CWE-78 · OS Command Injection (page 39)
Page 39 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-42055 | Medium | 6.5 | 2022-10-27 | Multiple command injection vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 via the ping and traceroute tools allow att… |
CVE-2022-31898 | Medium | 6.8 | 2022-10-27 | gl-inet GL-MT300N-V2 Mango v3.212 and GL-AX1800 Flint v3.214 were discovered to contain multiple command injection vulnerabilities via the ping_addr and trace_… |
CVE-2022-42999 | High | 7.5 | 2022-10-26 | D-Link DIR-816 A2 1.10 B05 was discovered to contain multiple command injection vulnerabilities via the admuser and admpass parameters at /goform/setSysAdm. |
CVE-2022-39327 | High | 8.1 | 2022-10-25 | Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. C… |
CVE-2022-39321 | High | 8.8 | 2022-10-25 | GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job… |
CVE-2022-35132 | High | 8.8 | 2022-10-25 | Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module. |
CVE-2022-34850 | High | 7.2 | 2022-10-25 | An OS command injection vulnerability exists in the web_server /action/import_authorized_keys/ functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-cr… |
CVE-2022-33207 | Critical | 9.9 | 2022-10-25 | Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit… |
CVE-2022-33206 | Critical | 9.9 | 2022-10-25 | Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit… |
CVE-2022-33205 | Critical | 9.9 | 2022-10-25 | Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit… |
CVE-2022-33204 | Critical | 9.9 | 2022-10-25 | Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit… |
CVE-2022-33195 | Critical | 10.0 | 2022-10-25 | Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD… |
CVE-2022-33194 | Critical | 10.0 | 2022-10-25 | Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD… |
CVE-2022-33193 | Critical | 10.0 | 2022-10-25 | Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD… |
CVE-2022-33192 | Critical | 10.0 | 2022-10-25 | Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD… |
CVE-2022-33189 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the XCMD setAlexa functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-crafted X… |
CVE-2022-33150 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the js_package install functionality of Robustel R1510 3.1.16. A specially-crafted network request can lead to… |
CVE-2022-32773 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-c… |
CVE-2022-32765 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the sysupgrade command injection functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network… |
CVE-2022-32586 | High | 8.8 | 2022-10-25 | An OS command injection vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9… |
CVE-2022-30603 | High | 8.8 | 2022-10-25 | An OS command injection vulnerability exists in the web interface /action/iperf functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z… |
CVE-2022-30541 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the XCMD setUPnP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-c… |
CVE-2022-29851 | Critical | 9.8 | 2022-10-25 | documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occu… |
CVE-2022-29520 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the console_main_loop :sys functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-… |
CVE-2022-29472 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the web interface util_set_serial_mac functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X an… |
CVE-2022-27804 | Critical | 9.8 | 2022-10-25 | An os command injection vulnerability exists in the web interface util_set_abode_code functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X an… |
CVE-2022-34437 | Medium | 6.7 | 2022-10-21 | Dell PowerScale OneFS, versions 8.2.2-9.3.0, contain an OS command injection vulnerability. A privileged local malicious user could potentially exploit this vu… |
CVE-2022-43184 | Critical | 9.8 | 2022-10-19 | D-Link DIR878 1.30B08 Hotfix_04 was discovered to contain a command injection vulnerability via the component /bin/proc.cgi. |
CVE-2016-20016 | Critical | 9.8 | 2022-10-19 | MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI. A remote unauthenticated att… |
CVE-2022-33874 | Critical | 9.8 | 2022-10-18 | An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in SSH login components of FortiTester 2… |
CVE-2022-33873 | Medium | 6.8 | 2022-10-18 | An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in Console login components of FortiTest… |
CVE-2022-33872 | Critical | 9.8 | 2022-10-18 | An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in Telnet login components of FortiTeste… |
CVE-2022-35844 | Medium | 6.7 | 2022-10-18 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiTester 2.3.0 through 3.9.1, 4.0… |
CVE-2022-39057 | High | 7.2 | 2022-10-18 | RAVA certificate validation system has insufficient filtering for special parameter of the web page input field. A remote attacker with administrator privilege… |
CVE-2022-41751 | High | 7.8 | 2022-10-17 | Jhead 3.06.0.1 allows attackers to execute arbitrary OS commands by placing them in a JPEG filename and then using the regeneration -rgt50 option. |
