CWE-78 · OS Command Injection (page 40)
Page 40 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-37079 | High | 7.8 | 2022-08-25 | TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg. |
CVE-2022-36455 | High | 7.8 | 2022-08-25 | TOTOLink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a command injection vulnerability via the username parameter in /cstecgi.cgi. |
CVE-2022-37076 | High | 7.8 | 2022-08-25 | TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the FileName parameter in the function UploadFirmwareFil… |
CVE-2022-37070 | Critical | 9.8 | 2022-08-25 | H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a command injection vulnerability via the param parameter at DelL2tpLNSList. |
CVE-2022-36510 | High | 7.8 | 2022-08-25 | H3C GR2200 MiniGR1A0V100R014 was discovered to contain a command injection vulnerability via the param parameter at DelL2tpLNSList. |
CVE-2022-36509 | High | 7.8 | 2022-08-25 | H3C GR3200 MiniGR1B0V100R014 was discovered to contain a command injection vulnerability via the param parameter at DelL2tpLNSList. |
CVE-2022-36487 | High | 7.8 | 2022-08-25 | TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the command parameter in the function setTracerouteCfg. |
CVE-2022-36486 | High | 7.8 | 2022-08-25 | TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the FileName parameter in the function UploadFirmwareFil… |
CVE-2022-36485 | High | 7.8 | 2022-08-25 | TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg. |
CVE-2022-36481 | High | 7.8 | 2022-08-25 | TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the ip parameter in the function setDiagnosisCfg. |
CVE-2022-36479 | High | 7.8 | 2022-08-25 | TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the host_time parameter in the function NTPSyncWithHost. |
CVE-2022-36461 | High | 7.8 | 2022-08-25 | TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg. |
CVE-2022-36460 | High | 7.8 | 2022-08-25 | TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the FileName parameter in the function UploadFirmwareFil… |
CVE-2022-36459 | High | 7.8 | 2022-08-25 | TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the host_time parameter in the function NTPSyncWithHost. |
CVE-2022-36458 | High | 7.8 | 2022-08-25 | TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the command parameter in the function setTracerouteCfg. |
CVE-2022-36456 | High | 7.8 | 2022-08-25 | TOTOLink A720R V4.1.5cu.532_B20210610 was discovered to contain a command injection vulnerability via the username parameter in /cstecgi.cgi. |
CVE-2022-36804 | High | 8.8 | 2022-08-25 | Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18… |
CVE-2022-2234 | Critical | 9.9 | 2022-08-24 | An authenticated mySCADA myPRO 8.26.0 user may be able to modify parameters to run commands directly in the operating system. |
CVE-2022-36633 | High | 8.8 | 2022-08-24 | Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encodi… |
CVE-2022-38132 | High | 8.2 | 2022-08-24 | Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the… |
CVE-2022-1513 | High | 7.3 | 2022-08-23 | A potential vulnerability was reported in Lenovo PCManager prior to version 5.0.10.4191 that may allow code execution when visiting a specially crafted website. |
CVE-2021-42232 | Critical | 9.8 | 2022-08-23 | TP-Link Archer A7 Archer A7(US)_V5_210519 is affected by a command injection vulnerability in /usr/bin/tddp. The vulnerability is caused by the program taking… |
CVE-2022-32572 | High | 8.8 | 2022-08-22 | An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HT… |
CVE-2022-30534 | High | 8.8 | 2022-08-22 | An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-craft… |
CVE-2022-35976 | Medium | 5.2 | 2022-08-18 | The GitOps Tools Extension for VSCode relies on kubeconfigs in order to communicate with Kubernetes clusters. A specially crafted kubeconfig leads to arbitrary… |
CVE-2022-37061 | Critical | 9.8 | 2022-08-18 | All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This can be exploited to inject and execute… |
CVE-2022-35975 | Critical | 9.0 | 2022-08-18 | The GitOps Tools Extension for VSCode can make it easier to manage Flux objects. A specially crafted Flux object may allow for remote code execution in the mac… |
CVE-2022-1410 | High | 8.0 | 2022-08-17 | OS Command Injection vulnerability in the db_optimize component of Device42 Asset Management Appliance allows an authenticated attacker to execute remote code… |
CVE-2022-36273 | Critical | 9.8 | 2022-08-16 | Tenda AC9 V15.03.2.21_cn is vulnerable to command injection via goform/SetSysTimeCfg. |
