attacker to execute arbitrary OS commands. |
CVE-2023-39224 | High | 8.0 | 2023-09-06 | Archer C5 firmware all versions and Archer C7 firmware versions prior to 'Archer C7(JP)_V2_230602' allow a network-adjacent authenticated attacker to execute a… |
CVE-2023-38588 | High | 8.0 | 2023-09-06 | Archer C3150 firmware versions prior to 'Archer C3150(JP)_V2_230511' allows a network-adjacent authenticated attacker to execute arbitrary OS commands. |
CVE-2023-38568 | High | 8.8 | 2023-09-06 | Archer A10 firmware versions prior to 'Archer A10(JP)_V2_230504' allows a network-adjacent unauthenticated attacker to execute arbitrary OS commands. |
CVE-2023-38563 | High | 8.8 | 2023-09-06 | Archer C1200 firmware versions prior to 'Archer C1200(JP)_V2_230508' and Archer C9 firmware versions prior to 'Archer C9(JP)_V3_230508' allow a network-adjacen… |
CVE-2023-36489 | High | 8.8 | 2023-09-06 | Multiple TP-LINK products allow a network-adjacent unauthenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: TL-WR8… |
CVE-2023-31188 | High | 8.0 | 2023-09-06 | Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer C… |
CVE-2023-39362 | High | 7.2 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can… |
CVE-2015-2201 | High | 7.2 | 2023-09-05 | Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users. |
CVE-2023-4711 | Medium | 5.0 | 2023-09-01 | A vulnerability, which was classified as critical, has been found in D-Link DAR-8000-10 up to 20230819. Affected by this issue is some unknown functionality of… |
CVE-2023-40582 | Critical | 9.8 | 2023-08-30 | find-exec is a utility to discover available shell commands. Versions prior to 1.0.3 did not properly escape user input and are vulnerable to Command Injection… |
CVE-2023-40839 | Critical | 9.8 | 2023-08-30 | Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_ADF3C' contains a command execution vulnerability. In the "formSetIptv" function, obtaining th… |
CVE-2023-40838 | Critical | 9.8 | 2023-08-30 | Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_3A1D0' contains a command execution vulnerability. |
CVE-2023-40837 | Critical | 9.8 | 2023-08-30 | Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_ADD50' contains a command execution vulnerability. In the "formSetIptv" function, obtaining th… |
CVE-2023-41109 | Critical | 9.8 | 2023-08-28 | SmartNode SN200 (aka SN200) 3.21.2-23021 allows unauthenticated OS Command Injection. |
CVE-2023-1997 | High | 8.8 | 2023-08-28 | An OS Command Injection vulnerability exists in SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023x. A specially crafted… |
CVE-2023-38027 | Critical | 9.8 | 2023-08-28 | SpotCam Co., Ltd. SpotCam Sense’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulne… |
CVE-2023-38025 | Critical | 9.8 | 2023-08-28 | SpotCam Co., Ltd. SpotCam FHD 2’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vuln… |
CVE-2022-43907 | High | 7.2 | 2023-08-27 | IBM Security Guardium 11.4 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM… |
CVE-2023-4542 | Medium | 6.3 | 2023-08-25 | A vulnerability was found in D-Link DAR-8000-10 up to 20230809. It has been classified as critical. This affects an unknown part of the file /app/sys1.php. The… |
CVE-2023-37249 | High | 8.8 | 2023-08-25 | Infoblox NIOS through 8.5.1 has a faulty component that accepts malicious input without sanitization, resulting in shell access. |
CVE-2023-40144 | High | 8.8 | 2023-08-23 | OS command injection vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its set… |
CVE-2020-21583 | Medium | 6.7 | 2023-08-22 | An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute arbitrary commands via the path parameter when setting the… |
CVE-2023-4412 | Medium | 6.3 | 2023-08-18 | A vulnerability was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical. This issue affects the function setWanCfg. The manipulation… |
CVE-2023-4411 | Medium | 6.3 | 2023-08-18 | A vulnerability has been found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical. This vulnerability affects the function setTracerouteC… |
CVE-2023-4410 | Medium | 6.3 | 2023-08-18 | A vulnerability, which was classified as critical, was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023. This affects the function setDiagnosisCfg. The mani… |
CVE-2023-40072 | High | 8.8 | 2023-08-18 | OS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command by sending a spe… |
CVE-2023-40069 | Critical | 9.8 | 2023-08-18 | OS command injection vulnerability in ELECOM wireless LAN routers allows an attacker who can access the product to execute an arbitrary OS command by sending a… |
CVE-2023-39944 | High | 8.8 | 2023-08-18 | OS command injection vulnerability in WRC-F1167ACF all versions, and WRC-1750GHBK all versions allows an attacker who can access the product to execute an arbi… |
CVE-2023-39455 | High | 8.8 | 2023-08-18 | OS command injection vulnerability in ELECOM wireless LAN routers allows an authenticated user to execute an arbitrary OS command by sending a specially crafte… |
CVE-2023-39416 | High | 7.2 | 2023-08-18 | Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlier, and Proself Mail Sanitize Edition Ver1.07 and earlier all… |
CVE-2023-34215 | High | 7.2 | 2023-08-17 | TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validat… |