CVE-2022-2884 | Critical | 9.9 | 2022-10-17 | A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to a… |
CVE-2022-3492 | Medium | 6.3 | 2022-10-13 | A vulnerability classified as critical was found in SourceCodester Human Resource Management System 1.0. This vulnerability affects unknown code of the compone… |
CVE-2022-24697 | Critical | 9.8 | 2022-10-13 | Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implem… |
CVE-2022-34427 | High | 8.8 | 2022-10-11 | Dell Container Storage Modules 1.2 contains an OS Command Injection in goiscsi and gobrick libraries. A remote unauthenticated attacker could exploit this vuln… |
CVE-2022-40176 | High | 8.0 | 2022-10-11 | A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All… |
CVE-2021-44171 | Critical | 9.0 | 2022-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiOS version 6.0.0 through 6.0.14, FortiOS version… |
CVE-2022-3276 | High | 8.4 | 2022-10-07 | Command injection is possible in the puppetlabs-mysql module prior to version 13.0.0. A malicious actor is able to exploit this vulnerability only if they are… |
CVE-2022-3275 | High | 8.4 | 2022-10-07 | Command injection is possible in the puppetlabs-apt module prior to version 9.0.0. A malicious actor is able to exploit this vulnerability only if they are abl… |
CVE-2022-37893 | High | 7.8 | 2022-10-07 | An authenticated command injection vulnerability exists in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of this vulnerabi… |
CVE-2022-41525 | Critical | 9.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a command injection vulnerability via the OpModeCfg function at /cgi-bin/cstecgi.cgi. |
CVE-2022-41518 | Critical | 9.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a command injection vulnerability via the UploadFirmwareFile function at /cgi-bin/cstecgi.cgi. |
CVE-2022-40764 | High | 7.8 | 2022-10-03 | Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common prac… |
CVE-2022-20930 | Medium | 6.7 | 2022-09-30 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite and possibly corrupt files on an affected system… |
CVE-2022-20855 | High | 7.9 | 2022-09-30 | A vulnerability in the self-healing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points could allow an authentic… |
CVE-2022-20851 | Medium | 5.5 | 2022-09-30 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected… |
CVE-2022-40475 | Critical | 9.8 | 2022-09-29 | TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection via the component /cgi-bin/downloadFile.cgi. |
CVE-2022-40929 | Critical | 9.8 | 2022-09-28 | XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. NOTE: this is disputed because the issues/4929 report is about an intended and support… |
CVE-2022-28811 | Critical | 9.8 | 2022-09-28 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could utilize an improper input valida… |
CVE-2022-40785 | High | 8.8 | 2022-09-26 | Unsanitized input when setting a locale file leads to shell injection in mIPC camera firmware 5.3.1.2003161406. This allows an attacker to gain remote code exe… |
CVE-2022-39224 | High | 7.0 | 2022-09-21 | Arr-pm is an RPM reader/writer library written in Ruby. Versions prior to 0.0.12 are subject to OS command injection resulting in shell execution if the RPM co… |
CVE-2022-37882 | High | 7.2 | 2022-09-20 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2022-37880 | High | 7.2 | 2022-09-20 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2022-37878 | High | 7.2 | 2022-09-20 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2022-38828 | Critical | 9.8 | 2022-09-16 | TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi |
CVE-2022-38826 | Critical | 9.8 | 2022-09-16 | In TOTOLINK T6 V4.1.5cu.709_B20210518, there is an execute arbitrary command in cstecgi.cgi. |
CVE-2022-38535 | High | 7.2 | 2022-09-15 | TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg function. |
CVE-2022-38534 | High | 7.2 | 2022-09-15 | TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setdiagnosicfg function. |
CVE-2022-38308 | Critical | 9.8 | 2022-09-14 | TOTOLink A700RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the lang parameter in the function cstesystem. This vulne… |
CVE-2022-39819 | High | 8.8 | 2022-09-13 | In NOKIA 1350 OMS R14.2, multiple OS Command Injection vulnerabilities occurs. This allows authenticated users to execute commands on the operating system. |
CVE-2022-39815 | Critical | 9.8 | 2022-09-13 | In NOKIA 1350 OMS R14.2, multiple OS Command Injection vulnerabilities occurs. This vulnerability allow unauthenticated users to execute commands on the operat… |
CVE-2022-36779 | Medium | 6.5 | 2022-09-13 | PROSCEND - PROSCEND / ADVICE .Ltd - G/5G Industrial Cellular Router (with GPS)4 Unauthenticated OS Command Injection Proscend M330-w / M33-W5 / M350-5G / M350-… |
CVE-2022-37860 | Critical | 9.8 | 2022-09-12 | The web configuration interface of the TP-Link M7350 V3 with firmware version 190531 is affected by a pre-authentication command injection vulnerability. |
CVE-2022-3133 | High | 7.8 | 2022-09-09 | OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0. |
CVE-2022-29061 | High | 7.2 | 2022-09-09 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSOAR before 7.2.1 allows… |
