CWE-78 · OS Command Injection (page 40)
Page 40 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-37173 | Critical | 9.8 | 2023-07-07 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function. |
CVE-2023-37172 | Critical | 9.8 | 2023-07-07 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function. |
CVE-2023-37171 | Critical | 9.8 | 2023-07-07 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function. |
CVE-2023-37170 | Critical | 9.8 | 2023-07-07 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the lang parameter in the se… |
CVE-2023-25583 | High | 7.2 | 2023-07-06 | Two OS command injection vulnerabilities exist in the zebra vlan_name functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead… |
CVE-2023-25582 | High | 7.2 | 2023-07-06 | Two OS command injection vulnerabilities exist in the zebra vlan_name functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead… |
CVE-2023-24595 | High | 7.2 | 2023-07-06 | An OS command injection vulnerability exists in the ys_thirdparty system_user_script functionality of Milesight UR32L v32.3.0.5. A specially crafted series of… |
CVE-2023-24582 | High | 8.8 | 2023-07-06 | Two OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5. A specially crafted network requ… |
CVE-2023-24520 | High | 8.8 | 2023-07-06 | Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. A specially-crafted networ… |
CVE-2023-24519 | High | 8.8 | 2023-07-06 | Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. A specially-crafted networ… |
CVE-2023-23550 | High | 7.2 | 2023-07-06 | An OS command injection vulnerability exists in the ys_thirdparty user_delete functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet ca… |
CVE-2023-22659 | High | 7.2 | 2023-07-06 | An os command injection vulnerability exists in the libzebra.so change_hostname functionality of Milesight UR32L v32.3.0.5. A specially-crafted network packets… |
CVE-2023-22653 | High | 8.8 | 2023-07-06 | An OS command injection vulnerability exists in the vtysh_ubus tcpdump_start_cb functionality of Milesight UR32L v32.3.0.5. A specially crafted HTTP request ca… |
CVE-2023-22371 | High | 8.1 | 2023-07-06 | An os command injection vulnerability exists in the liburvpn.so create_private_key functionality of Milesight VPN v2.0.2. A specially-crafted network request c… |
CVE-2023-22365 | High | 7.2 | 2023-07-06 | An OS command injection vulnerability exists in the ys_thirdparty check_system_user functionality of Milesight UR32L v32.3.0.5. A specially crafted set of netw… |
CVE-2023-22299 | High | 8.8 | 2023-07-06 | An OS command injection vulnerability exists in the vtysh_ubus _get_fw_logs functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can… |
CVE-2023-36622 | High | 7.2 | 2023-07-05 | The websocket configuration endpoint of the Loxone Miniserver Go Gen.2 before 14.1.5.9 allows remote authenticated administrators to inject arbitrary OS comman… |
CVE-2023-27198 | Medium | 6.8 | 2023-07-05 | PAX A930 device with PayDroid_7.1.1_Virgo_V04.5.02_20220722 can allow the execution of arbitrary commands by using the exec service and including a specific wo… |
CVE-2023-3314 | High | 8.1 | 2023-07-03 | A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip file(s). Incomplete neutralization of external commands used to co… |
CVE-2023-3313 | High | 7.8 | 2023-07-03 | An OS common injection vulnerability exists in the ESM certificate API, whereby incorrectly neutralized special elements may have allowed an unauthorized user… |
CVE-2023-22816 | Medium | 6.0 | 2023-06-30 | A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an attacker to build files… |
CVE-2023-22815 | Medium | 6.2 | 2023-06-30 | Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute code in the context… |
CVE-2023-32622 | High | 7.2 | 2023-06-30 | Improper neutralization of special elements in WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to execute OS… |
CVE-2023-36143 | High | 8.8 | 2023-06-30 | Maxprint Maxlink 1200G v3.4.11E has an OS command injection vulnerability in the "Diagnostic tool" functionality of the device. |
