CWE-78 · OS Command Injection (page 38)
Page 38 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-33839 | High | 7.2 | 2023-10-23 | IBM Security Verify Governance 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted requ… |
CVE-2023-43066 | Medium | 5.1 | 2023-10-23 | Dell Unity prior to 5.3 contains a Restricted Shell Bypass vulnerability. This could allow an authenticated, local attacker to exploit this vulnerability by a… |
CVE-2023-28805 | Medium | 6.7 | 2023-10-23 | An Improper Input Validation vulnerability in Zscaler Client Connector on Linux allows Privilege Escalation. This issue affects Client Connector: before 1.4.0… |
CVE-2023-46306 | High | 8.4 | 2023-10-22 | The web administration interface in NetModule Router Software (NRSW) 4.6 before 4.6.0.106 and 4.8 before 4.8.0.101 executes an OS command constructed with unsa… |
CVE-2023-5684 | Medium | 4.7 | 2023-10-21 | A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231012. It has been declared as critical. Affected by this vulnerability is an unkno… |
CVE-2023-5683 | Medium | 6.3 | 2023-10-21 | A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231010 and classified as critical. This issue affects some unknown processing of the… |
CVE-2023-46117 | High | 8.8 | 2023-10-20 | reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities… |
CVE-2023-23373 | High | 8.8 | 2023-10-20 | An OS command injection vulnerability has been reported to affect QUSBCam2. If exploited, the vulnerability could allow users to execute commands via a network… |
CVE-2023-40145 | High | 8.8 | 2023-10-19 | In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device. |
CVE-2023-43959 | High | 8.8 | 2023-10-17 | An issue in YeaLinkSIP-T19P-E2 v.53.84.0.15 allows a remote privileged attacker to execute arbitrary code via a crafted request the ping function of the diagno… |
CVE-2023-3991 | Critical | 10.0 | 2023-10-16 | An OS command injection vulnerability exists in the httpd iperfrun.cgi functionality of FreshTomato 2023.3. A specially crafted HTTP request can lead to arbitr… |
CVE-2023-45158 | Critical | 9.8 | 2023-10-16 | An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default… |
CVE-2023-21413 | Critical | 9.1 | 2023-10-16 | GoSecure on behalf of Genetec Inc. has found a flaw that allows for a remote code execution during the installation of ACAP applications on the Axis device. Th… |
CVE-2023-26155 | High | 7.3 | 2023-10-14 | All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize its parameter input… |
CVE-2023-34975 | Medium | 6.6 | 2023-10-13 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2023-32976 | Medium | 6.6 | 2023-10-13 | An OS command injection vulnerability has been reported to affect Container Station. If exploited, the vulnerability could allow authenticated administrators t… |
CVE-2023-45467 | Critical | 9.8 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ntpServIP parameter in the Time Settings. |
CVE-2023-35194 | High | 7.2 | 2023-10-11 | An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HT… |
CVE-2023-35193 | High | 7.2 | 2023-10-11 | An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HT… |
CVE-2023-34356 | High | 7.2 | 2023-10-11 | An OS command injection vulnerability exists in the data.cgi xfer_dns functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request… |
CVE-2023-28381 | High | 7.2 | 2023-10-11 | An OS command injection vulnerability exists in the admin.cgi MVPN_trial_init functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP… |
CVE-2023-27380 | High | 7.2 | 2023-10-11 | An OS command injection vulnerability exists in the admin.cgi USSD_send functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP reque… |
CVE-2023-42788 | High | 7.8 | 2023-10-10 | An improper neutralization of special elements used in an os command ('OS Command Injection') vulnerability [CWE-78] in FortiManager & FortiAnalyzer version 7… |
CVE-2023-41838 | High | 7.1 | 2023-10-10 | An improper neutralization of special elements used in an os command ('os command injection') in FortiManager 7.4.0 and 7.2.0 through 7.2.3 may allow attacker… |
CVE-2023-36550 | Critical | 9.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-36549 | High | 8.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-36548 | Critical | 9.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-36547 | Critical | 9.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-34993 | Critical | 9.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-34992 | Critical | 10.0 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized… |
CVE-2023-34989 | High | 8.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-34988 | High | 8.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-34987 | High | 8.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-34986 | High | 8.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-34985 | High | 8.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-25607 | High | 7.8 | 2023-10-10 | An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78 ] in FortiManager 7.2.0 through 7.2.2, 7.0… |
