CWE-78 · OS Command Injection (page 37)
Page 37 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-7093 | Medium | 5.3 | 2023-12-25 | A vulnerability classified as critical has been found in KylinSoft kylin-system-updater up to 2.0.5.16-0k2.33. Affected is an unknown function of the file /usr… |
CVE-2023-7002 | High | 7.2 | 2023-12-23 | The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vuln… |
CVE-2023-51035 | Critical | 9.8 | 2023-12-22 | TOTOLINK EX1200L V9.3.5u.6146_B20201023 is vulnerable to arbitrary command execution on the cstecgi.cgi NTPSyncWithHost interface. |
CVE-2023-51033 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1200L V9.3.5u.6146_B20201023 is vulnerable to arbitrary command execution via the cstecgi.cgi setOpModeCfg interface. |
CVE-2023-50147 | Critical | 9.8 | 2023-12-22 | There is an arbitrary command execution vulnerability in the setDiagnosisCfg function of the cstecgi .cgi of the TOTOlink A3700R router device in its firmware… |
CVE-2023-51028 | Critical | 9.8 | 2023-12-22 | TOTOLINK EX1800T 9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the apcliChannel parameter of the setWiFiExtenderConfig in… |
CVE-2023-50993 | Critical | 9.8 | 2023-12-20 | Ruijie WS6008 v1.x v2.x AC_RGOS11.9(6)W3B2_G2C6-01_10221911 and WS6108 v1.x AC_RGOS11.9(6)W3B2_G2C6-01_10221911 was discovered to contain a command injection v… |
CVE-2023-35895 | Medium | 6.3 | 2023-12-20 | IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API… |
CVE-2023-0011 | High | 7.6 | 2023-12-20 | A flaw in the input validation in TOBY-L2 allows a user to execute arbitrary operating system commands using specifically crafted AT commands. This vulnerabili… |
CVE-2023-50466 | High | 8.8 | 2023-12-19 | An authenticated command injection vulnerability in Weintek cMT2078X easyweb Web Version v2.1.3, OS v20220215 allows attackers to execute arbitrary code or acc… |
CVE-2019-25158 | Medium | 5.5 | 2023-12-19 | A vulnerability has been found in pedroetb tts-api up to 2.1.4 and classified as critical. This vulnerability affects the function onSpeechDone of the file app… |
CVE-2023-51385 | Medium | 6.5 | 2023-12-18 | In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansio… |
CVE-2023-6901 | High | 7.3 | 2023-12-17 | A vulnerability, which was classified as critical, was found in codelyfe Stupid Simple CMS up to 1.2.3. This affects an unknown part of the file /terminal/hand… |
CVE-2023-6895 | Medium | 6.3 | 2023-12-17 | A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects u… |
CVE-2021-42796 | Critical | 9.8 | 2023-12-16 | An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticated arbitrary command… |
CVE-2023-48380 | High | 7.4 | 2023-12-15 | Softnext Mail SQR Expert is an email management platform, it has insufficient filtering for a special character within a spcific function. A remote attacker au… |
CVE-2023-48668 | High | 8.2 | 2023-12-14 | Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 on DDMC contain an OS command injection vulnerability in an admin op… |
CVE-2023-48667 | High | 7.2 | 2023-12-14 | Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in administrator CLI… |
CVE-2023-48665 | High | 7.2 | 2023-12-14 | Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit… |
CVE-2023-48664 | High | 7.2 | 2023-12-14 | Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit… |
CVE-2023-48663 | High | 7.2 | 2023-12-14 | Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit… |
CVE-2023-48662 | High | 7.2 | 2023-12-14 | Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit… |
CVE-2023-44279 | Medium | 6.7 | 2023-12-14 | Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in administrator CLI… |
CVE-2023-44277 | High | 7.8 | 2023-12-14 | Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in the CLI. A local lo… |
CVE-2023-6795 | Medium | 5.5 | 2023-12-13 | An OS command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to disrupt system processes and potentially… |
CVE-2023-6792 | Medium | 5.5 | 2023-12-13 | An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and po… |
CVE-2023-42495 | Critical | 9.8 | 2023-12-13 | Dasan Networks - W-Web versions 1.22-1.27 - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
CVE-2023-48782 | High | 8.8 | 2023-12-13 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 allows attacker t… |
CVE-2023-40716 | Medium | 6.7 | 2023-12-13 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiTester 2.3.0 through 7.2.3… |
CVE-2023-46454 | Critical | 9.8 | 2023-12-12 | In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information… |
CVE-2023-49692 | High | 7.2 | 2023-12-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2D… |
CVE-2023-49691 | High | 7.2 | 2023-12-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2023-48428 | High | 7.2 | 2023-12-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The radius configuration mechanism of affected products does not correctly… |
