CWE-78 · OS Command Injection (page 36)
Page 36 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-2564 | Critical | 10.0 | 2023-05-07 | OS Command Injection in GitHub repository sbs20/scanservjs prior to v2.27.0. |
CVE-2023-30054 | Critical | 9.8 | 2023-05-05 | TOTOLINK A7100RU V7.4cu.2313_B20191024 has a Command Injection vulnerability. An attacker can obtain a stable root shell through a specially constructed payloa… |
CVE-2023-30053 | Critical | 9.8 | 2023-05-05 | TOTOLINK A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection. |
CVE-2023-30013 | Critical | 9.8 | 2023-05-05 | TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability all… |
CVE-2023-2522 | Medium | 4.7 | 2023-05-04 | A vulnerability was found in Chengdu VEC40G 3.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /send… |
CVE-2023-24958 | High | 8.8 | 2023-05-04 | A vulnerability in the IBM TS7700 Management Interface 8.51.2.12, 8.52.200.111, 8.52.102.13, and 8.53.0.63 could allow an authenticated user to submit a specia… |
CVE-2023-27999 | High | 7.8 | 2023-05-03 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 7.2.0, 7.1.0 through 7.1.1 may allow an authenticated a… |
CVE-2023-25826 | Critical | 9.8 | 2023-05-03 | Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and exe… |
CVE-2023-28742 | High | 7.2 | 2023-05-03 | When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh. Note: Software versions which have reached En… |
CVE-2023-29778 | Critical | 9.8 | 2023-05-02 | GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread. |
CVE-2023-2479 | Critical | 9.8 | 2023-05-02 | OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4. |
CVE-2023-22919 | High | 8.8 | 2023-05-01 | The post-authentication command injection vulnerability in the Zyxel NBG6604 firmware version V1.01(ABIR.0)C0 could allow an authenticated attacker to execute… |
CVE-2023-30854 | High | 8.8 | 2023-04-28 | AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CloneSite/cloneClie… |
CVE-2023-28528 | High | 8.4 | 2023-04-28 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands… |
CVE-2023-29169 | High | 8.8 | 2023-04-27 | mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. |
CVE-2023-29150 | High | 8.8 | 2023-04-27 | mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. |
CVE-2023-28716 | High | 8.8 | 2023-04-27 | mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. |
CVE-2023-28400 | High | 8.8 | 2023-04-27 | mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. |
CVE-2023-28384 | High | 8.8 | 2023-04-27 | mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. |
CVE-2023-25313 | Critical | 9.8 | 2023-04-25 | OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to t… |
CVE-2023-28771 | Critical | 9.8 | 2023-04-25 | Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series… |
CVE-2023-30628 | High | 8.8 | 2023-04-24 | Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and prior, the `changelog.yml` workflow is v… |
CVE-2023-27991 | High | 8.8 | 2023-04-24 | The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware ve… |
CVE-2023-25507 | High | 7.2 | 2023-04-22 | NVIDIA DGX-1 BMC contains a vulnerability in the SPX REST API, where an attacker with the appropriate level of authorization can inject arbitrary shell command… |
CVE-2023-30621 | Critical | 9.8 | 2023-04-21 | Gipsy is a multi-purpose discord bot which aim to be as modular and user-friendly as possible. In versions prior to 1.3 users can run command on the host machi… |
CVE-2023-2131 | Critical | 10.0 | 2023-04-20 | Versions of INEA ME RTU firmware prior to 3.36 are vulnerable to OS command injection, which could allow an attacker to remotely execute arbitrary code. |
CVE-2023-25759 | Medium | 5.4 | 2023-04-19 | OS Command Injection in TripleData Reporting Engine in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated users to run unprivileged OS le… |
CVE-2023-29412 | Critical | 9.8 | 2023-04-18 | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote code execution… |
CVE-2023-25555 | Medium | 5.6 | 2023-04-18 | A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow a use… |
CVE-2023-25554 | High | 7.8 | 2023-04-18 | A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that allows a local privilege es… |
CVE-2023-28983 | High | 8.8 | 2023-04-17 | An OS Command Injection vulnerability in gRPC Network Operations Interface (gNOI) server module of Juniper Networks Junos OS Evolved allows an authenticated, l… |
CVE-2021-33990 | Critical | 9.8 | 2023-04-16 | Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor disputes this issue because the… |
