CWE-78 · OS Command Injection (page 41)
Page 41 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-29169 | High | 8.8 | 2023-04-27 | mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. |
CVE-2023-29150 | High | 8.8 | 2023-04-27 | mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. |
CVE-2023-28716 | High | 8.8 | 2023-04-27 | mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. |
CVE-2023-28400 | High | 8.8 | 2023-04-27 | mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. |
CVE-2023-28384 | High | 8.8 | 2023-04-27 | mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. |
CVE-2023-25313 | Critical | 9.8 | 2023-04-25 | OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to t… |
CVE-2023-28771 | Critical | 9.8 | 2023-04-25 | Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series… |
CVE-2023-30628 | High | 8.8 | 2023-04-24 | Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and prior, the `changelog.yml` workflow is v… |
CVE-2023-27991 | High | 8.8 | 2023-04-24 | The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware ve… |
CVE-2023-25507 | High | 7.2 | 2023-04-22 | NVIDIA DGX-1 BMC contains a vulnerability in the SPX REST API, where an attacker with the appropriate level of authorization can inject arbitrary shell command… |
CVE-2023-30621 | Critical | 9.8 | 2023-04-21 | Gipsy is a multi-purpose discord bot which aim to be as modular and user-friendly as possible. In versions prior to 1.3 users can run command on the host machi… |
CVE-2023-2131 | Critical | 10.0 | 2023-04-20 | Versions of INEA ME RTU firmware prior to 3.36 are vulnerable to OS command injection, which could allow an attacker to remotely execute arbitrary code. |
CVE-2023-25759 | Medium | 5.4 | 2023-04-19 | OS Command Injection in TripleData Reporting Engine in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated users to run unprivileged OS le… |
CVE-2023-29412 | Critical | 9.8 | 2023-04-18 | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote code execution… |
CVE-2023-25555 | Medium | 5.6 | 2023-04-18 | A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow a use… |
CVE-2023-25554 | High | 7.8 | 2023-04-18 | A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that allows a local privilege es… |
CVE-2023-28983 | High | 8.8 | 2023-04-17 | An OS Command Injection vulnerability in gRPC Network Operations Interface (gNOI) server module of Juniper Networks Junos OS Evolved allows an authenticated, l… |
CVE-2021-33990 | Critical | 9.8 | 2023-04-16 | Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor disputes this issue because the… |
CVE-2022-38841 | High | 8.8 | 2023-04-16 | Linksys AX3200 1.1.00 is vulnerable to OS command injection by authenticated users via shell metacharacters to the diagnostics traceroute page. |
CVE-2023-2091 | High | 7.8 | 2023-04-15 | A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS. Affected by this vulnerability is the function adjust_cpufreq_scalin… |
CVE-2023-29805 | Critical | 9.8 | 2023-04-14 | WFS-SR03 v1.0.3 was discovered to contain a command injection vulnerability via the pro_stor_canceltrans_handler_part_19 function. |
CVE-2023-29804 | High | 8.8 | 2023-04-14 | WFS-SR03 v1.0.3 was discovered to contain a command injection vulnerability via the sys_smb_pwdmod function. |
CVE-2023-27216 | High | 8.8 | 2023-04-12 | An issue found in D-Link DSL-3782 v.1.03 allows remote authenticated users to execute arbitrary code as root via the network settings page. |
CVE-2023-27826 | High | 8.8 | 2023-04-12 | SeowonIntech SWC 5100W WIMAX Bootloader 1.18.19.0, HW 0.0.7.0, and FW 1.11.0.1, 1.9.9.4 are vulnerable to OS Command Injection. which allows attackers to take… |
CVE-2022-43948 | Medium | 6.7 | 2023-04-11 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0.3, FortiADC version… |
CVE-2022-40679 | High | 7.8 | 2023-04-11 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 5.x all versions, 6.0 all versions, 6.1 all versions, 6… |
CVE-2023-27917 | High | 8.8 | 2023-04-11 | OS command injection vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker who can access Network Maintenance page to execute… |
CVE-2023-27076 | Critical | 9.8 | 2023-04-10 | Command injection vulnerability found in Tenda G103 v.1.0.0.5 allows attacker to execute arbitrary code via a the language parameter. |
CVE-2023-20153 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injectio… |
CVE-2023-20122 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in the restricted shell of Cisco Evolved Programmable Network Manager (EPNM), Cisco Identity Services Engine (ISE), and Cisco Prime In… |
