CWE-78 · OS Command Injection (page 41)
Page 41 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-33314 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network reques… |
CVE-2022-33313 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network reques… |
CVE-2022-33312 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network reques… |
CVE-2022-31885 | Critical | 9.8 | 2022-06-28 | Marval MSM v14.19.0.12476 is vulnerable to OS Command Injection due to the insecure handling of VBScripts. |
CVE-2022-32092 | Critical | 9.8 | 2022-06-27 | D-Link DIR-645 v1.03 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter at __ajax_explorer.sgi. |
CVE-2022-28171 | High | 7.5 | 2022-06-27 | The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attac… |
CVE-2022-31767 | Critical | 9.8 | 2022-06-24 | IBM CICS TX Standard and Advanced 11.1 could allow a remote attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-… |
CVE-2022-32534 | High | 8.8 | 2022-06-23 | The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 and earlier was found to be vulnerable to command injection through its diagnostics web inte… |
CVE-2022-2068 | High | 7.3 | 2022-06-21 | In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise she… |
CVE-2022-26147 | Critical | 9.8 | 2022-06-21 | The Quectel RG502Q-EA modem before 2022-02-23 allow OS Command Injection. |
CVE-2022-31795 | Critical | 9.8 | 2022-06-20 | An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnerability resides in the grel_finfo functi… |
CVE-2022-31794 | Critical | 9.8 | 2022-06-20 | An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnerability resides in the requestTempFile f… |
CVE-2022-30329 | Critical | 9.8 | 2022-06-16 | An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. An OS injection vulnerability exists within the web interface, allowing an attacker with v… |
CVE-2022-30023 | High | 8.8 | 2022-06-16 | Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function. |
CVE-2022-33140 | High | 8.8 | 2022-06-15 | The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution… |
CVE-2022-31311 | Critical | 9.8 | 2022-06-14 | An issue in adm.cgi of WAVLINK AERIAL X 1200M M79X3.V5030.180719 allows attackers to execute arbitrary commands via a crafted POST request. |
CVE-2022-31446 | Critical | 9.8 | 2022-06-14 | Tenda AC18 router V15.03.05.19 and V15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the Mac parameter at ip/goform/WriteF… |
CVE-2022-30311 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-refresh-request" POST request doesn’t check for port syntax. This… |
CVE-2022-30310 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-acknerr-request" POST request doesn’t check for port syntax. This… |
CVE-2022-30309 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax… |
CVE-2022-30308 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax… |
CVE-2021-41738 | High | 8.8 | 2022-06-11 | ZeroShell 3.9.5 has a command injection vulnerability in /cgi-bin/kerbynet IP parameter, which may allow an authenticated attacker to execute system commands. |
CVE-2022-1986 | Critical | 9.8 | 2022-06-09 | OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9. |
CVE-2019-25066 | Medium | 6.3 | 2022-06-09 | A vulnerability has been found in ajenti 2.1.31 and classified as critical. This vulnerability affects unknown code of the component API. The manipulation lead… |
CVE-2019-25065 | Medium | 6.3 | 2022-06-09 | A vulnerability was found in OpenNetAdmin 18.1.1. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads t… |
CVE-2022-29013 | Critical | 9.8 | 2022-06-09 | A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST… |
CVE-2022-1703 | High | 8.8 | 2022-06-08 | Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attacker to inject OS Com… |
CVE-2022-24065 | High | 8.1 | 2022-06-08 | The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code wi… |
CVE-2021-35531 | Medium | 6.7 | 2022-06-07 | Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub CoreTec 4 product, allows an attacker with acc… |
CVE-2022-31486 | High | 8.8 | 2022-06-06 | An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts prod… |
CVE-2022-31479 | Critical | 9.6 | 2022-06-06 | An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection… |
CVE-2021-42890 | Critical | 9.8 | 2022-06-03 | TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function NTPSyncWithHost of the file system.so which can control hostTime t… |
CVE-2021-42888 | Critical | 9.8 | 2022-06-03 | TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setLanguageCfg of the file global.so which can control langType to… |
CVE-2021-42885 | Critical | 9.8 | 2022-06-03 | TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceMac of the file global.so which can control deviceName to… |
CVE-2021-42884 | Critical | 9.8 | 2022-06-03 | TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceName of the file global.so which can control thedeviceNam… |
