CWE-78 · OS Command Injection (page 35)
Page 35 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-34139 | High | 8.8 | 2023-07-17 | A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series… |
CVE-2023-34138 | High | 8.0 | 2023-07-17 | A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USG FLEX series firmwa… |
CVE-2023-33012 | High | 8.8 | 2023-07-17 | A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware ver… |
CVE-2023-28767 | High | 8.8 | 2023-07-17 | The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through 5.36, USG FLEX series firmware versions… |
CVE-2023-38378 | Critical | 9.8 | 2023-07-16 | The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to execute arbitrary code via shell metacharac… |
CVE-2023-37564 | High | 8.0 | 2023-07-13 | OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute an arbitrary OS command with a ro… |
CVE-2023-34127 | High | 8.8 | 2023-07-13 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall Analytics enables an authe… |
CVE-2023-34116 | High | 8.2 | 2023-07-11 | Improper input validation in the Zoom Desktop Client for Windows before version 5.15.0 may allow an unauthorized user to enable an escalation of privilege via… |
CVE-2023-23777 | High | 7.2 | 2023-07-11 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiWeb version 7.0.1 and below, 6.4 a… |
CVE-2023-36922 | Critical | 9.1 | 2023-07-11 | Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary ope… |
CVE-2023-3608 | Medium | 4.7 | 2023-07-10 | A vulnerability was found in Ruijie BCR810W 2.5.10. It has been rated as critical. This issue affects some unknown processing of the component Tracert Page. Th… |
CVE-2023-3607 | Medium | 5.5 | 2023-07-10 | A vulnerability was found in kodbox 1.26. It has been declared as critical. This vulnerability affects the function Execute of the file webconsole.php.txt of t… |
CVE-2023-3606 | Medium | 6.3 | 2023-07-10 | A vulnerability was found in TamronOS up to 20230703. It has been classified as critical. This affects an unknown part of the file /api/ping. The manipulation… |
CVE-2021-42081 | Critical | 9.1 | 2023-07-10 | An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API. POC http://<IP_ADDRESS>/qstorapi/storageSystemModify?stora… |
CVE-2023-37173 | Critical | 9.8 | 2023-07-07 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function. |
CVE-2023-37172 | Critical | 9.8 | 2023-07-07 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function. |
CVE-2023-37171 | Critical | 9.8 | 2023-07-07 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function. |
CVE-2023-37170 | Critical | 9.8 | 2023-07-07 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the lang parameter in the se… |
CVE-2023-25583 | High | 7.2 | 2023-07-06 | Two OS command injection vulnerabilities exist in the zebra vlan_name functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead… |
CVE-2023-25582 | High | 7.2 | 2023-07-06 | Two OS command injection vulnerabilities exist in the zebra vlan_name functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead… |
CVE-2023-24595 | High | 7.2 | 2023-07-06 | An OS command injection vulnerability exists in the ys_thirdparty system_user_script functionality of Milesight UR32L v32.3.0.5. A specially crafted series of… |
CVE-2023-24582 | High | 8.8 | 2023-07-06 | Two OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5. A specially crafted network requ… |
CVE-2023-24520 | High | 8.8 | 2023-07-06 | Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. A specially-crafted networ… |
CVE-2023-24519 | High | 8.8 | 2023-07-06 | Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. A specially-crafted networ… |
CVE-2023-23550 | High | 7.2 | 2023-07-06 | An OS command injection vulnerability exists in the ys_thirdparty user_delete functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet ca… |
CVE-2023-22659 | High | 7.2 | 2023-07-06 | An os command injection vulnerability exists in the libzebra.so change_hostname functionality of Milesight UR32L v32.3.0.5. A specially-crafted network packets… |
CVE-2023-22653 | High | 8.8 | 2023-07-06 | An OS command injection vulnerability exists in the vtysh_ubus tcpdump_start_cb functionality of Milesight UR32L v32.3.0.5. A specially crafted HTTP request ca… |