CVE-2022-30079 | High | 8.8 | 2022-09-08 | Command injection vulnerability was discovered in Netgear R6200 v2 firmware through R6200v2-V1.0.3.12 via binary /sbin/acos_service that could allow remote aut… |
CVE-2022-38094 | High | 8.8 | 2022-09-08 | OS command injection vulnerability in the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to… |
CVE-2022-35273 | High | 8.8 | 2022-09-08 | OS command injection vulnerability in GUI setting page of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to ex… |
CVE-2022-33941 | Critical | 9.8 | 2022-09-08 | PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC… |
CVE-2022-38531 | High | 8.8 | 2022-09-08 | FPT G-97RG6M R4.2.98.035 and G-97RG3 R4.2.43.078 are vulnerable to Remote Command Execution in the ping function. |
CVE-2022-30078 | High | 8.8 | 2022-09-07 | NETGEAR R6200_V2 firmware versions through R6200v2-V1.0.3.12_10.1.11 and R6300_V2 firmware versions through R6300v2-V1.0.4.52_10.0.93 allow remote authenticate… |
CVE-2022-23683 | High | 7.2 | 2022-09-06 | Authenticated command injection vulnerabilities exist in the AOS-CX Network Analytics Engine via NAE scripts. Successful exploitation of these vulnerabilities… |
CVE-2022-23682 | High | 7.8 | 2022-09-06 | Multiple vulnerabilities exist in the AOS-CX command line interface that could lead to authenticated command injection. A successful exploit could allow an att… |
CVE-2022-23681 | High | 7.8 | 2022-09-06 | Multiple vulnerabilities exist in the AOS-CX command line interface that could lead to authenticated command injection. A successful exploit could allow an att… |
CVE-2022-34883 | High | 7.2 | 2022-09-06 | OS Command Injection vulnerability in Hitachi RAID Manager Storage Replication Adapter allows remote authenticated users to execute arbitrary OS commands. This… |
CVE-2021-28398 | High | 7.2 | 2022-09-05 | A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to execute arbitrary OS commands remotely… |
CVE-2022-31814 | Critical | 9.8 | 2022-09-05 | pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. NOTE: 3… |
CVE-2022-3008 | High | 8.1 | 2022-09-05 | The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This functi… |
CVE-2022-37130 | Critical | 9.8 | 2022-08-31 | In D-Link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img a command injection vulnerability occurs in /goform/Diagnosis, after the condition is met, setnu… |
CVE-2022-37129 | High | 8.8 | 2022-08-31 | D-Link DIR-816 A2_v1.10CNB04.img is vulnerable to Command Injection via /goform/SystemCommand. After the user passes in the command parameter, it will be splic… |
CVE-2022-37123 | High | 8.8 | 2022-08-31 | D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/form2userconfig.cgi. |
CVE-2022-34383 | High | 8.1 | 2022-08-31 | Dell Edge Gateway 5200 (EGW) versions before 1.03.10 contain an operating system command injection vulnerability. A local malicious user may potentially exploi… |
CVE-2022-36566 | Critical | 9.8 | 2022-08-31 | Rengine v1.3.0 was discovered to contain a command injection vulnerability via the scan engine function. |
CVE-2022-36749 | Critical | 9.8 | 2022-08-30 | RPi-Jukebox-RFID v2.3.0 was discovered to contain a command injection vulnerability via the component /htdocs/utils/Files.php. This vulnerability is exploited… |
CVE-2022-34374 | High | 8.8 | 2022-08-30 | Dell Container Storage Modules 1.2 contains an OS command injection in goiscsi and gobrick libraries. A remote authenticated malicious user with low privileges… |
CVE-2022-31232 | High | 8.6 | 2022-08-30 | SmartFabric storage software version 1.0.0 contains a Command-Injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerabi… |
CVE-2022-37149 | Critical | 9.8 | 2022-08-30 | WAVLINK WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability when operating the file adm.cgi. This vulnerability allows… |
CVE-2022-38511 | High | 7.8 | 2022-08-29 | TOTOLINK A810R V5.9c.4050_B20190424 was discovered to contain a command injection vulnerability via the component downloadFile.cgi. |
CVE-2022-37056 | Critical | 9.8 | 2022-08-28 | D-Link GO-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 is vulnerable to Command Injection via /cgibin, hnap_main, |
CVE-2022-37057 | Critical | 9.8 | 2022-08-28 | D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Command Injection via cgibin, ssdpcgi_main. |
CVE-2022-31499 | Critical | 9.8 | 2022-08-25 | Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo. NOTE: this issue exists because of… |
CVE-2022-20865 | Medium | 6.7 | 2022-08-25 | A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privile… |
CVE-2022-37810 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a command injection vulnerability via the mac parameter in the function formWriteFacMac. |
CVE-2022-37083 | High | 7.8 | 2022-08-25 | TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the ip parameter at the function setDiagnosisCfg. |
CVE-2022-37082 | High | 7.8 | 2022-08-25 | TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the host_time parameter at the function NTPSyncWithHost. |
CVE-2022-37081 | High | 7.8 | 2022-08-25 | TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the command parameter at setting/setTracerouteCfg. |