CVE-2022-44720 | Critical | 9.8 | 2023-06-29 | An issue was discovered in Weblib Ucopia before 6.0.13. OS Command Injection injection can occur, related to chroot. |
CVE-2023-26613 | Critical | 9.8 | 2023-06-29 | An OS command injection vulnerability in D-Link DIR-823G firmware version 1.02B05 allows unauthorized attackers to execute arbitrary operating system commands… |
CVE-2023-3450 | Medium | 4.7 | 2023-06-28 | A vulnerability was found in Ruijie RG-BCR860 2.5.13 and classified as critical. This issue affects some unknown processing of the component Network Diagnostic… |
CVE-2023-2625 | Critical | 9.0 | 2023-06-28 | A vulnerability exists that can be exploited by an authenticated client that is connected to the same network segment as the CoreTec 4, having any level of acc… |
CVE-2023-26134 | Critical | 9.8 | 2023-06-28 | Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo () fails to saniti… |
CVE-2023-3333 | High | 7.2 | 2023-06-28 | Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG… |
CVE-2023-34420 | High | 7.2 | 2023-06-26 | A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web API. |
CVE-2023-30261 | Critical | 9.8 | 2023-06-26 | Command Injection vulnerability in OpenWB 1.6 and 1.7 allows remote attackers to run arbitrary commands via crafted GET request. |
CVE-2023-34254 | High | 7.6 | 2023-06-23 | The GLPI Agent is a generic management agent. Prior to version 1.5, if glpi-agent is running remoteinventory task against an Unix platform with ssh command, an… |
CVE-2023-30258 | Critical | 9.8 | 2023-06-23 | Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request. |
CVE-2023-35174 | High | 8.6 | 2023-06-22 | Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a `livebook://` link from a browser… |
CVE-2023-24261 | High | 7.2 | 2023-06-21 | A vulnerability in GL.iNET GL-E750 Mudi before firmware v3.216 allows authenticated attackers to execute arbitrary code via a crafted POST request. |
CVE-2023-33869 | Medium | 6.3 | 2023-06-20 | Enphase Envoy versions D7.0.88 is vulnerable to a command injection exploit that may allow an attacker to execute root commands. |
CVE-2023-27992 | Critical | 9.8 | 2023-06-19 | The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21… |
CVE-2023-34642 | High | 7.8 | 2023-06-19 | KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on Windows 10. This issue can allow attacke… |
CVE-2022-48472 | Critical | 9.8 | 2023-06-16 | A Huawei printer has a system command injection vulnerability. Successful exploitation could lead to remote code execution. Affected product versions include:B… |
CVE-2023-34800 | Critical | 9.8 | 2023-06-15 | D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at genacgi_main. |
CVE-2022-32752 | High | 7.2 | 2023-06-15 | IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a spe… |
CVE-2023-32548 | High | 8.1 | 2023-06-13 | OS command injection vulnerability exists in WPS Office version 10.8.0.6186. If a remote attacker who can conduct a man-in-the-middle attack connects the produ… |
CVE-2023-31198 | High | 7.2 | 2023-06-13 | OS command injection vulnerability exists in Wi-Fi AP UNIT allows. If this vulnerability is exploited, a remote authenticated attacker with an administrative p… |
CVE-2023-30764 | Critical | 9.8 | 2023-06-13 | OS command injection vulnerability exists in KB-AHR series and KB-IRIP series. If this vulnerability is exploited, an arbitrary OS command may be executed on t… |
CVE-2023-28000 | Medium | 6.7 | 2023-06-13 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC CLI 7.1.0, 7.0.0 through 7.0.3, 6.2.0 through 6.2.4, 6… |
CVE-2023-26210 | High | 7.8 | 2023-06-13 | Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] vulnerability in Fortinet allows a… |
CVE-2023-34343 | High | 7.2 | 2023-06-12 | AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can inject arbitrary shell commands, which may lead to cod… |
CVE-2023-34334 | High | 7.2 | 2023-06-12 | AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can inject arbitrary shell commands, which may lead to cod… |
CVE-2023-34105 | High | 7.5 | 2023-06-12 | SRS is a real-time video server supporting RTMP, WebRTC, HLS, HTTP-FLV, SRT, MPEG-DASH, and GB28181. Prior to versions 5.0.157, 5.0-b1, and 6.0.48, SRS's `api-… |