CVE-2023-22371 | High | 8.1 | 2023-07-06 | An os command injection vulnerability exists in the liburvpn.so create_private_key functionality of Milesight VPN v2.0.2. A specially-crafted network request c… |
CVE-2023-22365 | High | 7.2 | 2023-07-06 | An OS command injection vulnerability exists in the ys_thirdparty check_system_user functionality of Milesight UR32L v32.3.0.5. A specially crafted set of netw… |
CVE-2023-22299 | High | 8.8 | 2023-07-06 | An OS command injection vulnerability exists in the vtysh_ubus _get_fw_logs functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can… |
CVE-2023-36622 | High | 7.2 | 2023-07-05 | The websocket configuration endpoint of the Loxone Miniserver Go Gen.2 before 14.1.5.9 allows remote authenticated administrators to inject arbitrary OS comman… |
CVE-2023-27198 | Medium | 6.8 | 2023-07-05 | PAX A930 device with PayDroid_7.1.1_Virgo_V04.5.02_20220722 can allow the execution of arbitrary commands by using the exec service and including a specific wo… |
CVE-2023-3314 | High | 8.1 | 2023-07-03 | A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip file(s). Incomplete neutralization of external commands used to co… |
CVE-2023-3313 | High | 7.8 | 2023-07-03 | An OS common injection vulnerability exists in the ESM certificate API, whereby incorrectly neutralized special elements may have allowed an unauthorized user… |
CVE-2023-22816 | Medium | 6.0 | 2023-06-30 | A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an attacker to build files… |
CVE-2023-22815 | Medium | 6.2 | 2023-06-30 | Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute code in the context… |
CVE-2023-32622 | High | 7.2 | 2023-06-30 | Improper neutralization of special elements in WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to execute OS… |
CVE-2023-36143 | High | 8.8 | 2023-06-30 | Maxprint Maxlink 1200G v3.4.11E has an OS command injection vulnerability in the "Diagnostic tool" functionality of the device. |
CVE-2022-44720 | Critical | 9.8 | 2023-06-29 | An issue was discovered in Weblib Ucopia before 6.0.13. OS Command Injection injection can occur, related to chroot. |
CVE-2023-26613 | Critical | 9.8 | 2023-06-29 | An OS command injection vulnerability in D-Link DIR-823G firmware version 1.02B05 allows unauthorized attackers to execute arbitrary operating system commands… |
CVE-2023-3450 | Medium | 4.7 | 2023-06-28 | A vulnerability was found in Ruijie RG-BCR860 2.5.13 and classified as critical. This issue affects some unknown processing of the component Network Diagnostic… |
CVE-2023-2625 | Critical | 9.0 | 2023-06-28 | A vulnerability exists that can be exploited by an authenticated client that is connected to the same network segment as the CoreTec 4, having any level of acc… |
CVE-2023-26134 | Critical | 9.8 | 2023-06-28 | Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo () fails to saniti… |
CVE-2023-3333 | High | 7.2 | 2023-06-28 | Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG… |
CVE-2023-34420 | High | 7.2 | 2023-06-26 | A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web API. |
CVE-2023-30261 | Critical | 9.8 | 2023-06-26 | Command Injection vulnerability in OpenWB 1.6 and 1.7 allows remote attackers to run arbitrary commands via crafted GET request. |
CVE-2023-34254 | High | 7.6 | 2023-06-23 | The GLPI Agent is a generic management agent. Prior to version 1.5, if glpi-agent is running remoteinventory task against an Unix platform with ssh command, an… |
CVE-2023-30258 | Critical | 9.8 | 2023-06-23 | Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request. |
CVE-2023-35174 | High | 8.6 | 2023-06-22 | Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a `livebook://` link from a browser… |
CVE-2023-24261 | High | 7.2 | 2023-06-21 | A vulnerability in GL.iNET GL-E750 Mudi before firmware v3.216 allows authenticated attackers to execute arbitrary code via a crafted POST request. |
CVE-2023-33869 | Medium | 6.3 | 2023-06-20 | Enphase Envoy versions D7.0.88 is vulnerable to a command injection exploit that may allow an attacker to execute root commands. |