CVE-2022-26868 | Medium | 6.4 | 2022-06-02 | Dell EMC PowerStore versions 2.0.0.x, 2.0.1.x, and 2.1.0.x are vulnerable to a command injection flaw. An authenticated attacker could potentially exploit this… |
CVE-2021-42875 | Critical | 9.8 | 2022-06-02 | TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the file lib/cste_modules/system.so to cont… |
CVE-2022-30425 | High | 8.8 | 2022-06-02 | Tenda Technology Co.,Ltd HG6 3.3.0-210926 was discovered to contain a command injection vulnerability via the pingAddr and traceAddr parameters. This vulnerabi… |
CVE-2021-44080 | High | 7.2 | 2022-06-02 | A Command Injection vulnerability in httpd web server (setup.cgi) in SerComm h500s, FW: lowi-h500s-v3.4.22 allows logged in administrators to arbitrary OS comm… |
CVE-2021-42872 | Critical | 9.8 | 2022-06-02 | TOTOLINK EX1200T V4.1.2cu.5215 is affected by a command injection vulnerability that can remotely execute arbitrary code. |
CVE-2021-34084 | Critical | 9.8 | 2022-06-02 | OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary commands via the metada… |
CVE-2021-34083 | High | 8.1 | 2022-06-02 | Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browse… |
CVE-2021-34082 | Critical | 9.8 | 2022-06-02 | OS Command Injection vulnerability in allenhwkim proctree through 0.1.1 and commit 0ac10ae575459457838f14e21d5996f2fa5c7593 for Node.js, allows attackers to ex… |
CVE-2021-34081 | High | 8.8 | 2022-06-02 | OS Command Injection vulnerability in bbultman gitsome through 0.2.3 allows attackers to execute arbitrary commands via a crafted tag name of the target git re… |
CVE-2021-34080 | Critical | 9.8 | 2022-06-02 | OS Command Injection vulnerability in es128 ssl-utils 1.0.0 for Node.js allows attackers to execute arbitrary commands via unsanitized shell metacharacters pro… |
CVE-2021-34079 | Critical | 9.8 | 2022-06-02 | OS Command injection vulnerability in Mintzo Docker-Tester through 1.2.1 allows attackers to execute arbitrary commands via shell metacharacters in the 'ports'… |
CVE-2021-34078 | High | 8.8 | 2022-06-02 | lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file. |
CVE-2022-20797 | Medium | 5.5 | 2022-05-27 | A vulnerability in the web-based management interface of Cisco Secure Network Analytics, formerly Cisco Stealthwatch Enterprise, could allow an authenticated… |
CVE-2022-29256 | Medium | 6.5 | 2022-05-25 | sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at `npm install` tim… |
CVE-2022-29337 | Critical | 9.8 | 2022-05-24 | C-DATA FD702XW-X-R430 v2.1.13_X001 was discovered to contain a command injection vulnerability via the va_cmd parameter in formlanipv6. This vulnerability allo… |
CVE-2022-26532 | High | 7.8 | 2022-05-24 | A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware v… |
CVE-2022-1813 | Critical | 9.8 | 2022-05-22 | OS Command Injection in GitHub repository yogeshojha/rengine prior to 1.2.0. |
CVE-2022-31245 | High | 8.8 | 2022-05-20 | mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug option in conjunction… |
CVE-2021-34111 | Critical | 9.8 | 2022-05-20 | Thecus 4800Eco was discovered to contain a command injection vulnerability via the username parameter in /adm/setmain.php. |
CVE-2022-30105 | Critical | 9.8 | 2022-05-18 | In Belkin N300 Firmware 1.00.08, the script located at /setting_hidden.asp, which is accessible before and after configuring the device, exhibits multiple remo… |
CVE-2021-42852 | High | 8.0 | 2022-05-18 | A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execute operating system… |
CVE-2022-29516 | Critical | 9.8 | 2022-05-18 | The web console of FUJITSU Network IPCOM series (IPCOM EX2 IN(3200, 3500), IPCOM EX2 LB(1100, 3200, 3500), IPCOM EX2 SC(1100, 3200, 3500), IPCOM EX2 NW(1100, 3… |
CVE-2022-1362 | Medium | 5.0 | 2022-05-17 | The affected On-Premise cnMaestro is vulnerable inside a specific route where a user can upload a crafted package to the system. An attacker could abuse this u… |
CVE-2022-1360 | High | 8.2 | 2022-05-17 | The affected On-Premise cnMaestro is vulnerable to execution of code on the cnMaestro hosting server. This could allow a remote attacker to change server confi… |
CVE-2022-1359 | Medium | 5.7 | 2022-05-17 | The affected On-Premise cnMaestro is vulnerable to an arbitrary file-write through improper limitation of a pathname to a restricted directory inside a specifi… |
CVE-2022-1357 | Critical | 9.8 | 2022-05-17 | The affected On-Premise cnMaestro allows an unauthenticated attacker to access the cnMaestro server and execute arbitrary code in the privileges of the web ser… |
CVE-2022-1356 | High | 7.1 | 2022-05-17 | cnMaestro is vulnerable to a local privilege escalation. By default, a user does not have root privileges. However, a user can run scripts as sudo, which could… |