CVE-2023-49695 | Medium | 6.8 | 2023-12-12 | OS command injection vulnerability in WRC-X3000GSN v1.0.2, WRC-X3000GS v1.0.24 and earlier, and WRC-X3000GSA v1.0.24 and earlier allows a network-adjacent atta… |
CVE-2022-48616 | Medium | 6.4 | 2023-12-12 | A Huawei data communication product has a command injection vulnerability. Successful exploitation of this vulnerability may allow attackers to gain higher pri… |
CVE-2023-47254 | Critical | 9.8 | 2023-12-09 | An OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote attackers to execute arbitrary system commands and escalate privi… |
CVE-2023-6612 | Medium | 5.5 | 2023-12-08 | A vulnerability was found in Totolink X5000R 9.1.0cu.2300_B20230112. It has been rated as critical. This issue affects the function setDdnsCfg/setDynamicRoute/… |
CVE-2023-47565 | High | 8.0 | 2023-12-08 | An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could a… |
CVE-2023-46157 | High | 8.8 | 2023-12-08 | File-Manager in MGT CloudPanel 2.0.0 through 2.3.2 allows the lowest privilege user to achieve OS command injection by changing file ownership and changing fil… |
CVE-2023-43744 | High | 7.2 | 2023-12-08 | An OS command injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.0… |
CVE-2023-49897 | High | 8.8 | 2023-12-06 | An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerabilit… |
CVE-2023-44221 | High | 7.2 | 2023-12-05 | Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to… |
CVE-2023-6357 | High | 8.8 | 2023-12-05 | A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker… |
CVE-2023-24046 | Medium | 6.8 | 2023-12-04 | An issue was discovered on Connectize AC21000 G6 641.139.1.1256 allows attackers to run arbitrary commands via use of a crafted string in the ping utility. |
CVE-2023-48800 | Critical | 9.8 | 2023-12-04 | In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_417338 function obtains fields from the front-end, connects them through the snprintf f… |
CVE-2023-44304 | High | 8.8 | 2023-12-04 | Dell DM5500 contains a privilege escalation vulnerability in the appliance. A remote attacker with low privileges could potentially exploit this vulnerabili… |
CVE-2023-44291 | High | 7.2 | 2023-12-04 | Dell DM5500 5.14.0.0 contains an OS command injection vulnerability in the appliance. A remote attacker with high privileges could potentially exploit this… |
CVE-2023-48842 | Critical | 9.8 | 2023-12-01 | D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at hedwig.cgi. |
CVE-2023-48812 | Critical | 9.8 | 2023-11-30 | In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function that when p… |
CVE-2023-48811 | Critical | 9.8 | 2023-11-30 | In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function that when… |
CVE-2023-48810 | Critical | 9.8 | 2023-11-30 | In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passe… |
CVE-2023-48808 | Critical | 9.8 | 2023-11-30 | In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passe… |
CVE-2023-48807 | Critical | 9.8 | 2023-11-30 | In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passe… |
CVE-2023-48806 | Critical | 9.8 | 2023-11-30 | In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passe… |
CVE-2023-48805 | Critical | 9.8 | 2023-11-30 | In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passe… |
CVE-2023-48804 | Critical | 9.8 | 2023-11-30 | In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passe… |
CVE-2023-48803 | Critical | 9.8 | 2023-11-30 | In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passe… |
CVE-2023-48802 | Critical | 9.8 | 2023-11-30 | In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passe… |
CVE-2023-4474 | Critical | 9.8 | 2023-11-30 | The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG… |
CVE-2023-4473 | Critical | 9.8 | 2023-11-30 | A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could al… |
CVE-2023-37928 | High | 8.8 | 2023-11-30 | A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.2… |
CVE-2023-37927 | High | 8.8 | 2023-11-30 | The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG… |
CVE-2023-35138 | Critical | 9.8 | 2023-11-30 | A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware versi… |
CVE-2023-3741 | Critical | 9.8 | 2023-11-30 | An OS Command injection vulnerability in NEC Platforms DT900 and DT900S Series all versions allows an attacker to execute any command on the device. |
CVE-2023-23325 | Critical | 9.8 | 2023-11-29 | Zumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain a command injection vulnerability via the NetHostname parameter. |
CVE-2023-6201 | High | 8.8 | 2023-11-28 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Univera Computer System Panorama allows Command Inj… |
