CWE-78 · OS Command Injection (page 37)
Page 37 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-26759 | High | 8.8 | 2023-02-27 | Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an OS command injection vulnerability via calls made to the XMService component. |
CVE-2022-2024 | Critical | 9.8 | 2023-02-25 | OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11. |
CVE-2023-26039 | High | 7.1 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2022-36231 | Critical | 9.8 | 2023-02-23 | pdf_info 0.5.3 is vulnerable to Command Execution because the Ruby code uses backticks instead of Open3. |
CVE-2023-20050 | Medium | 4.4 | 2023-02-23 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2023-20015 | Medium | 6.0 | 2023-02-23 | A vulnerability in the CLI of Cisco Firepower 4100 Series, Cisco Firepower 9300 Security Appliances, and Cisco UCS 6200, 6300, 6400, and 6500 Series Fabric Int… |
CVE-2023-0935 | Medium | 6.3 | 2023-02-21 | A vulnerability was found in DolphinPHP up to 1.5.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file c… |
CVE-2022-48337 | Critical | 9.8 | 2023-02-20 | GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system… |
CVE-2022-46303 | High | 8.0 | 2023-02-20 | Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management per… |
CVE-2023-23779 | Medium | 6.8 | 2023-02-16 | Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in FortiWeb version 7.0.1 and belo… |
CVE-2022-33869 | High | 8.8 | 2023-02-16 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiWAN 4.0.0 through 4.5.9 may all… |
CVE-2022-30303 | High | 8.8 | 2023-02-16 | An improper neutralization of special elements used in an os command ('OS Command Injection') [CWE-78] in FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6… |
CVE-2022-27489 | High | 7.2 | 2023-02-16 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.0.0 through 7.0.3, 5.3.2, 4.2.4 and be… |
CVE-2022-27482 | High | 7.8 | 2023-02-16 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.1, 6.2.0 through 6… |
CVE-2023-0861 | High | 7.2 | 2023-02-16 | NetModule NSRW web administration interface executes an OS command constructed with unsanitized user input. A successful exploit could allow an authenticated u… |
CVE-2023-0830 | Medium | 6.3 | 2023-02-14 | A vulnerability classified as critical has been found in EasyNAS 1.1.0. Affected is the function system of the file /backup.pl. The manipulation leads to os co… |
CVE-2023-20076 | High | 7.2 | 2023-02-12 | A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the und… |
CVE-2022-45104 | High | 8.8 | 2023-02-11 | Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain a command execution vulnerability. A low privileged re… |
CVE-2022-34447 | High | 7.2 | 2023-02-11 | PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains OS Command Injection vulnerability. An authenticated remote attacker with adminis… |
CVE-2023-24816 | Medium | 4.5 | 2023-02-10 | IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming la… |
CVE-2022-46649 | High | 8.8 | 2023-02-10 | Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the… |
CVE-2022-45699 | Critical | 9.8 | 2023-02-10 | Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as roo… |
CVE-2022-43550 | Critical | 9.8 | 2023-02-09 | A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows which could allow a… |
CVE-2022-45768 | High | 8.8 | 2023-02-07 | Command Injection vulnerability in Edimax Technology Co., Ltd. Wireless Router N300 Firmware BR428nS v3 allows attacker to execute arbitrary code via the formW… |
CVE-2022-43758 | High | 7.6 | 2023-02-07 | A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SUSE Rancher allows code execution for user with… |
CVE-2022-31249 | High | 7.5 | 2023-02-07 | A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in wrangler of SUSE Rancher allows remote attackers… |
CVE-2023-22643 | Medium | 6.3 | 2023-02-07 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in libzypp-plugin-appdata of SUSE Linux Enterprise… |
CVE-2022-38547 | High | 7.2 | 2023-02-07 | A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN series firmware ve… |
CVE-2022-25855 | High | 7.4 | 2023-02-06 | All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization. |
CVE-2022-25853 | High | 7.4 | 2023-02-06 | All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization. |
CVE-2022-46552 | High | 8.8 | 2023-02-02 | D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist parameter. This vu… |
CVE-2023-23076 | Critical | 9.8 | 2023-02-01 | OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules. |