CVE-2023-34108 | High | 8.8 | 2023-06-07 | mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration. A vulner… |
CVE-2023-33381 | High | 7.2 | 2023-06-06 | A command injection vulnerability was found in the ping functionality of the MitraStar GPT-2741GNAC router (firmware version AR_g5.8_110WVN0b7_2). The vulnerab… |
CVE-2023-3097 | Medium | 5.3 | 2023-06-05 | A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been rated as critical. This issue affects the function setMainSource. The… |
CVE-2023-28704 | High | 8.8 | 2023-06-02 | Furbo dog camera has insufficient filtering for special parameter of device log management function. An unauthenticated remote attacker in the Bluetooth networ… |
CVE-2023-28702 | High | 8.8 | 2023-06-02 | ASUS RT-AC86U does not filter special characters for parameters in specific web URLs. A remote attacker with normal user privileges can exploit this vulnerabil… |
CVE-2022-47616 | High | 7.2 | 2023-06-02 | Hitron CODA-5310 has insufficient filtering for specific parameters in the connection test function. A remote attacker authenticated as an administrator, can u… |
CVE-2023-33965 | Critical | 9.6 | 2023-06-01 | Brook is a cross-platform programmable network tool. The `tproxy` server is vulnerable to a drive-by command injection. An attacker may fool a victim into visi… |
CVE-2023-25539 | High | 8.4 | 2023-05-31 | Dell NetWorker 19.6.1.2, contains an OS command injection Vulnerability in the NetWorker client. A remote unauthenticated attacker could potentially exploit t… |
CVE-2023-34152 | Critical | 9.8 | 2023-05-30 | A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured. |
CVE-2022-46361 | Medium | 6.9 | 2023-05-30 | An attacker having physical access to WDM can plug USB device to gain access and execute unwanted commands. A malicious user could enter a system command along… |
CVE-2023-27988 | High | 7.2 | 2023-05-30 | The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authenticated attacker w… |
CVE-2023-30253 | High | 8.8 | 2023-05-29 | Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data. |
CVE-2023-26129 | High | 8.4 | 2023-05-27 | All versions of the package bwm-ng are vulnerable to Command Injection due to improper input sanitization in the 'check' function in the bwm-ng.js file. **No… |
CVE-2023-26128 | High | 8.4 | 2023-05-27 | All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employ… |
CVE-2023-26127 | High | 7.8 | 2023-05-27 | All versions of the package n158 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function. **Note:** To execut… |
CVE-2023-31128 | High | 8.1 | 2023-05-26 | NextCloud Cookbook is a recipe library app. Prior to commit a46d9855 on the `master` branch and commit 489bb744 on the `main-0.9.x` branch, the `pull-checks.ym… |
CVE-2023-33617 | High | 7.2 | 2023-05-23 | An OS Command Injection vulnerability in Parks Fiberlink 210 firmware version V2.1.14_X000 was found via the /boaform/admin/formPing target_addr parameter. |
CVE-2023-23694 | Medium | 4.7 | 2023-05-23 | Dell VxRail versions earlier than 7.0.450, contain(s) an OS command injection vulnerability in VxRail Manager. A local authenticated attacker could potentiall… |
CVE-2023-23693 | Medium | 6.7 | 2023-05-23 | Dell VxRail, versions prior to 7.0.450, contains an OS command injection Vulnerability in DCManager command-line utility. A local high privileged attacker cou… |
CVE-2023-28394 | High | 8.8 | 2023-05-23 | Beekeeper Studio versions prior to 3.9.9 allows a remote authenticated attacker to execute arbitrary JavaScript code with the privilege of the application on t… |
CVE-2023-28392 | High | 7.2 | 2023-05-23 | Wi-Fi AP UNIT AC-PD-WAPU v1.05_B04 and earlier, AC-PD-WAPUM v1.05_B04 and earlier, AC-PD-WAPU-P v1.05_B04P and earlier, AC-PD-WAPUM-P v1.05_B04P and earlier, A… |
CVE-2023-27521 | High | 8.8 | 2023-05-23 | OS command injection vulnerability in the mail setting page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versions prior to Ve… |