CVE-2023-20121 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in the restricted shell of Cisco Evolved Programmable Network Manager (EPNM), Cisco Identity Services Engine (ISE), and Cisco Prime In… |
CVE-2023-20117 | High | 7.2 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticate… |
CVE-2023-20152 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injectio… |
CVE-2023-20128 | High | 7.2 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticate… |
CVE-2023-20023 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injectio… |
CVE-2023-20022 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injectio… |
CVE-2023-20021 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injectio… |
CVE-2023-26921 | Critical | 9.8 | 2023-04-04 | OS Command Injection vulnerability in quectel AG550QCN allows attackers to execute arbitrary commands via ql_atfwd. |
CVE-2023-28726 | High | 7.5 | 2023-03-31 | Panasonic AiSEG2 versions 2.80F through 2.93A allows remote attackers to execute arbitrary OS commands. |
CVE-2023-26482 | Critical | 9.0 | 2023-03-30 | Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are desig… |
CVE-2022-43647 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is… |
CVE-2022-43646 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is… |
CVE-2022-43645 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is… |
CVE-2022-43644 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is… |
CVE-2022-43643 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is… |
CVE-2022-43642 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is… |
CVE-2022-43633 | Medium | 6.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authenticati… |
CVE-2022-43632 | Medium | 6.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authenticati… |
CVE-2022-43631 | Medium | 6.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authenticati… |
CVE-2022-43629 | Medium | 6.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authenticati… |
CVE-2022-43628 | Medium | 6.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authenticati… |
CVE-2022-43627 | Medium | 6.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authenticati… |
CVE-2022-43626 | Medium | 6.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authenticati… |
CVE-2022-43624 | Medium | 6.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authenticati… |
CVE-2022-42433 | High | 8.0 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR841N TL-WR841N(US)_V14_220121 routers… |
CVE-2022-3210 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication i… |
CVE-2022-27647 | High | 8.0 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Although… |
CVE-2023-23355 | Medium | 6.6 | 2023-03-29 | An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated… |
CVE-2023-27886 | Critical | 9.8 | 2023-03-28 | Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated OS command injection vulnerability. This can be exploited to inject and execute arbitra… |
CVE-2023-27394 | Critical | 9.8 | 2023-03-28 | Osprey Pump Controller version 1.01 is vulnerable an unauthenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary… |
CVE-2023-28102 | High | 8.3 | 2023-03-27 | discordrb is an implementation of the Discord API using Ruby. In discordrb before commit `91e13043ffa` the `encoder.rb` file unsafely constructs a shell string… |
CVE-2023-28627 | High | 8.3 | 2023-03-27 | pymedusa is an automatic video library manager for TV Shows. In versions prior 1.0.12 an attacker with access to the web interface can update the git executabl… |
CVE-2023-24841 | High | 7.2 | 2023-03-27 | HGiga MailSherlock query function for connection log has a vulnerability of insufficient filtering for user input. An authenticated remote attacker with admini… |
CVE-2023-24837 | High | 8.8 | 2023-03-27 | HGiga PowerStation remote management function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can explo… |
CVE-2018-25083 | Critical | 9.8 | 2023-03-27 | The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name. |
CVE-2022-28495 | Critical | 9.8 | 2023-03-24 | TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx para… |
CVE-2023-20082 | Medium | 6.1 | 2023-03-23 | A vulnerability in Cisco IOS XE Software for Cisco Catalyst 9300 Series Switches could allow an authenticated, local attacker with level-15 privileges or an un… |
CVE-2023-20056 | Medium | 6.5 | 2023-03-23 | A vulnerability in the management CLI of Cisco access point (AP) software could allow an authenticated, local attacker to cause a denial of service (DoS) condi… |