CVE-2023-23692 | High | 8.8 | 2023-02-01 | Dell EMC prior to version DDOS 7.9 contain(s) an OS command injection Vulnerability. An authenticated non admin attacker could potentially exploit this vulner… |
CVE-2022-25916 | High | 7.4 | 2023-02-01 | Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function. |
CVE-2022-25906 | High | 7.4 | 2023-02-01 | All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the… |
CVE-2022-21129 | High | 7.4 | 2023-01-31 | Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function… |
CVE-2022-42484 | Critical | 9.8 | 2023-01-30 | An OS command injection vulnerability exists in the httpd logs/view.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP request can lead to arbit… |
CVE-2022-48108 | Critical | 9.8 | 2023-01-27 | D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /SetNetworkSettings/SubnetMask. This vulnerability allow… |
CVE-2022-48107 | Critical | 9.8 | 2023-01-27 | D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /setnetworksettings/IPAddress. This vulnerability allows… |
CVE-2022-48072 | High | 7.8 | 2023-01-27 | Phicomm K2G v22.6.3.20 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function. |
CVE-2022-48070 | High | 7.8 | 2023-01-27 | Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function. |
CVE-2022-48069 | High | 7.5 | 2023-01-27 | Totolink A830R V4.1.2cu.5182 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter. |
CVE-2022-42493 | Critical | 9.8 | 2023-01-26 | Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network request can lea… |
CVE-2022-42492 | Critical | 9.8 | 2023-01-26 | Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network request can lea… |
CVE-2022-42491 | Critical | 9.8 | 2023-01-26 | Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network request can lea… |
CVE-2022-42490 | Critical | 9.8 | 2023-01-26 | Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network request can lea… |
CVE-2022-40969 | High | 8.8 | 2023-01-26 | An os command injection vulnerability exists in the httpd delfile.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP req… |
CVE-2022-40222 | Critical | 9.8 | 2023-01-26 | An OS command injection vulnerability exists in the m2m DELETE_FILE cmd functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted networ… |
CVE-2022-40220 | High | 8.8 | 2023-01-26 | An OS command injection vulnerability exists in the httpd txt/restore.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted netw… |
CVE-2022-38066 | High | 8.8 | 2023-01-26 | An OS command injection vulnerability exists in the httpd SNMP functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP response c… |
CVE-2023-24422 | High | 8.8 | 2023-01-26 | A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission t… |
CVE-2022-29843 | Medium | 6.2 | 2023-01-26 | A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows… |
CVE-2022-25962 | High | 7.4 | 2023-01-26 | All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization. |
CVE-2022-25908 | High | 7.4 | 2023-01-26 | All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization. |
CVE-2022-25860 | High | 8.1 | 2023-01-26 | Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to… |
CVE-2022-25350 | High | 7.4 | 2023-01-26 | All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization. |
CVE-2022-21810 | High | 7.4 | 2023-01-26 | All versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization. |
CVE-2022-40720 | High | 8.8 | 2023-01-26 | This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication i… |
CVE-2022-40719 | High | 8.8 | 2023-01-26 | This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication i… |
CVE-2022-45639 | High | 7.8 | 2023-01-24 | OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter. NOTE: th… |
CVE-2022-37718 | High | 8.8 | 2023-01-23 | The management portal component of JetNexus/EdgeNexus ADC 4.2.8 was discovered to contain a command injection vulnerability. This vulnerability allows authenti… |
CVE-2022-48126 | Critical | 9.8 | 2023-01-20 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the username parameter in the setting/setOpenVpnCertGene… |
CVE-2022-48125 | Critical | 9.8 | 2023-01-20 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the password parameter in the setting/setOpenVpnCertGene… |
CVE-2022-48124 | Critical | 9.8 | 2023-01-20 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the FileName parameter in the setting/setOpenVpnCertGene… |
CVE-2022-48123 | Critical | 9.8 | 2023-01-20 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the servername parameter in the setting/delStaticDhcpRul… |