CVE-2022-38841 | High | 8.8 | 2023-04-16 | Linksys AX3200 1.1.00 is vulnerable to OS command injection by authenticated users via shell metacharacters to the diagnostics traceroute page. |
CVE-2023-2091 | High | 7.8 | 2023-04-15 | A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS. Affected by this vulnerability is the function adjust_cpufreq_scalin… |
CVE-2023-29805 | Critical | 9.8 | 2023-04-14 | WFS-SR03 v1.0.3 was discovered to contain a command injection vulnerability via the pro_stor_canceltrans_handler_part_19 function. |
CVE-2023-29804 | High | 8.8 | 2023-04-14 | WFS-SR03 v1.0.3 was discovered to contain a command injection vulnerability via the sys_smb_pwdmod function. |
CVE-2023-27216 | High | 8.8 | 2023-04-12 | An issue found in D-Link DSL-3782 v.1.03 allows remote authenticated users to execute arbitrary code as root via the network settings page. |
CVE-2023-27826 | High | 8.8 | 2023-04-12 | SeowonIntech SWC 5100W WIMAX Bootloader 1.18.19.0, HW 0.0.7.0, and FW 1.11.0.1, 1.9.9.4 are vulnerable to OS Command Injection. which allows attackers to take… |
CVE-2022-43948 | Medium | 6.7 | 2023-04-11 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0.3, FortiADC version… |
CVE-2022-40679 | High | 7.8 | 2023-04-11 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 5.x all versions, 6.0 all versions, 6.1 all versions, 6… |
CVE-2023-27917 | High | 8.8 | 2023-04-11 | OS command injection vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker who can access Network Maintenance page to execute… |
CVE-2023-27076 | Critical | 9.8 | 2023-04-10 | Command injection vulnerability found in Tenda G103 v.1.0.0.5 allows attacker to execute arbitrary code via a the language parameter. |
CVE-2023-20153 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injectio… |
CVE-2023-20122 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in the restricted shell of Cisco Evolved Programmable Network Manager (EPNM), Cisco Identity Services Engine (ISE), and Cisco Prime In… |
CVE-2023-20121 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in the restricted shell of Cisco Evolved Programmable Network Manager (EPNM), Cisco Identity Services Engine (ISE), and Cisco Prime In… |
CVE-2023-20117 | High | 7.2 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticate… |
CVE-2023-20152 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injectio… |
CVE-2023-20128 | High | 7.2 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticate… |
CVE-2023-20023 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injectio… |
CVE-2023-20022 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injectio… |
CVE-2023-20021 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injectio… |
CVE-2023-26921 | Critical | 9.8 | 2023-04-04 | OS Command Injection vulnerability in quectel AG550QCN allows attackers to execute arbitrary commands via ql_atfwd. |
CVE-2023-28726 | High | 7.5 | 2023-03-31 | Panasonic AiSEG2 versions 2.80F through 2.93A allows remote attackers to execute arbitrary OS commands. |
CVE-2023-26482 | Critical | 9.0 | 2023-03-30 | Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are desig… |
CVE-2022-43647 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is… |
CVE-2022-43646 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is… |
CVE-2022-43645 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is… |
CVE-2022-43644 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is… |
CVE-2022-43643 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is… |
CVE-2022-43642 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is… |
CVE-2022-43633 | Medium | 6.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authenticati… |
CVE-2022-43632 | Medium | 6.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authenticati… |
CVE-2022-43631 | Medium | 6.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authenticati… |
CVE-2022-43629 | Medium | 6.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authenticati… |
CVE-2022-43628 | Medium | 6.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authenticati… |
CVE-2022-43627 | Medium | 6.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authenticati… |
CVE-2022-43626 | Medium | 6.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authenticati… |
CVE-2022-43624 | Medium | 6.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authenticati… |
CVE-2022-42433 | High | 8.0 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR841N TL-WR841N(US)_V14_220121 routers… |
CVE-2022-3210 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication i… |
CVE-2022-27647 | High | 8.0 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Although… |