CVE-2023-27992 | Critical | 9.8 | 2023-06-19 | The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21… |
CVE-2023-34642 | High | 7.8 | 2023-06-19 | KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on Windows 10. This issue can allow attacke… |
CVE-2022-48472 | Critical | 9.8 | 2023-06-16 | A Huawei printer has a system command injection vulnerability. Successful exploitation could lead to remote code execution. Affected product versions include:B… |
CVE-2023-34800 | Critical | 9.8 | 2023-06-15 | D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at genacgi_main. |
CVE-2022-32752 | High | 7.2 | 2023-06-15 | IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a spe… |
CVE-2023-32548 | High | 8.1 | 2023-06-13 | OS command injection vulnerability exists in WPS Office version 10.8.0.6186. If a remote attacker who can conduct a man-in-the-middle attack connects the produ… |
CVE-2023-31198 | High | 7.2 | 2023-06-13 | OS command injection vulnerability exists in Wi-Fi AP UNIT allows. If this vulnerability is exploited, a remote authenticated attacker with an administrative p… |
CVE-2023-30764 | Critical | 9.8 | 2023-06-13 | OS command injection vulnerability exists in KB-AHR series and KB-IRIP series. If this vulnerability is exploited, an arbitrary OS command may be executed on t… |
CVE-2023-28000 | Medium | 6.7 | 2023-06-13 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC CLI 7.1.0, 7.0.0 through 7.0.3, 6.2.0 through 6.2.4, 6… |
CVE-2023-26210 | High | 7.8 | 2023-06-13 | Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] vulnerability in Fortinet allows a… |
CVE-2023-34343 | High | 7.2 | 2023-06-12 | AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can inject arbitrary shell commands, which may lead to cod… |
CVE-2023-34334 | High | 7.2 | 2023-06-12 | AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can inject arbitrary shell commands, which may lead to cod… |
CVE-2023-34105 | High | 7.5 | 2023-06-12 | SRS is a real-time video server supporting RTMP, WebRTC, HLS, HTTP-FLV, SRT, MPEG-DASH, and GB28181. Prior to versions 5.0.157, 5.0-b1, and 6.0.48, SRS's `api-… |
CVE-2023-34108 | High | 8.8 | 2023-06-07 | mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration. A vulner… |
CVE-2023-33381 | High | 7.2 | 2023-06-06 | A command injection vulnerability was found in the ping functionality of the MitraStar GPT-2741GNAC router (firmware version AR_g5.8_110WVN0b7_2). The vulnerab… |
CVE-2023-3097 | Medium | 5.3 | 2023-06-05 | A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been rated as critical. This issue affects the function setMainSource. The… |
CVE-2023-28704 | High | 8.8 | 2023-06-02 | Furbo dog camera has insufficient filtering for special parameter of device log management function. An unauthenticated remote attacker in the Bluetooth networ… |
CVE-2023-28702 | High | 8.8 | 2023-06-02 | ASUS RT-AC86U does not filter special characters for parameters in specific web URLs. A remote attacker with normal user privileges can exploit this vulnerabil… |
CVE-2022-47616 | High | 7.2 | 2023-06-02 | Hitron CODA-5310 has insufficient filtering for specific parameters in the connection test function. A remote attacker authenticated as an administrator, can u… |
CVE-2023-33965 | Critical | 9.6 | 2023-06-01 | Brook is a cross-platform programmable network tool. The `tproxy` server is vulnerable to a drive-by command injection. An attacker may fool a victim into visi… |
CVE-2023-25539 | High | 8.4 | 2023-05-31 | Dell NetWorker 19.6.1.2, contains an OS command injection Vulnerability in the NetWorker client. A remote unauthenticated attacker could potentially exploit t… |
CVE-2023-34152 | Critical | 9.8 | 2023-05-30 | A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured. |
CVE-2022-46361 | Medium | 6.9 | 2023-05-30 | An attacker having physical access to WDM can plug USB device to gain access and execute unwanted commands. A malicious user could enter a system command along… |
CVE-2023-27988 | High | 7.2 | 2023-05-30 | The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authenticated attacker w… |