CVE-2022-48122 | Critical | 9.8 | 2023-01-20 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the dayvalid parameter in the setting/delStaticDhcpRules… |
CVE-2022-48121 | Critical | 9.8 | 2023-01-20 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the rsabits parameter in the setting/delStaticDhcpRules… |
CVE-2023-23596 | High | 8.8 | 2023-01-20 | jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with crafted username an… |
CVE-2023-20007 | Medium | 4.7 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an auth… |
CVE-2022-20964 | Medium | 6.3 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to inject arbitrary comma… |
CVE-2022-46476 | Critical | 9.8 | 2023-01-19 | D-Link DIR-859 A1 1.05 was discovered to contain a command injection vulnerability via the service= variable in the soapcgi_main function. |
CVE-2023-0164 | High | 8.8 | 2023-01-18 | OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server. This is possible because the application inje… |
CVE-2022-47911 | Critical | 9.1 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup… |
CVE-2022-43483 | Critical | 9.1 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the monitor… |
CVE-2022-2251 | Medium | 4.8 | 2023-01-17 | Improper sanitization of branch names in GitLab Runner affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user who… |
CVE-2022-47853 | Critical | 9.8 | 2023-01-17 | TOTOlink A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection Vulnerability in the httpd service. An attacker can obtain a stable root shell throug… |
CVE-2023-22304 | High | 8.0 | 2023-01-17 | OS command injection vulnerability in PIX-RT100 versions RT100_TEQ_2.1.1_EQ101 and RT100_TEQ_2.1.2_EQ101 allows a network-adjacent attacker who can access prod… |
CVE-2023-22280 | High | 7.2 | 2023-01-17 | MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/… |
CVE-2023-22279 | Critical | 9.8 | 2023-01-17 | MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/… |
CVE-2022-41955 | High | 8.8 | 2023-01-14 | Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded p… |
CVE-2022-21191 | High | 7.4 | 2023-01-13 | Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes be… |
CVE-2022-42290 | High | 7.2 | 2023-01-13 | NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial… |
CVE-2022-42289 | High | 7.2 | 2023-01-13 | NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial… |
CVE-2022-42279 | High | 7.2 | 2023-01-13 | NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial… |
CVE-2023-22598 | High | 7.2 | 2023-01-12 | InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-78: Im… |
CVE-2022-48252 | Critical | 9.8 | 2023-01-11 | The jokob-sk/Pi.Alert fork (before 22.12.20) of Pi.Alert allows Remote Code Execution via nmap_scan.php (scan parameter) OS Command Injection. |
CVE-2022-43390 | Medium | 5.4 | 2023-01-11 | A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to execute… |
CVE-2022-43973 | High | 7.2 | 2023-01-09 | An arbitrary code execution vulnerability exisits in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. The Check_TSSI function within t… |
CVE-2022-43971 | High | 7.2 | 2023-01-09 | An arbitrary code exection vulnerability exists in Linksys WUMC710 Wireless-AC Universal Media Connector with firmware <= 1.0.02 (build3). The do_setNTP functi… |
CVE-2022-36926 | High | 8.8 | 2023-01-09 | Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerabi… |
CVE-2022-25890 | High | 7.4 | 2023-01-09 | All versions of the package wifey are vulnerable to Command Injection via the connect() function due to improper input sanitization. |
CVE-2022-44149 | High | 8.8 | 2023-01-06 | The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host fiel… |
CVE-2022-25923 | High | 7.4 | 2023-01-06 | Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess() functionality due to improper user-input sanitizat… |
CVE-2022-44877 | Critical | 9.8 | 2023-01-05 | login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metac… |
CVE-2022-43538 | High | 7.2 | 2023-01-05 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2022-43537 | High | 7.2 | 2023-01-05 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2022-43536 | High | 7.2 | 2023-01-05 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2022-25926 | High | 7.4 | 2023-01-04 | Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanitization. |
CVE-2022-39947 | High | 8.8 | 2023-01-03 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.2, FortiADC version… |
CVE-2022-35845 | High | 7.8 | 2023-01-03 | Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in FortiTester 7.1.0, 7.0 all vers… |