CVE-2022-22298 | Medium | 6.7 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiIsolator version 1.0.0, FortiIsolator version 1.1… |
CVE-2023-5494 | Medium | 6.3 | 2023-10-10 | A vulnerability was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928 and classified as critical. Affected… |
CVE-2023-30806 | Critical | 9.8 | 2023-10-10 | The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated… |
CVE-2023-30805 | Critical | 9.8 | 2023-10-10 | The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated… |
CVE-2023-26153 | High | 8.3 | 2023-10-06 | Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie. T… |
CVE-2023-4401 | High | 7.8 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contains an OS Command Injection Vulnerability in the CLI use of the ‘more’ command. A local or remote au… |
CVE-2023-43069 | High | 7.8 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contain(s) an OS Command Injection Vulnerability in the CLI. An authenticated local attacker could potent… |
CVE-2023-43068 | High | 7.8 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contains an OS Command Injection Vulnerability in the restricted shell in SSH. An authenticated remote at… |
CVE-2023-36618 | High | 8.8 | 2023-10-04 | Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of OS commands as root user by low-privileged authenticated users. |
CVE-2023-33273 | Critical | 9.8 | 2023-10-03 | An issue was discovered in DTS Monitoring 3.57.0. The parameter url within the WGET check function is vulnerable to OS command injection (blind). |
CVE-2023-33272 | Critical | 9.8 | 2023-10-03 | An issue was discovered in DTS Monitoring 3.57.0. The parameter ip within the Ping check function is vulnerable to OS command injection (blind). |
CVE-2023-33271 | Critical | 9.8 | 2023-10-03 | An issue was discovered in DTS Monitoring 3.57.0. The parameter common_name within the SSL Certificate check function is vulnerable to OS command injection (bl… |
CVE-2023-33270 | Critical | 9.8 | 2023-10-03 | An issue was discovered in DTS Monitoring 3.57.0. The parameter url within the Curl check function is vulnerable to OS command injection (blind). |
CVE-2023-33269 | Critical | 9.8 | 2023-10-03 | An issue was discovered in DTS Monitoring 3.57.0. The parameter options within the WGET check function is vulnerable to OS command injection (blind). |
CVE-2023-33268 | Critical | 9.8 | 2023-10-03 | An issue was discovered in DTS Monitoring 3.57.0. The parameter port within the SSL Certificate check function is vulnerable to OS command injection (blind). |
CVE-2023-39222 | High | 8.8 | 2023-10-03 | OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command that is… |
CVE-2023-43893 | Critical | 9.8 | 2023-10-02 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the wakeup_mac parameter in the Wake-On-LAN (WoL) function. This vulnera… |
CVE-2023-43892 | Critical | 9.8 | 2023-10-02 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the Hostname parameter within the WAN settings. This vulnerability is ex… |
CVE-2023-43890 | High | 8.8 | 2023-10-02 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the diagnostic tools page. This vulnerability is exploited via a crafted… |
CVE-2023-5301 | Medium | 4.7 | 2023-09-30 | A vulnerability classified as critical was found in DedeCMS 5.7.111. This vulnerability affects the function AddMyAddon of the file album_add.php. The manipula… |
CVE-2023-26145 | High | 7.4 | 2023-09-28 | This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept… |
CVE-2023-44080 | Critical | 9.8 | 2023-09-27 | An issue in PGYER codefever v.2023.8.14-2ce4006 allows a remote attacker to execute arbitrary code via a crafted request to the branchList component. |
CVE-2023-20231 | High | 8.8 | 2023-09-27 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device… |
CVE-2023-3767 | Critical | 9.8 | 2023-09-27 | An OS command injection vulnerability has been found on EasyPHP Webserver affecting version 14.1. This vulnerability could allow an attacker to get full acces… |
CVE-2023-40581 | High | 8.3 | 2023-09-25 | yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its d… |
CVE-2023-43130 | Critical | 9.8 | 2023-09-22 | D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection. |
CVE-2023-43129 | Critical | 9.8 | 2023-09-22 | D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of REMOTE_PORT parameters. |
CVE-2023-5002 | Medium | 6.0 | 2023-09-22 | A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_d… |
CVE-2022-3874 | High | 8.0 | 2023-09-22 | A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands throu… |
CVE-2023-23362 | High | 8.8 | 2023-09-22 | An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to… |
CVE-2023-0118 | Critical | 9.1 | 2023-09-20 | An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underl… |
CVE-2023-38886 | High | 7.2 | 2023-09-20 | An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script. |
CVE-2022-47555 | Critical | 9.3 | 2023-09-19 | Operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users with elevated priv… |
