CWE-78 · OS Command Injection (page 39)
Page 39 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-41109 | Critical | 9.8 | 2023-08-28 | SmartNode SN200 (aka SN200) 3.21.2-23021 allows unauthenticated OS Command Injection. |
CVE-2023-1997 | High | 8.8 | 2023-08-28 | An OS Command Injection vulnerability exists in SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023x. A specially crafted… |
CVE-2023-38027 | Critical | 9.8 | 2023-08-28 | SpotCam Co., Ltd. SpotCam Sense’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulne… |
CVE-2023-38025 | Critical | 9.8 | 2023-08-28 | SpotCam Co., Ltd. SpotCam FHD 2’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vuln… |
CVE-2022-43907 | High | 7.2 | 2023-08-27 | IBM Security Guardium 11.4 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM… |
CVE-2023-4542 | Medium | 6.3 | 2023-08-25 | A vulnerability was found in D-Link DAR-8000-10 up to 20230809. It has been classified as critical. This affects an unknown part of the file /app/sys1.php. The… |
CVE-2023-37249 | High | 8.8 | 2023-08-25 | Infoblox NIOS through 8.5.1 has a faulty component that accepts malicious input without sanitization, resulting in shell access. |
CVE-2023-40144 | High | 8.8 | 2023-08-23 | OS command injection vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its set… |
CVE-2020-21583 | Medium | 6.7 | 2023-08-22 | An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute arbitrary commands via the path parameter when setting the… |
CVE-2023-4412 | Medium | 6.3 | 2023-08-18 | A vulnerability was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical. This issue affects the function setWanCfg. The manipulation… |
CVE-2023-4411 | Medium | 6.3 | 2023-08-18 | A vulnerability has been found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical. This vulnerability affects the function setTracerouteC… |
CVE-2023-4410 | Medium | 6.3 | 2023-08-18 | A vulnerability, which was classified as critical, was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023. This affects the function setDiagnosisCfg. The mani… |
CVE-2023-40072 | High | 8.8 | 2023-08-18 | OS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command by sending a spe… |
CVE-2023-40069 | Critical | 9.8 | 2023-08-18 | OS command injection vulnerability in ELECOM wireless LAN routers allows an attacker who can access the product to execute an arbitrary OS command by sending a… |
CVE-2023-39944 | High | 8.8 | 2023-08-18 | OS command injection vulnerability in WRC-F1167ACF all versions, and WRC-1750GHBK all versions allows an attacker who can access the product to execute an arbi… |
CVE-2023-39455 | High | 8.8 | 2023-08-18 | OS command injection vulnerability in ELECOM wireless LAN routers allows an authenticated user to execute an arbitrary OS command by sending a specially crafte… |
CVE-2023-39416 | High | 7.2 | 2023-08-18 | Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlier, and Proself Mail Sanitize Edition Ver1.07 and earlier all… |
CVE-2023-34215 | High | 7.2 | 2023-08-17 | TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validat… |
CVE-2023-34214 | High | 7.2 | 2023-08-17 | TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. Th… |
CVE-2023-34213 | High | 8.8 | 2023-08-17 | TN-5900 Series firmware versions v3.3 and prior are vulnerable to command-injection vulnerability. This vulnerability stems from insufficient input validation… |
CVE-2023-33239 | High | 8.8 | 2023-08-17 | TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. Th… |
CVE-2023-33238 | High | 7.2 | 2023-08-17 | TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. Th… |
CVE-2023-35893 | Critical | 9.9 | 2023-08-16 | IBM Security Guardium 10.6, 11.3, 11.4, and 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially… |
CVE-2023-20017 | Medium | 6.5 | 2023-08-16 | Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary commands using root-l… |
CVE-2023-20013 | Medium | 6.5 | 2023-08-16 | Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary commands using root-l… |
CVE-2023-33013 | High | 8.8 | 2023-08-14 | A post-authentication command injection vulnerability in the NTP feature of Zyxel NBG6604 firmware version V1.01(ABIR.1)C0 could allow an authenticated attacke… |
CVE-2023-3267 | Critical | 9.1 | 2023-08-14 | When adding a remote backup location, an authenticated user can pass arbitrary OS commands through the username field. The username is passed without sanitizat… |
CVE-2023-3261 | High | 7.5 | 2023-08-14 | The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier contains a buffer overflow vulnerability in the librta.so.0.0.0 library.Successful ex… |
CVE-2023-3260 | High | 7.2 | 2023-08-14 | The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to command injection via the `user-name` URL parameter. An authenticate… |
CVE-2023-40253 | Medium | 6.0 | 2023-08-11 | Improper Authentication vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Authentica… |
CVE-2023-31209 | High | 8.8 | 2023-08-10 | Improper neutralization of active check command arguments in Checkmk < 2.1.0p32, < 2.0.0p38, < 2.2.0p4 leads to arbitrary command execution for authenticated u… |
CVE-2022-48604 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “logging export” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directl… |