CVE-2022-36381 | High | 7.2 | 2022-08-16 | OS command injection vulnerability in Nintendo Wi-Fi Network Adaptor WAP-001 All versions allows an attacker with an administrative privilege to execute arbitr… |
CVE-2022-36309 | High | 8.8 | 2022-08-16 | Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of the recoverySubmit… |
CVE-2022-2314 | Critical | 9.8 | 2022-08-15 | The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site. |
CVE-2022-35555 | Critical | 9.8 | 2022-08-12 | A command injection vulnerability exists in /goform/exeCommand in Tenda W6 V1.0.0.9(4122), which allows attackers to construct cmdinput parameters for arbitrar… |
CVE-2022-20827 | Critical | 9.0 | 2022-08-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbit… |
CVE-2022-22140 | Critical | 9.8 | 2022-08-05 | An os command injection vulnerability exists in the confsrv ucloud_add_node functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted netwo… |
CVE-2022-21178 | Critical | 9.8 | 2022-08-05 | An os command injection vulnerability exists in the confsrv ucloud_add_new_node functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14. A specially-crafted ne… |
CVE-2022-34769 | Medium | 6.3 | 2022-08-05 | Michlol - rashim web interface Insecure direct object references (IDOR). First of all, the attacker needs to login. After he performs log into the system there… |
CVE-2022-25168 | Critical | 9.8 | 2022-08-04 | Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands… |
CVE-2022-27616 | High | 7.2 | 2022-08-03 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi component in Synology DiskStation Manager (D… |
CVE-2020-28424 | High | 7.2 | 2022-08-02 | This affects all versions of package s3-kilatstorage. |
CVE-2022-33955 | Medium | 6.8 | 2022-08-01 | IBM CICS TX 11.1 could allow allow an attacker with physical access to the system to execute code due using a back and refresh attack. IBM X-Force ID: 229312. |
CVE-2022-34527 | High | 8.8 | 2022-07-29 | D-Link DSL-3782 v1.03 and below was discovered to contain a command injection vulnerability via the function byte_4C0160. |
CVE-2022-22684 | High | 7.2 | 2022-07-28 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task management component in Synology DiskStation M… |
CVE-2022-2550 | High | 8.8 | 2022-07-27 | OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5. |
CVE-2022-24405 | Critical | 9.8 | 2022-07-27 | OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API. |
CVE-2022-23100 | Critical | 9.8 | 2022-07-27 | OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment). |
CVE-2022-20910 | Medium | 4.7 | 2022-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20888 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20887 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20886 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20885 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20884 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20883 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20882 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20881 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-33923 | Medium | 6.4 | 2022-07-21 | Dell PowerStore, versions prior to 3.0.0.0, contains an OS Command Injection vulnerability in PowerStore T environment. A locally authenticated attacker could… |
CVE-2022-22555 | Medium | 6.0 | 2022-07-21 | Dell EMC PowerStore, contains an OS command injection Vulnerability. A locally authenticated attacker could potentially exploit this vulnerability, leading to… |
CVE-2022-20880 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20879 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20878 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20877 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20876 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20875 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20874 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20873 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-2488 | High | 8.0 | 2022-07-20 | A vulnerability was found in WAVLINK WN535K2 and WN535K3 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/touchlist_… |
CVE-2022-2487 | High | 8.0 | 2022-07-20 | A vulnerability has been found in WAVLINK WN535K2 and WN535K3 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/nightled… |
CVE-2022-2486 | High | 8.0 | 2022-07-20 | A vulnerability, which was classified as critical, was found in WAVLINK WN535K2 and WN535K3. This affects an unknown part of the file /cgi-bin/mesh.cgi?page=up… |