CVE-2023-30253 | High | 8.8 | 2023-05-29 | Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data. |
CVE-2023-26129 | High | 8.4 | 2023-05-27 | All versions of the package bwm-ng are vulnerable to Command Injection due to improper input sanitization in the 'check' function in the bwm-ng.js file. **No… |
CVE-2023-26128 | High | 8.4 | 2023-05-27 | All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employ… |
CVE-2023-26127 | High | 7.8 | 2023-05-27 | All versions of the package n158 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function. **Note:** To execut… |
CVE-2023-31128 | High | 8.1 | 2023-05-26 | NextCloud Cookbook is a recipe library app. Prior to commit a46d9855 on the `master` branch and commit 489bb744 on the `main-0.9.x` branch, the `pull-checks.ym… |
CVE-2023-33617 | High | 7.2 | 2023-05-23 | An OS Command Injection vulnerability in Parks Fiberlink 210 firmware version V2.1.14_X000 was found via the /boaform/admin/formPing target_addr parameter. |
CVE-2023-23694 | Medium | 4.7 | 2023-05-23 | Dell VxRail versions earlier than 7.0.450, contain(s) an OS command injection vulnerability in VxRail Manager. A local authenticated attacker could potentiall… |
CVE-2023-23693 | Medium | 6.7 | 2023-05-23 | Dell VxRail, versions prior to 7.0.450, contains an OS command injection Vulnerability in DCManager command-line utility. A local high privileged attacker cou… |
CVE-2023-28394 | High | 8.8 | 2023-05-23 | Beekeeper Studio versions prior to 3.9.9 allows a remote authenticated attacker to execute arbitrary JavaScript code with the privilege of the application on t… |
CVE-2023-28392 | High | 7.2 | 2023-05-23 | Wi-Fi AP UNIT AC-PD-WAPU v1.05_B04 and earlier, AC-PD-WAPUM v1.05_B04 and earlier, AC-PD-WAPU-P v1.05_B04P and earlier, AC-PD-WAPUM-P v1.05_B04P and earlier, A… |
CVE-2023-27521 | High | 8.8 | 2023-05-23 | OS command injection vulnerability in the mail setting page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versions prior to Ve… |
CVE-2023-27514 | High | 8.8 | 2023-05-23 | OS command injection vulnerability in the download page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versions prior to Ver.8… |
CVE-2023-32350 | High | 8.0 | 2023-05-22 | Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a Lua service. An at… |
CVE-2023-31756 | Medium | 6.7 | 2023-05-19 | A command injection vulnerability exists in the administrative web portal in TP-Link Archer VR1600V devices running firmware Versions <= 0.1.0. 0.9.1 v5006.0 B… |
CVE-2023-20164 | Medium | 6.5 | 2023-05-18 | Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform command injection attacks on the underlying o… |
CVE-2023-20163 | Medium | 6.5 | 2023-05-18 | Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform command injection attacks on the underlying o… |
CVE-2023-24805 | High | 8.8 | 2023-05-17 | cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. If you use… |
CVE-2023-1698 | Critical | 9.8 | 2023-05-15 | In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can resul… |
CVE-2020-13378 | High | 8.8 | 2023-05-12 | Loadbalancer.org Enterprise VA MAX through 8.3.8 has an OS Command Injection vulnerability that allows a remote authenticated attacker to execute arbitrary cod… |
CVE-2022-29841 | High | 8.0 | 2023-05-10 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that was caused by a command that read files from a pr… |
CVE-2023-32568 | High | 7.2 | 2023-05-10 | An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The VIOM web application does not validate user… |
CVE-2023-27407 | Critical | 9.9 | 2023-05-09 | A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web based management of affected device does not properly validate user inpu… |
CVE-2023-2574 | High | 8.8 | 2023-05-08 | Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the device name input field, which can be tri… |
CVE-2023-2573 | High | 8.8 | 2023-05-08 | Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the NTP server input field, which can be trig… |
CVE-2023-29944 | Critical | 9.8 | 2023-05-08 | Metersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution. The system command reverse-shell can be executed at the custom code snippet functi… |