CVE-2023-23355 | Medium | 6.6 | 2023-03-29 | An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated… |
CVE-2023-27886 | Critical | 9.8 | 2023-03-28 | Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated OS command injection vulnerability. This can be exploited to inject and execute arbitra… |
CVE-2023-27394 | Critical | 9.8 | 2023-03-28 | Osprey Pump Controller version 1.01 is vulnerable an unauthenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary… |
CVE-2023-28102 | High | 8.3 | 2023-03-27 | discordrb is an implementation of the Discord API using Ruby. In discordrb before commit `91e13043ffa` the `encoder.rb` file unsafely constructs a shell string… |
CVE-2023-28627 | High | 8.3 | 2023-03-27 | pymedusa is an automatic video library manager for TV Shows. In versions prior 1.0.12 an attacker with access to the web interface can update the git executabl… |
CVE-2023-24841 | High | 7.2 | 2023-03-27 | HGiga MailSherlock query function for connection log has a vulnerability of insufficient filtering for user input. An authenticated remote attacker with admini… |
CVE-2023-24837 | High | 8.8 | 2023-03-27 | HGiga PowerStation remote management function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can explo… |
CVE-2018-25083 | Critical | 9.8 | 2023-03-27 | The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name. |
CVE-2022-28495 | Critical | 9.8 | 2023-03-24 | TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx para… |
CVE-2023-20082 | Medium | 6.1 | 2023-03-23 | A vulnerability in Cisco IOS XE Software for Cisco Catalyst 9300 Series Switches could allow an authenticated, local attacker with level-15 privileges or an un… |
CVE-2023-20056 | Medium | 6.5 | 2023-03-23 | A vulnerability in the management CLI of Cisco access point (AP) software could allow an authenticated, local attacker to cause a denial of service (DoS) condi… |
CVE-2022-28491 | Critical | 9.8 | 2023-03-23 | TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 contains a command injection vulnerability in the NTPSyncWithHost function via the host_name parameter. This vul… |
CVE-2022-28494 | Critical | 9.8 | 2023-03-23 | TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setUpgradeFW function via the filename paramet… |
CVE-2022-37337 | Critical | 9.1 | 2023-03-21 | A command execution vulnerability exists in the access control functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted HTTP request can lead t… |
CVE-2023-28617 | High | 7.8 | 2023-03-19 | org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name… |
CVE-2023-25280 | Critical | 9.8 | 2023-03-16 | OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parame… |
CVE-2023-24229 | High | 7.8 | 2023-03-15 | DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system commands via the mai… |
CVE-2023-28343 | Critical | 9.8 | 2023-03-14 | OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, beca… |
CVE-2023-25617 | Critical | 9.0 | 2023-03-14 | SAP Business Object (Adaptive Job Server) - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects execution is enabled… |
CVE-2023-25279 | Critical | 9.8 | 2023-03-13 | OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload. |
CVE-2023-24762 | Critical | 9.8 | 2023-03-13 | OS Command injection vulnerability in D-Link DIR-867 DIR_867_FW1.30B07 allows attackers to execute arbitrary commands via a crafted LocalIPAddress parameter fo… |
CVE-2023-1350 | Medium | 6.3 | 2023-03-11 | A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the comp… |
CVE-2023-27985 | High | 7.8 | 2023-03-09 | emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of complia… |
CVE-2023-1277 | High | 7.8 | 2023-03-08 | A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin. Affected is the function InstallSnap of… |
CVE-2023-25395 | Critical | 9.8 | 2023-03-08 | TOTOlink A7100RU V7.4cu.2313_B20191024 router was discovered to contain a command injection vulnerability via the ou parameter at /setting/delStaticDhcpRules. |
CVE-2022-39951 | High | 7.2 | 2023-03-07 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version… |
CVE-2023-26490 | High | 7.3 | 2023-03-04 | mailcow is a dockerized email package, with multiple containers linked in one bridged network. The Sync Job feature - which can be made available to standard u… |
CVE-2023-26213 | High | 7.2 | 2023-03-03 | On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_… |
CVE-2023-20075 | Medium | 6.0 | 2023-03-01 | Vulnerability in the CLI of Cisco Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary commands. These vulnerability is d… |