CVE-2022-34540 | High | 8.8 | 2022-07-19 | Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a command injection vulnerability in the component /admin/vca/license/license_… |
CVE-2022-34539 | High | 8.8 | 2022-07-19 | Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a command injection vulnerability in the component /admin/curltest.cgi. This v… |
CVE-2022-34538 | High | 8.8 | 2022-07-19 | Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a command injection vulnerability in the component /admin/vca/bia/addacph.cgi… |
CVE-2022-27373 | High | 8.8 | 2022-07-19 | Shanghai Feixun Data Communication Technology Co., Ltd router fir302b A2 was discovered to contain a remote command execution (RCE) vulnerability via the Ping… |
CVE-2022-27483 | High | 7.2 | 2022-07-19 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager version 7.0.0 through 7.0.3, 6.4.0 throug… |
CVE-2022-33891 | High | 8.8 | 2022-07-18 | The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a… |
CVE-2022-26482 | High | 7.2 | 2022-07-17 | An issue was discovered in Poly EagleEye Director II before 2.2.2.1. os.system command injection can be achieved by an admin. |
CVE-2022-26481 | High | 8.8 | 2022-07-17 | An issue was discovered in Poly Studio before 3.7.0. Command Injection can occur via the CN field of a Create Certificate Signing Request (CSR) action. |
CVE-2022-32212 | High | 8.1 | 2022-07-14 | A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypas… |
CVE-2022-28375 | Critical | 9.8 | 2022-07-14 | Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the crtcswitchsimprofile function of the crtc… |
CVE-2022-28374 | High | 8.8 | 2022-07-14 | Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the DMACC URLs on the Settings page of the En… |
CVE-2022-28373 | Critical | 9.8 | 2022-07-14 | Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not properly sanitize user-controlled parameters within the crtcreadpartition function of the crtcrpc… |
CVE-2022-34753 | High | 8.8 | 2022-07-13 | A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote root exploit… |
CVE-2022-28888 | Critical | 9.8 | 2022-07-13 | Spryker Commerce OS 1.4.2 allows Remote Command Execution. |
CVE-2022-22997 | Medium | 6.8 | 2022-07-12 | Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially allowed an attacke… |
CVE-2021-36667 | High | 7.8 | 2022-07-12 | Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the local HTTP server du… |
CVE-2022-31138 | High | 8.8 | 2022-07-11 | mailcow is a mailserver suite. Prior to mailcow-dockerized version 2022-06a, an extended privilege vulnerability can be exploited by manipulating the custom pa… |
CVE-2022-31137 | Critical | 10.0 | 2022-07-08 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 6.1.1.0 are subject to a remote code execution vulnera… |
CVE-2022-32054 | Critical | 9.8 | 2022-07-07 | Tenda AC10 US_AC10V1.0RTL_V15.03.06.26_multi_TD01 was discovered to contain a remote code execution (RCE) vulnerability via the lanIp parameter. |
CVE-2022-25048 | High | 8.8 | 2022-07-07 | Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user. |
CVE-2022-34597 | Critical | 9.8 | 2022-07-06 | Tenda AX1806 v1.0.0.1 was discovered to contain a command injection vulnerability via the function WanParameterSetting. |
CVE-2022-34596 | Critical | 9.8 | 2022-07-06 | Tenda AX1803 v1.0.0.1_2890 was discovered to contain a command injection vulnerability via the function WanParameterSetting. |
CVE-2022-34595 | Critical | 9.8 | 2022-07-06 | Tenda AX1803 v1.0.0.1_2890 was discovered to contain a command injection vulnerability via the function setipv6status. |
CVE-2022-33948 | High | 8.8 | 2022-07-04 | HOME SPOT CUBE2 V102 contains an OS command injection vulnerability due to improper processing of data received from DHCP server. An adjacent attacker may exec… |
CVE-2022-2185 | Critical | 9.9 | 2022-07-01 | A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where… |
CVE-2022-2253 | Critical | 9.1 | 2022-07-01 | A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 may send OS commands to execute on the host server. |
CVE-2014-0156 | Critical | 9.8 | 2022-06-30 | Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as arguments. If untrusted inp… |
CVE-2022-33329 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets… |
CVE-2022-33328 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets… |
CVE-2022-33327 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets… |
CVE-2022-33326 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets… |
CVE-2022-33325 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets… |