CVE-2023-35850 | High | 7.2 | 2023-09-18 | SUNNET WMPro portal's file management function has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege or… |
CVE-2023-28614 | Critical | 9.8 | 2023-09-15 | Freewill iFIS (aka SMART Trade) 20.01.01.04 allows OS Command Injection via shell metacharacters to a report page. |
CVE-2023-36642 | Medium | 6.7 | 2023-09-13 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiTester 3.0.0 through 7.2.3 may… |
CVE-2022-35849 | High | 7.8 | 2023-09-13 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiADC 7.1.0 through 7.1.1, 7.0.0… |
CVE-2023-39780 | High | 8.8 | 2023-09-11 | On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: f… |
CVE-2023-4873 | Medium | 6.3 | 2023-09-10 | A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230906… |
CVE-2023-20193 | Medium | 6.0 | 2023-09-07 | A vulnerability in the Embedded Service Router (ESR) of Cisco ISE could allow an authenticated, local attacker to read, write, or delete arbitrary files on the… |
CVE-2023-39237 | High | 8.8 | 2023-09-07 | ASUS RT-AC86U Traffic Analyzer - Apps analysis function has insufficient filtering of special character. A remote attacker with regular user privilege can exp… |
CVE-2023-39236 | High | 8.8 | 2023-09-07 | ASUS RT-AC86U Traffic Analyzer - Statistic function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit… |
CVE-2023-38033 | High | 8.8 | 2023-09-07 | ASUS RT-AC86U unused Traffic Analyzer legacy Statistic function has insufficient filtering of special character. A remote attacker with regular user privilege… |
CVE-2023-38032 | High | 8.8 | 2023-09-07 | ASUS RT-AC86U AiProtection security- related function has insufficient filtering of special character. A remote attacker with regular user privilege can explo… |
CVE-2023-38031 | High | 8.8 | 2023-09-07 | ASUS RT-AC86U Adaptive QoS - Web History function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit t… |
CVE-2021-36023 | Critical | 9.1 | 2023-09-06 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Upd… |
CVE-2023-41149 | Critical | 9.8 | 2023-09-06 | F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. If this vulnerability is exploited, an attacker who can access the prod… |
CVE-2023-40531 | High | 8.0 | 2023-09-06 | Archer AX6000 firmware versions prior to 'Archer AX6000(JP)_V1_1.3.0 Build 20221208' allows a network-adjacent authenticated attacker to execute arbitrary OS c… |
CVE-2023-40357 | High | 8.0 | 2023-09-06 | Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer A… |
CVE-2023-40193 | High | 8.0 | 2023-09-06 | Deco M4 firmware versions prior to 'Deco M4(JP)_V2_1.5.8 Build 20230619' allows a network-adjacent authenticated attacker to execute arbitrary OS commands. |
CVE-2023-39935 | High | 8.0 | 2023-09-06 | Archer C5400 firmware versions prior to 'Archer C5400(JP)_V2_230506' allows a network-adjacent authenticated attacker to execute arbitrary OS commands. |
CVE-2023-39224 | High | 8.0 | 2023-09-06 | Archer C5 firmware all versions and Archer C7 firmware versions prior to 'Archer C7(JP)_V2_230602' allow a network-adjacent authenticated attacker to execute a… |
CVE-2023-38588 | High | 8.0 | 2023-09-06 | Archer C3150 firmware versions prior to 'Archer C3150(JP)_V2_230511' allows a network-adjacent authenticated attacker to execute arbitrary OS commands. |
CVE-2023-38568 | High | 8.8 | 2023-09-06 | Archer A10 firmware versions prior to 'Archer A10(JP)_V2_230504' allows a network-adjacent unauthenticated attacker to execute arbitrary OS commands. |
CVE-2023-38563 | High | 8.8 | 2023-09-06 | Archer C1200 firmware versions prior to 'Archer C1200(JP)_V2_230508' and Archer C9 firmware versions prior to 'Archer C9(JP)_V3_230508' allow a network-adjacen… |
CVE-2023-36489 | High | 8.8 | 2023-09-06 | Multiple TP-LINK products allow a network-adjacent unauthenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: TL-WR8… |
CVE-2023-31188 | High | 8.0 | 2023-09-06 | Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer C… |
CVE-2023-39362 | High | 7.2 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can… |
CVE-2015-2201 | High | 7.2 | 2023-09-05 | Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users. |
CVE-2023-4711 | Medium | 5.0 | 2023-09-01 | A vulnerability, which was classified as critical, has been found in D-Link DAR-8000-10 up to 20230819. Affected by this issue is some unknown functionality of… |
CVE-2023-40582 | Critical | 9.8 | 2023-08-30 | find-exec is a utility to discover available shell commands. Versions prior to 1.0.3 did not properly escape user input and are vulnerable to Command Injection… |
CVE-2023-40839 | Critical | 9.8 | 2023-08-30 | Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_ADF3C' contains a command execution vulnerability. In the "formSetIptv" function, obtaining th… |
CVE-2023-40838 | Critical | 9.8 | 2023-08-30 | Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_3A1D0' contains a command execution vulnerability. |
CVE-2023-40837 | Critical | 9.8 | 2023-08-30 | Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_ADD50' contains a command execution vulnerability. In the "formSetIptv" function, obtaining th… |