CVE-2023-34214 | High | 7.2 | 2023-08-17 | TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. Th… |
CVE-2023-34213 | High | 8.8 | 2023-08-17 | TN-5900 Series firmware versions v3.3 and prior are vulnerable to command-injection vulnerability. This vulnerability stems from insufficient input validation… |
CVE-2023-33239 | High | 8.8 | 2023-08-17 | TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. Th… |
CVE-2023-33238 | High | 7.2 | 2023-08-17 | TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. Th… |
CVE-2023-35893 | Critical | 9.9 | 2023-08-16 | IBM Security Guardium 10.6, 11.3, 11.4, and 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially… |
CVE-2023-20017 | Medium | 6.5 | 2023-08-16 | Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary commands using root-l… |
CVE-2023-20013 | Medium | 6.5 | 2023-08-16 | Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary commands using root-l… |
CVE-2023-33013 | High | 8.8 | 2023-08-14 | A post-authentication command injection vulnerability in the NTP feature of Zyxel NBG6604 firmware version V1.01(ABIR.1)C0 could allow an authenticated attacke… |
CVE-2023-3267 | Critical | 9.1 | 2023-08-14 | When adding a remote backup location, an authenticated user can pass arbitrary OS commands through the username field. The username is passed without sanitizat… |
CVE-2023-3261 | High | 7.5 | 2023-08-14 | The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier contains a buffer overflow vulnerability in the librta.so.0.0.0 library.Successful ex… |
CVE-2023-3260 | High | 7.2 | 2023-08-14 | The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to command injection via the `user-name` URL parameter. An authenticate… |
CVE-2023-40253 | Medium | 6.0 | 2023-08-11 | Improper Authentication vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Authentica… |
CVE-2023-31209 | High | 8.8 | 2023-08-10 | Improper neutralization of active check command arguments in Checkmk < 2.1.0p32, < 2.0.0p38, < 2.2.0p4 leads to arbitrary command execution for authenticated u… |
CVE-2022-48604 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “logging export” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directl… |
CVE-2022-48603 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “message viewer iframe” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it… |
CVE-2022-48602 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “message viewer print” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it d… |
CVE-2022-48601 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “network print report” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it d… |
CVE-2022-48600 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “notes view” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to… |
CVE-2022-48599 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “reporter events type” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it d… |
CVE-2022-48598 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “reporter events type date” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes… |
CVE-2022-48597 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “ticket event report” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it di… |
CVE-2022-48596 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “ticket queue watchers” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it… |
CVE-2022-48595 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “ticket template watchers” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes… |
CVE-2022-48594 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “ticket watchers email” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it… |
CVE-2022-48593 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “topology data service” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it… |
CVE-2022-48592 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the vendor_country parameter of the “vendor print report” feature of the ScienceLogic SL1 that takes unsanitized user‐c… |
CVE-2022-48591 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the vendor_state parameter of the “vendor print report” feature of the ScienceLogic SL1 that takes unsanitized user‐con… |
CVE-2022-48590 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “admin dynamic app mib errors” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and pas… |
CVE-2022-48589 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “reporting job editor” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it d… |
CVE-2022-48588 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “schedule editor decoupled” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes… |
CVE-2022-48587 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “schedule editor” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it direct… |
CVE-2022-48586 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “json walker” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly t… |
CVE-2022-48585 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “admin brand portal” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it dir… |
CVE-2022-48584 | High | 8.8 | 2023-08-09 | A command injection vulnerability exists in the download and convert report feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and pa… |