CVE-2023-27514 | High | 8.8 | 2023-05-23 | OS command injection vulnerability in the download page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versions prior to Ver.8… |
CVE-2023-32350 | High | 8.0 | 2023-05-22 | Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a Lua service. An at… |
CVE-2023-31756 | Medium | 6.7 | 2023-05-19 | A command injection vulnerability exists in the administrative web portal in TP-Link Archer VR1600V devices running firmware Versions <= 0.1.0. 0.9.1 v5006.0 B… |
CVE-2023-20164 | Medium | 6.5 | 2023-05-18 | Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform command injection attacks on the underlying o… |
CVE-2023-20163 | Medium | 6.5 | 2023-05-18 | Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform command injection attacks on the underlying o… |
CVE-2023-24805 | High | 8.8 | 2023-05-17 | cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. If you use… |
CVE-2023-1698 | Critical | 9.8 | 2023-05-15 | In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can resul… |
CVE-2020-13378 | High | 8.8 | 2023-05-12 | Loadbalancer.org Enterprise VA MAX through 8.3.8 has an OS Command Injection vulnerability that allows a remote authenticated attacker to execute arbitrary cod… |
CVE-2022-29841 | High | 8.0 | 2023-05-10 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that was caused by a command that read files from a pr… |
CVE-2023-32568 | High | 7.2 | 2023-05-10 | An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The VIOM web application does not validate user… |
CVE-2023-27407 | Critical | 9.9 | 2023-05-09 | A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web based management of affected device does not properly validate user inpu… |
CVE-2023-2574 | High | 8.8 | 2023-05-08 | Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the device name input field, which can be tri… |
CVE-2023-2573 | High | 8.8 | 2023-05-08 | Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the NTP server input field, which can be trig… |
CVE-2023-29944 | Critical | 9.8 | 2023-05-08 | Metersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution. The system command reverse-shell can be executed at the custom code snippet functi… |
CVE-2023-2564 | Critical | 10.0 | 2023-05-07 | OS Command Injection in GitHub repository sbs20/scanservjs prior to v2.27.0. |
CVE-2023-30054 | Critical | 9.8 | 2023-05-05 | TOTOLINK A7100RU V7.4cu.2313_B20191024 has a Command Injection vulnerability. An attacker can obtain a stable root shell through a specially constructed payloa… |
CVE-2023-30053 | Critical | 9.8 | 2023-05-05 | TOTOLINK A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection. |
CVE-2023-30013 | Critical | 9.8 | 2023-05-05 | TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability all… |
CVE-2023-2522 | Medium | 4.7 | 2023-05-04 | A vulnerability was found in Chengdu VEC40G 3.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /send… |
CVE-2023-24958 | High | 8.8 | 2023-05-04 | A vulnerability in the IBM TS7700 Management Interface 8.51.2.12, 8.52.200.111, 8.52.102.13, and 8.53.0.63 could allow an authenticated user to submit a specia… |
CVE-2023-27999 | High | 7.8 | 2023-05-03 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 7.2.0, 7.1.0 through 7.1.1 may allow an authenticated a… |
CVE-2023-25826 | Critical | 9.8 | 2023-05-03 | Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and exe… |
CVE-2023-28742 | High | 7.2 | 2023-05-03 | When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh. Note: Software versions which have reached En… |
CVE-2023-29778 | Critical | 9.8 | 2023-05-02 | GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread. |
CVE-2023-2479 | Critical | 9.8 | 2023-05-02 | OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4. |
CVE-2023-22919 | High | 8.8 | 2023-05-01 | The post-authentication command injection vulnerability in the Zyxel NBG6604 firmware version V1.01(ABIR.0)C0 could allow an authenticated attacker to execute… |
CVE-2023-30854 | High | 8.8 | 2023-04-28 | AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CloneSite/cloneClie… |
CVE-2023-28528 | High | 8.4 | 2023-04-28 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands… |