CWE-78 · OS Command Injection (page 38)
Page 38 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-46304 | High | 8.8 | 2023-01-03 | ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter. An unauthenticated remote attacker can… |
CVE-2022-40740 | High | 7.2 | 2023-01-03 | Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this vulnerability to pe… |
CVE-2022-46598 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a command injection vulnerability via the wps_sta_enrollee_pin parameter in the action set_sta_enrollee_pin… |
CVE-2022-46597 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a command injection vulnerability via the sys_service parameter in the setup_wizard_mydlink (sub_4104B8) fu… |
CVE-2021-4281 | Medium | 4.6 | 2022-12-26 | A vulnerability was found in Brave UX for-the-badge and classified as critical. Affected by this issue is some unknown functionality of the file .github/workfl… |
CVE-2022-40005 | High | 8.8 | 2022-12-25 | Intelbras WiFiber 120AC inMesh before 1-1-220826 allows command injection by authenticated users, as demonstrated by the /boaform/formPing6 and /boaform/formTr… |
CVE-2022-45717 | Critical | 9.8 | 2022-12-23 | IP-COM M50 V15.11.0.33(10768) was discovered to contain a command injection vulnerability via the usbPartitionName parameter in the formSetUSBPartitionUmount f… |
CVE-2022-45711 | Critical | 9.8 | 2022-12-23 | IP-COM M50 V15.11.0.33(10768) was discovered to contain a command injection vulnerability via the hostname parameter in the formSetNetCheckTools function. |
CVE-2022-45709 | Critical | 9.8 | 2022-12-23 | IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple command injection vulnerabilities via the pEnable, pLevel, and pModule parameters in the formS… |
CVE-2022-44567 | Critical | 9.8 | 2022-12-23 | A command injection vulnerability exists in Rocket.Chat-Desktop <3.8.14 that could allow an attacker to pass a malicious url of openInternalVideoChatWindow to… |
CVE-2021-32692 | Critical | 9.6 | 2022-12-23 | Activity Watch is a free and open-source automated time tracker. Versions prior to 0.11.0 allow an attacker to execute arbitrary commands on any macOS machine… |
CVE-2022-3183 | Critical | 9.8 | 2022-12-21 | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specific function does not sanitize the input provided by the user, whic… |
CVE-2022-4643 | Medium | 6.3 | 2022-12-21 | A vulnerability was found in docconv up to 1.2.0. It has been declared as critical. This vulnerability affects the function ConvertPDFImages of the file pdf_oc… |
CVE-2022-24431 | High | 7.4 | 2022-12-21 | All versions of package abacus-ext-cmdline are vulnerable to Command Injection via the execute function due to improper user-input sanitization. |
CVE-2022-4515 | High | 7.8 | 2022-12-20 | A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the comm… |
CVE-2022-46538 | Critical | 9.8 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a command injection vulnerability via the mac parameter at /goform/WriteFacMac. |
CVE-2022-40624 | Critical | 9.8 | 2022-12-20 | pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different vulnerability than… |
CVE-2022-45942 | High | 8.8 | 2022-12-20 | A Remote Code Execution (RCE) vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4. |
CVE-2022-25171 | High | 7.4 | 2022-12-20 | The package p4 before 0.0.7 are vulnerable to Command Injection via the run() function due to improper input sanitization |
CVE-2022-44456 | Critical | 9.8 | 2022-12-19 | CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server where the product is… |
CVE-2022-43466 | Medium | 6.8 | 2022-12-19 | OS command injection vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS co… |
CVE-2022-43443 | High | 8.8 | 2022-12-19 | OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted req… |
CVE-2022-26582 | High | 7.8 | 2022-12-16 | PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow an attacker to gain root access through command injection in systool client. The attack… |
CVE-2022-26580 | Medium | 6.8 | 2022-12-16 | PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow the execution of specific command injections on selected binaries in the ADB daemon she… |
CVE-2022-47210 | High | 7.8 | 2022-12-16 | The default console presented to users over telnet (when enabled) is restricted to a subset of commands. Commands issued at this console, however, appear to be… |
CVE-2022-47208 | High | 8.8 | 2022-12-16 | The “puhttpsniff” service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticated attacker on th… |
CVE-2022-46634 | Critical | 9.8 | 2022-12-15 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the setting/setWiFiWpsCfg f… |
CVE-2022-46631 | Critical | 9.8 | 2022-12-15 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the setting/setWiFiSignalCf… |