CVE-2022-48603 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “message viewer iframe” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it… |
CVE-2022-48602 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “message viewer print” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it d… |
CVE-2022-48601 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “network print report” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it d… |
CVE-2022-48600 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “notes view” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to… |
CVE-2022-48599 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “reporter events type” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it d… |
CVE-2022-48598 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “reporter events type date” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes… |
CVE-2022-48597 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “ticket event report” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it di… |
CVE-2022-48596 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “ticket queue watchers” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it… |
CVE-2022-48595 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “ticket template watchers” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes… |
CVE-2022-48594 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “ticket watchers email” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it… |
CVE-2022-48593 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “topology data service” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it… |
CVE-2022-48592 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the vendor_country parameter of the “vendor print report” feature of the ScienceLogic SL1 that takes unsanitized user‐c… |
CVE-2022-48591 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the vendor_state parameter of the “vendor print report” feature of the ScienceLogic SL1 that takes unsanitized user‐con… |
CVE-2022-48590 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “admin dynamic app mib errors” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and pas… |
CVE-2022-48589 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “reporting job editor” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it d… |
CVE-2022-48588 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “schedule editor decoupled” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes… |
CVE-2022-48587 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “schedule editor” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it direct… |
CVE-2022-48586 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “json walker” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly t… |
CVE-2022-48585 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “admin brand portal” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it dir… |
CVE-2022-48584 | High | 8.8 | 2023-08-09 | A command injection vulnerability exists in the download and convert report feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and pa… |
CVE-2022-48583 | High | 8.8 | 2023-08-09 | A command injection vulnerability exists in the dashboard scheduler feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it… |
CVE-2022-48582 | High | 8.8 | 2023-08-09 | A command injection vulnerability exists in the ticket report generate feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes… |
CVE-2022-48581 | High | 8.8 | 2023-08-09 | A command injection vulnerability exists in the “dash export” feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it direct… |
CVE-2022-48580 | High | 8.8 | 2023-08-09 | A command injection vulnerability exists in the ARP ping device tool feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it… |
CVE-2023-38208 | Critical | 9.1 | 2023-08-09 | Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Improper Neutralization of Special Element… |
CVE-2023-37863 | High | 7.2 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with SNMPv2 write privileges may use an a special SNMP request to g… |
CVE-2023-37861 | High | 8.8 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated remote attacker can execute code with root permissions with a specia… |
CVE-2023-37569 | High | 8.8 | 2023-08-08 | This vulnerability exists in ESDS Emagic Data Center Management Suit due to lack of input sanitization in its Ping component. A remote authenticated attacker c… |
CVE-2023-3573 | High | 8.8 | 2023-08-08 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a command injection in a HTTP POST requ… |
CVE-2023-3572 | Critical | 10.0 | 2023-08-08 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote, unauthenticated attacker may use an attribute of a specific HTTP POST reque… |
CVE-2023-3571 | High | 8.8 | 2023-08-08 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP POST releated to certif… |
CVE-2023-3570 | High | 8.8 | 2023-08-08 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP DELETE request to gain… |
CVE-2023-38692 | Critical | 9.8 | 2023-08-04 | CloudExplorer Lite is an open source, lightweight cloud management platform. Versions prior to 1.3.1 contain a command injection vulnerability in the installat… |