CVE-2022-48583 | High | 8.8 | 2023-08-09 | A command injection vulnerability exists in the dashboard scheduler feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it… |
CVE-2022-48582 | High | 8.8 | 2023-08-09 | A command injection vulnerability exists in the ticket report generate feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes… |
CVE-2022-48581 | High | 8.8 | 2023-08-09 | A command injection vulnerability exists in the “dash export” feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it direct… |
CVE-2022-48580 | High | 8.8 | 2023-08-09 | A command injection vulnerability exists in the ARP ping device tool feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it… |
CVE-2023-38208 | Critical | 9.1 | 2023-08-09 | Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Improper Neutralization of Special Element… |
CVE-2023-37863 | High | 7.2 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with SNMPv2 write privileges may use an a special SNMP request to g… |
CVE-2023-37861 | High | 8.8 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated remote attacker can execute code with root permissions with a specia… |
CVE-2023-37569 | High | 8.8 | 2023-08-08 | This vulnerability exists in ESDS Emagic Data Center Management Suit due to lack of input sanitization in its Ping component. A remote authenticated attacker c… |
CVE-2023-3573 | High | 8.8 | 2023-08-08 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a command injection in a HTTP POST requ… |
CVE-2023-3572 | Critical | 10.0 | 2023-08-08 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote, unauthenticated attacker may use an attribute of a specific HTTP POST reque… |
CVE-2023-3571 | High | 8.8 | 2023-08-08 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP POST releated to certif… |
CVE-2023-3570 | High | 8.8 | 2023-08-08 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP DELETE request to gain… |
CVE-2023-38692 | Critical | 9.8 | 2023-08-04 | CloudExplorer Lite is an open source, lightweight cloud management platform. Versions prior to 1.3.1 contain a command injection vulnerability in the installat… |
CVE-2023-33377 | Critical | 9.8 | 2023-08-04 | Connected IO v2.1.0 and prior has an OS command injection vulnerability in the set firewall command in part of its communication protocol, enabling attackers t… |
CVE-2023-33374 | Critical | 9.8 | 2023-08-04 | Connected IO v2.1.0 and prior has a command as part of its communication protocol allowing the management platform to specify arbitrary OS commands for devices… |
CVE-2023-33364 | High | 8.8 | 2023-08-03 | An OS Command injection vulnerability exists in Suprema BioStar 2 before V2.9.1, which allows authenticated users to execute arbitrary OS commands on the BioSt… |
CVE-2023-21411 | High | 7.2 | 2023-08-03 | User provided input is not sanitized in the “Settings > Access Control” configuration interface allowing for arbitrary code execution. |
CVE-2023-21410 | High | 7.2 | 2023-08-03 | User provided input is not sanitized on the AXIS License Plate Verifier specific “api.cgi” allowing for arbitrary code execution. |
CVE-2023-26317 | High | 7.0 | 2023-08-02 | Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from external interface… |
CVE-2023-31425 | High | 7.8 | 2023-08-01 | A vulnerability in the fosexec command of Brocade Fabric OS after Brocade Fabric OS v9.1.0 and, before Brocade Fabric OS v9.1.1 could allow a local authenticat… |
CVE-2023-4033 | High | 7.8 | 2023-08-01 | OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0. |
CVE-2023-35861 | Critical | 9.8 | 2023-07-31 | A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute… |
CVE-2023-35019 | High | 7.2 | 2023-07-31 | IBM Security Verify Governance, Identity Manager 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a spec… |
CVE-2023-37213 | High | 8.8 | 2023-07-30 | Synel SYnergy Fingerprint Terminals - CWE-78: 'OS Command Injection' |
CVE-2023-3975 | Critical | 9.8 | 2023-07-27 | OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0. |
CVE-2023-3974 | Critical | 9.8 | 2023-07-27 | OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0. |
CVE-2023-38673 | Critical | 9.6 | 2023-07-26 | PaddlePaddle before 2.5.0 has a command injection in fs.py. This resulted in the ability to execute arbitrary commands on the operating system. |
CVE-2023-38056 | High | 7.2 | 2023-07-24 | Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authen… |
CVE-2023-37903 | Critical | 9.8 | 2023-07-21 | vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sa… |
CVE-2023-37292 | Critical | 9.8 | 2023-07-21 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in HGiga iSherlock 4.5 (iSherlock-user modules), HGiga… |
CVE-2023-37477 | High | 7.2 | 2023-07-18 | 1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality… |
CVE-2023-36670 | Critical | 9.8 | 2023-07-18 | A remotely exploitable command injection vulnerability was found on the Kratos NGC-IDU 9.1.0.4. An attacker can execute arbitrary Linux commands as root by sen… |
CVE-2020-36762 | Medium | 5.5 | 2023-07-18 | A vulnerability was found in ONS Digital RAS Collection Instrument up to 2.0.27 and classified as critical. Affected by this issue is the function jobs of the… |
CVE-2023-34141 | High | 8.0 | 2023-07-17 | A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX ser… |