CVE-2023-4222 | High | 7.2 | 2023-11-28 | Command injection in `main/lp/openoffice_text_document.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote c… |
CVE-2023-4221 | High | 7.2 | 2023-11-28 | Command injection in `main/lp/openoffice_presentation.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote co… |
CVE-2023-3368 | Critical | 9.8 | 2023-11-28 | Command injection in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution… |
CVE-2023-6309 | Medium | 5.5 | 2023-11-27 | A vulnerability, which was classified as critical, was found in moses-smt mosesdecoder up to 4.0. This affects an unknown part of the file contrib/iSenWeb/tran… |
CVE-2023-6304 | High | 7.2 | 2023-11-27 | A vulnerability was found in Tecno 4G Portable WiFi TR118 TR118-M30E-RR-D-EnFrArSwHaPo-OP-V008-20220830. It has been declared as critical. This vulnerability a… |
CVE-2023-4149 | Critical | 9.8 | 2023-11-21 | A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system commands and gain full system control. Those c… |
CVE-2023-35762 | Critical | 9.9 | 2023-11-20 | Versions of INEA ME RTU firmware 3.36b and prior are vulnerable to operating system (OS) command injection, which could allow remote code execution. |
CVE-2023-47675 | High | 7.2 | 2023-11-17 | CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command. |
CVE-2023-6019 | Critical | 9.8 | 2023-11-16 | A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely witho… |
CVE-2023-6018 | Critical | 9.8 | 2023-11-16 | An attacker can overwrite any file on the server hosting MLflow without any authentication. |
CVE-2023-43752 | High | 8.0 | 2023-11-16 | OS command injection vulnerability in WRC-X3000GS2-W v1.05 and earlier, WRC-X3000GS2-B v1.05 and earlier, and WRC-X3000GS2A-B v1.05 and earlier allows a networ… |
CVE-2023-36553 | Critical | 9.8 | 2023-11-14 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 5.4.0 and 5.3.0 through 5.3.3 and 5… |
CVE-2023-5037 | High | 7.2 | 2023-11-13 | badmonkey, a Security Researcher has found a flaw that allows for a authenticated command injection on the camera. An attacker could inject malicious into requ… |
CVE-2023-39295 | High | 8.8 | 2023-11-10 | An OS command injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to execute commands… |
CVE-2023-23367 | Medium | 4.7 | 2023-11-10 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2023-26156 | Medium | 5.6 | 2023-11-09 | Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This… |
CVE-2023-4249 | High | 8.8 | 2023-11-08 | Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 has a command in… |
CVE-2023-23369 | Critical | 9.0 | 2023-11-03 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2023-23368 | Critical | 9.8 | 2023-11-03 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2023-41352 | High | 7.2 | 2023-11-03 | Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege can exploit this v… |
CVE-2023-41348 | High | 8.8 | 2023-11-03 | ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its code-authentication module. An au… |
CVE-2023-41347 | High | 8.8 | 2023-11-03 | ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its check token module. An authentica… |
CVE-2023-41346 | High | 8.8 | 2023-11-03 | ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenti… |
CVE-2023-41345 | High | 8.8 | 2023-11-03 | ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module. An authen… |
CVE-2023-20219 | High | 7.2 | 2023-11-01 | Multiple vulnerabilities in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to e… |
CVE-2023-20175 | High | 8.8 | 2023-11-01 | A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the underlying operati… |
CVE-2023-20170 | Medium | 6.0 | 2023-11-01 | A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the underlying operati… |
CVE-2023-43139 | Critical | 9.8 | 2023-10-31 | An issue in franfinance before v.2.0.27 allows a remote attacker to execute arbitrary code via the validation.php, and controllers/front/validation.php compone… |
CVE-2023-47104 | Critical | 9.8 | 2023-10-30 | tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign) in titles, messages, and other input d… |
CVE-2023-46510 | Critical | 9.8 | 2023-10-27 | An issue in ZIONCOM (Hong Kong) Technology Limited A7000R v.4.1cu.4154 allows an attacker to execute arbitrary code via the cig-bin/cstecgi.cgi to the settings… |
CVE-2018-17879 | Critical | 9.8 | 2023-10-26 | An issue was discovered on certain ABUS TVIP cameras. The CGI scripts allow remote attackers to execute code via system() as root. There are several injection… |
CVE-2018-17558 | Critical | 9.8 | 2023-10-26 | Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVIP TVIP20050 LM.1.6.18, TVIP10051 LM.1.6… |
CVE-2023-43208 | Critical | 9.8 | 2023-10-26 | NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the inc… |
CVE-2023-20273 | High | 7.2 | 2023-10-25 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. Th… |