CVE-2023-33377 | Critical | 9.8 | 2023-08-04 | Connected IO v2.1.0 and prior has an OS command injection vulnerability in the set firewall command in part of its communication protocol, enabling attackers t… |
CVE-2023-33374 | Critical | 9.8 | 2023-08-04 | Connected IO v2.1.0 and prior has a command as part of its communication protocol allowing the management platform to specify arbitrary OS commands for devices… |
CVE-2023-33364 | High | 8.8 | 2023-08-03 | An OS Command injection vulnerability exists in Suprema BioStar 2 before V2.9.1, which allows authenticated users to execute arbitrary OS commands on the BioSt… |
CVE-2023-21411 | High | 7.2 | 2023-08-03 | User provided input is not sanitized in the “Settings > Access Control” configuration interface allowing for arbitrary code execution. |
CVE-2023-21410 | High | 7.2 | 2023-08-03 | User provided input is not sanitized on the AXIS License Plate Verifier specific “api.cgi” allowing for arbitrary code execution. |
CVE-2023-26317 | High | 7.0 | 2023-08-02 | Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from external interface… |
CVE-2023-31425 | High | 7.8 | 2023-08-01 | A vulnerability in the fosexec command of Brocade Fabric OS after Brocade Fabric OS v9.1.0 and, before Brocade Fabric OS v9.1.1 could allow a local authenticat… |
CVE-2023-4033 | High | 7.8 | 2023-08-01 | OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0. |
CVE-2023-35861 | Critical | 9.8 | 2023-07-31 | A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute… |
CVE-2023-35019 | High | 7.2 | 2023-07-31 | IBM Security Verify Governance, Identity Manager 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a spec… |
CVE-2023-37213 | High | 8.8 | 2023-07-30 | Synel SYnergy Fingerprint Terminals - CWE-78: 'OS Command Injection' |
CVE-2023-3975 | Critical | 9.8 | 2023-07-27 | OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0. |
CVE-2023-3974 | Critical | 9.8 | 2023-07-27 | OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0. |
CVE-2023-38673 | Critical | 9.6 | 2023-07-26 | PaddlePaddle before 2.5.0 has a command injection in fs.py. This resulted in the ability to execute arbitrary commands on the operating system. |
CVE-2023-38056 | High | 7.2 | 2023-07-24 | Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authen… |
CVE-2023-37903 | Critical | 9.8 | 2023-07-21 | vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sa… |
CVE-2023-37292 | Critical | 9.8 | 2023-07-21 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in HGiga iSherlock 4.5 (iSherlock-user modules), HGiga… |
CVE-2023-37477 | High | 7.2 | 2023-07-18 | 1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality… |
CVE-2023-36670 | Critical | 9.8 | 2023-07-18 | A remotely exploitable command injection vulnerability was found on the Kratos NGC-IDU 9.1.0.4. An attacker can execute arbitrary Linux commands as root by sen… |
CVE-2020-36762 | Medium | 5.5 | 2023-07-18 | A vulnerability was found in ONS Digital RAS Collection Instrument up to 2.0.27 and classified as critical. Affected by this issue is the function jobs of the… |
CVE-2023-34141 | High | 8.0 | 2023-07-17 | A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX ser… |
CVE-2023-34139 | High | 8.8 | 2023-07-17 | A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series… |
CVE-2023-34138 | High | 8.0 | 2023-07-17 | A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USG FLEX series firmwa… |
CVE-2023-33012 | High | 8.8 | 2023-07-17 | A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware ver… |
CVE-2023-28767 | High | 8.8 | 2023-07-17 | The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through 5.36, USG FLEX series firmware versions… |
CVE-2023-38378 | Critical | 9.8 | 2023-07-16 | The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to execute arbitrary code via shell metacharac… |
CVE-2023-37564 | High | 8.0 | 2023-07-13 | OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute an arbitrary OS command with a ro… |
CVE-2023-34127 | High | 8.8 | 2023-07-13 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall Analytics enables an authe… |
CVE-2023-34116 | High | 8.2 | 2023-07-11 | Improper input validation in the Zoom Desktop Client for Windows before version 5.15.0 may allow an unauthorized user to enable an escalation of privilege via… |
CVE-2023-23777 | High | 7.2 | 2023-07-11 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiWeb version 7.0.1 and below, 6.4 a… |
CVE-2023-36922 | Critical | 9.1 | 2023-07-11 | Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary ope… |
CVE-2023-3608 | Medium | 4.7 | 2023-07-10 | A vulnerability was found in Ruijie BCR810W 2.5.10. It has been rated as critical. This issue affects some unknown processing of the component Tracert Page. Th… |
CVE-2023-3607 | Medium | 5.5 | 2023-07-10 | A vulnerability was found in kodbox 1.26. It has been declared as critical. This vulnerability affects the function Execute of the file webconsole.php.txt of t… |
CVE-2023-3606 | Medium | 6.3 | 2023-07-10 | A vulnerability was found in TamronOS up to 20230703. It has been classified as critical. This affects an unknown part of the file /api/ping. The manipulation… |
CVE-2021-42081 | Critical | 9.1 | 2023-07-10 | An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API. POC http://<IP_ADDRESS>/qstorapi/storageSystemModify?stora… |