CVE-2022-24394 | High | 8.8 | 2022-05-17 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “update_checkfile” value… |
CVE-2022-24393 | High | 8.8 | 2022-05-17 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “check_vertica_upgrade”… |
CVE-2022-24392 | High | 8.8 | 2022-05-17 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “feed_comm_test” value f… |
CVE-2022-24390 | High | 8.8 | 2022-05-17 | Vulnerability in rconfig “remote_text_file” enables an attacker with user level access to the CLI to inject user level commands into Fidelis Network and Decept… |
CVE-2022-24389 | High | 8.8 | 2022-05-17 | Vulnerability in rconfig “cert_utils” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception Co… |
CVE-2022-24388 | High | 8.8 | 2022-05-17 | Vulnerability in rconfig “date” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandP… |
CVE-2022-23673 | High | 7.2 | 2022-05-17 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23672 | High | 7.2 | 2022-05-17 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23667 | High | 7.2 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23666 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23665 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23664 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23663 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23662 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23661 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2021-42897 | Critical | 9.8 | 2022-05-16 | A remote command execution (RCE) vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. The $_POST[r_name] is directly passed into the $my… |
CVE-2021-42969 | High | 8.8 | 2022-05-13 | Certain Anaconda3 2021.05 are affected by OS command injection. When a user installs Anaconda, an attacker can create a new file and write something in usercus… |
CVE-2022-26518 | High | 8.8 | 2022-05-12 | An OS command injection vulnerability exists in the console infactory_net functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of n… |
CVE-2022-26420 | High | 8.8 | 2022-05-12 | An OS command injection vulnerability exists in the console infactory_port functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of… |
CVE-2022-26085 | High | 8.8 | 2022-05-12 | An OS command injection vulnerability exists in the httpd wlscan_ASP functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can… |
CVE-2022-26075 | High | 8.8 | 2022-05-12 | An OS command injection vulnerability exists in the console infactory_wlan functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of… |
CVE-2022-26042 | High | 8.8 | 2022-05-12 | An OS command injection vulnerability exists in the daretools binary functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request c… |
CVE-2022-26007 | High | 7.2 | 2022-05-12 | An OS command injection vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request ca… |
CVE-2022-29303 | Critical | 9.8 | 2022-05-12 | SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php. |
CVE-2022-29539 | Critical | 9.8 | 2022-05-12 | resi-calltrace in RESI Gemini-Net 4.2 is affected by OS Command Injection. It does not properly check the parameters sent as input before they are processed on… |
CVE-2022-30525 | Critical | 9.8 | 2022-05-12 | A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5… |
CVE-2021-30361 | Medium | 6.7 | 2022-05-11 | The Check Point Gaia Portal's GUI Clients allowed authenticated administrators with permission for the GUI Clients settings to inject a command that would run… |
CVE-2022-22454 | High | 7.8 | 2022-05-10 | IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on the system by sending a specially crafted… |
CVE-2022-28915 | Critical | 9.8 | 2022-05-10 | D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a command injection vulnerability via the admuser and admpass parameters in /goform/setSysAdm. |
CVE-2022-28913 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUploadSetting. |
CVE-2022-28912 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUpgradeFW. |
CVE-2022-28911 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/CloudACMunualUpdate. |
CVE-2022-28910 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the devicename parameter in /setting/setDeviceName. |
CVE-2022-28909 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the webwlanidx parameter in /setting/setWebWlanIdx. |
CVE-2022-28908 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the ipdoamin parameter in /setting/setDiagnosisCfg. |
CVE-2022-28907 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the hosttime function in /setting/NTPSyncWithHost. |
CVE-2022-28906 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the langtype parameter in /setting/setLanguageCfg. |
CVE-2022-28905 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the devicemac parameter in /setting/setDeviceName. |