CVE-2022-24377 | High | 7.4 | 2022-12-14 | The package cycle-import-check before 1.3.2 are vulnerable to Command Injection via the writeFileToTmpDirAndOpenIt function due to improper user-input sanitiza… |
CVE-2022-42140 | High | 7.2 | 2022-12-14 | Delta Electronics DX-2100-L1-CN 2.42 is vulnerable to Command Injection via lform/net_diagnose. |
CVE-2022-42139 | High | 8.8 | 2022-12-14 | Delta Electronics DVW-W02W2-E2 1.5.0.10 is vulnerable to Command Injection via Crafted URL. |
CVE-2022-45005 | Critical | 9.8 | 2022-12-13 | IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the cmd_get_ping_output function. |
CVE-2022-45996 | High | 7.2 | 2022-12-12 | Tenda W20E V16.01.0.6(3392) is vulnerable to Command injection via cmd_get_ping_output. |
CVE-2022-45977 | High | 8.8 | 2022-12-12 | Tenda AX12 V22.03.01.21_CN was found to have a command injection vulnerability via /goform/setMacFilterCfg function. |
CVE-2022-45043 | High | 8.8 | 2022-12-12 | Tenda AX12 V22.03.01.16_cn is vulnerable to command injection via goform/fast_setting_internet_set. |
CVE-2022-37924 | High | 7.2 | 2022-12-12 | Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A… |
CVE-2022-37912 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37902 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37901 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37900 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37899 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37898 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37897 | Critical | 9.8 | 2022-12-12 | There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (… |
CVE-2022-45145 | Critical | 9.8 | 2022-12-10 | egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file. |
CVE-2022-33186 | Critical | 9.8 | 2022-12-08 | A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute… |
CVE-2022-45506 | Critical | 9.8 | 2022-12-08 | Tenda W30E v1.0.1.25(633) was discovered to contain a command injection vulnerability via the fileNameMit parameter at /goform/delFileName. |
CVE-2022-45497 | Critical | 9.8 | 2022-12-08 | Tenda W6-S v1.0.0.4(510) was discovered to contain a command injection vulnerability in the tpi_get_ping_output function at /goform/exeCommand. |
CVE-2022-4364 | High | 7.3 | 2022-12-08 | A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16. Affected by this issue is some unknown functionality of the file palette.php of the componen… |
CVE-2022-44606 | High | 8.8 | 2022-12-07 | OS command injection vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker… |
CVE-2022-43464 | High | 8.8 | 2022-12-07 | Hidden functionality vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker… |
CVE-2022-45026 | Critical | 9.8 | 2022-12-07 | An issue in Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom allows attackers to execute arbitrary commands during the GFM export process. |
CVE-2022-45025 | Critical | 9.8 | 2022-12-07 | Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerability via the PDF file import function. |
CVE-2022-45915 | High | 8.8 | 2022-12-07 | ILIAS before 7.16 allows OS Command Injection. |
CVE-2022-43867 | High | 7.8 | 2022-12-06 | IBM Spectrum Scale 5.1.0.1 through 5.1.4.1 could allow a local attacker to execute arbitrary commands in the container. IBM X-Force ID: 239437. |
CVE-2020-6627 | Critical | 9.8 | 2022-12-06 | The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in ci… |
CVE-2022-25912 | High | 8.1 | 2022-12-06 | The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clo… |
CVE-2022-43548 | High | 8.1 | 2022-12-05 | A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easil… |
CVE-2022-46169 | Critical | 9.8 | 2022-12-05 | Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a… |
CVE-2022-42496 | Critical | 9.8 | 2022-12-05 | OS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to obtain appkey of th… |
CVE-2022-41642 | Critical | 9.8 | 2022-12-05 | OS command injection vulnerability in Nadesiko3 (PC Version) v3.3.61 and earlier allows a remote attacker to execute an arbitrary OS command when processing co… |
CVE-2022-44930 | Critical | 9.8 | 2022-12-02 | D-Link DHP-W310AV 3.10EU was discovered to contain a command injection vulnerability via the System Checks function. |
CVE-2022-44928 | Critical | 9.8 | 2022-12-02 | D-Link DVG-G5402SP GE_1.03 was discovered to contain a command injection vulnerability via the Maintenance function. |
CVE-2022-43325 | Critical | 9.8 | 2022-12-02 | An unauthenticated command injection vulnerability in the product license validation function of Telos Alliance Omnia MPX Node 1.3.* - 1.4.* allows attackers t… |
CVE-2022-3226 | High | 7.2 | 2022-12-01 | An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA. |
CVE-2022-4257 | Medium | 6.3 | 2022-12-01 | A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto… |
CVE-2022-4221 | Critical | 9.8 | 2022-12-01 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Asus NAS-M25 allows an unauthenticated attacker to… |