CVE-2022-28491 | Critical | 9.8 | 2023-03-23 | TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 contains a command injection vulnerability in the NTPSyncWithHost function via the host_name parameter. This vul… |
CVE-2022-28494 | Critical | 9.8 | 2023-03-23 | TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setUpgradeFW function via the filename paramet… |
CVE-2022-37337 | Critical | 9.1 | 2023-03-21 | A command execution vulnerability exists in the access control functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted HTTP request can lead t… |
CVE-2023-28617 | High | 7.8 | 2023-03-19 | org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name… |
CVE-2023-25280 | Critical | 9.8 | 2023-03-16 | OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parame… |
CVE-2023-24229 | High | 7.8 | 2023-03-15 | DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system commands via the mai… |
CVE-2023-28343 | Critical | 9.8 | 2023-03-14 | OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, beca… |
CVE-2023-25617 | Critical | 9.0 | 2023-03-14 | SAP Business Object (Adaptive Job Server) - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects execution is enabled… |
CVE-2023-25279 | Critical | 9.8 | 2023-03-13 | OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload. |
CVE-2023-24762 | Critical | 9.8 | 2023-03-13 | OS Command injection vulnerability in D-Link DIR-867 DIR_867_FW1.30B07 allows attackers to execute arbitrary commands via a crafted LocalIPAddress parameter fo… |
CVE-2023-1350 | Medium | 6.3 | 2023-03-11 | A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the comp… |
CVE-2023-27985 | High | 7.8 | 2023-03-09 | emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of complia… |
CVE-2023-1277 | High | 7.8 | 2023-03-08 | A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin. Affected is the function InstallSnap of… |
CVE-2023-25395 | Critical | 9.8 | 2023-03-08 | TOTOlink A7100RU V7.4cu.2313_B20191024 router was discovered to contain a command injection vulnerability via the ou parameter at /setting/delStaticDhcpRules. |
CVE-2022-39951 | High | 7.2 | 2023-03-07 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version… |
CVE-2023-26490 | High | 7.3 | 2023-03-04 | mailcow is a dockerized email package, with multiple containers linked in one bridged network. The Sync Job feature - which can be made available to standard u… |
CVE-2023-26213 | High | 7.2 | 2023-03-03 | On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_… |
CVE-2023-20075 | Medium | 6.0 | 2023-03-01 | Vulnerability in the CLI of Cisco Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary commands. These vulnerability is d… |
CVE-2023-26759 | High | 8.8 | 2023-02-27 | Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an OS command injection vulnerability via calls made to the XMService component. |
CVE-2022-2024 | Critical | 9.8 | 2023-02-25 | OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11. |
CVE-2023-26039 | High | 7.1 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2022-36231 | Critical | 9.8 | 2023-02-23 | pdf_info 0.5.3 is vulnerable to Command Execution because the Ruby code uses backticks instead of Open3. |
CVE-2023-20050 | Medium | 4.4 | 2023-02-23 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2023-20015 | Medium | 6.0 | 2023-02-23 | A vulnerability in the CLI of Cisco Firepower 4100 Series, Cisco Firepower 9300 Security Appliances, and Cisco UCS 6200, 6300, 6400, and 6500 Series Fabric Int… |
CVE-2023-0935 | Medium | 6.3 | 2023-02-21 | A vulnerability was found in DolphinPHP up to 1.5.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file c… |
CVE-2022-48337 | Critical | 9.8 | 2023-02-20 | GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system… |
CVE-2022-46303 | High | 8.0 | 2023-02-20 | Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management per… |
CVE-2023-23779 | Medium | 6.8 | 2023-02-16 | Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in FortiWeb version 7.0.1 and belo… |
CVE-2022-33869 | High | 8.8 | 2023-02-16 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiWAN 4.0.0 through 4.5.9 may all… |
CVE-2022-30303 | High | 8.8 | 2023-02-16 | An improper neutralization of special elements used in an os command ('OS Command Injection') [CWE-78] in FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6… |
CVE-2022-27489 | High | 7.2 | 2023-02-16 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.0.0 through 7.0.3, 5.3.2, 4.2.4 and be… |
CVE-2022-27482 | High | 7.8 | 2023-02-16 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.1, 6.2.0 through 6… |