CVE-2022-45045 | High | 8.8 | 2022-12-01 | Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authentica… |
CVE-2021-4242 | Medium | 6.3 | 2022-11-30 | A vulnerability was found in Sapido BR270n, BRC76n, GR297 and RB1732 and classified as critical. Affected by this issue is some unknown functionality of the fi… |
CVE-2022-24441 | Medium | 5.8 | 2022-11-30 | The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can… |
CVE-2022-22984 | Medium | 5.0 | 2022-11-30 | The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plu… |
CVE-2022-36962 | High | 7.2 | 2022-11-29 | SolarWinds Platform was susceptible to Command Injection. This vulnerability allows a remote adversary with complete control over the SolarWinds database to ex… |
CVE-2022-45939 | High | 7.8 | 2022-11-28 | GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system… |
CVE-2022-44844 | Critical | 9.8 | 2022-11-25 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pass parameter in the setting/setOpenVpnCfg function. |
CVE-2022-44843 | Critical | 9.8 | 2022-11-25 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the port parameter in the setting/setOpenVpnClientCfg fu… |
CVE-2022-44252 | Critical | 9.8 | 2022-11-23 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the setUploadSetting function. |
CVE-2022-44251 | Critical | 9.8 | 2022-11-23 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the ussd parameter in the setUssd function. |
CVE-2022-44250 | Critical | 9.8 | 2022-11-23 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the hostName parameter in the setOpModeCfg function. |
CVE-2022-44249 | Critical | 9.8 | 2022-11-23 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the UploadFirmwareFile function. |
CVE-2022-41942 | High | 7.9 | 2022-11-22 | Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sour… |
CVE-2022-44808 | Critical | 9.8 | 2022-11-22 | A command injection vulnerability has been found on D-Link DIR-823G devices with firmware version 1.02B03 that allows an attacker to execute arbitrary operatin… |
CVE-2022-44201 | Critical | 9.8 | 2022-11-22 | D-Link DIR823G 1.02B05 is vulnerable to Commad Injection. |
CVE-2022-41131 | High | 7.8 | 2022-11-22 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows… |
CVE-2022-40954 | Medium | 5.5 | 2022-11-22 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allow… |
CVE-2022-40189 | Critical | 9.8 | 2022-11-22 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows… |
CVE-2022-38649 | Critical | 9.8 | 2022-11-22 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allow… |
CVE-2022-45461 | High | 7.5 | 2022-11-17 | The Java Admin Console in Veritas NetBackup through 10.1 and related Veritas products on Linux and UNIX allows authenticated non-root users (that have been exp… |
CVE-2022-20934 | Medium | 6.0 | 2022-11-15 | A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software and Cisco FXOS Software could allow an authenticated, local attacker to execute arb… |
CVE-2022-20926 | Medium | 6.3 | 2022-11-15 | A vulnerability in the web management interface of the Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execut… |
CVE-2022-20925 | Medium | 6.3 | 2022-11-15 | A vulnerability in the web management interface of the Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execut… |
CVE-2022-42053 | High | 7.8 | 2022-11-15 | Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a command injection vulnerability via the PortMappingServer parameter in the setPo… |
CVE-2022-41396 | High | 7.8 | 2022-11-15 | Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain multiple command injection vulnerabilities in the function setIPsecTunnelList via… |
CVE-2022-41395 | High | 7.8 | 2022-11-15 | Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a command injection vulnerability via the dmzHost parameter in the setDMZ function. |
CVE-2022-40847 | High | 7.8 | 2022-11-15 | In Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576), there exists a command injection vulnerability in the function formSetFixTools. This vulnerability allow… |
CVE-2022-38387 | High | 7.1 | 2022-11-11 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending… |
CVE-2022-35717 | High | 7.8 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on the system by sending a specially crafted… |
CVE-2022-35642 | Medium | 5.4 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2022-33870 | High | 7.8 | 2022-11-02 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiTester 3.0.0 through 3.9.1… |
CVE-2022-40741 | Critical | 9.8 | 2022-10-31 | Mail SQR Expert’s specific function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this vulnerability to per… |
CVE-2022-44019 | High | 8.8 | 2022-10-30 | In Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via shell metacharacters in the host parameter. |
CVE-2022-37915 | Critical | 9.8 | 2022-10-28 | A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to run arbitr… |