CWE-78 · OS Command Injection (page 42)
Page 42 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-28901 | Critical | 9.8 | 2022-05-10 | A command injection vulnerability in the component /SetTriggerLEDBlink/Blink of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to root… |
CVE-2022-28896 | Critical | 9.8 | 2022-05-10 | A command injection vulnerability in the component /setnetworksettings/SubnetMask of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to… |
CVE-2022-28895 | Critical | 9.8 | 2022-05-10 | A command injection vulnerability in the component /setnetworksettings/IPAddress of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to… |
CVE-2022-27224 | High | 7.2 | 2022-05-09 | An issue was discovered in Galleon NTS-6002-GPS 4.14.103-Galleon-NTS-6002.V12 4. An authenticated attacker can perform command injection as root via shell meta… |
CVE-2022-28584 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setWiFiWpsStart interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows a… |
CVE-2022-28583 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setWiFiWpsCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an… |
CVE-2022-28582 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setWiFiSignalCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows… |
CVE-2022-28581 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setWiFiAdvancedCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allow… |
CVE-2022-28580 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setL2tpServerCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows… |
CVE-2022-28579 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setParentalRules interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows… |
CVE-2022-28578 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setOpenVpnCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an… |
CVE-2022-28577 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the delParentalRules interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows… |
CVE-2022-28575 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setopenvpnclientcfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allo… |
CVE-2022-29592 | Critical | 9.8 | 2022-05-05 | Tenda TX9 Pro 22.03.02.10 devices allow OS command injection via set_route (called by doSystemCmd_route). |
CVE-2021-41739 | Critical | 9.8 | 2022-05-05 | A OS Command Injection vulnerability was discovered in Artica Proxy 4.30.000000. Attackers can execute OS commands in cyrus.events.php with GET param logs and… |
CVE-2022-20801 | Medium | 4.7 | 2022-05-04 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to… |
CVE-2022-20799 | Medium | 4.7 | 2022-05-04 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to… |
CVE-2022-28557 | Critical | 9.8 | 2022-05-04 | There is a command injection vulnerability at the /goform/setsambacfg interface of Tenda AC15 US_AC15V1.0BR_V15.03.05.20_multi_TDE01.bin device web, which can… |
CVE-2022-27903 | High | 8.8 | 2022-05-04 | An OS Command Injection vulnerability in the configuration parser of Eve-NG Professional through 4.0.1-65 and Eve-NG Community through 2.0.3-112 allows a remot… |
CVE-2022-28055 | Critical | 9.8 | 2022-05-04 | Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function. |
CVE-2021-43164 | High | 8.8 | 2022-05-04 | A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the updateVersi… |
CVE-2022-1292 | High | 7.3 | 2022-05-03 | The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a man… |
CVE-2021-42165 | High | 8.8 | 2022-05-03 | MitraStar GPT-2541GNAC-N1 (HGU) 100VNZ0b33 devices allow remote authenticated users to obtain root access by executing command "deviceinfo show file &&/bin/bas… |
CVE-2022-28573 | Critical | 9.8 | 2022-05-02 | D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetNTPserverSeting. This vulnerability allows attackers t… |
CVE-2022-28572 | High | 8.8 | 2022-05-02 | Tenda AX1806 v1.0.0.1 was discovered to contain a command injection vulnerability in `SetIPv6Status` function |
CVE-2022-28571 | Critical | 9.8 | 2022-05-02 | D-link 882 DIR882A1_FW130B06 was discovered to contain a command injection vulnerability in`/usr/bin/cli. |
CVE-2022-29937 | High | 8.8 | 2022-04-29 | USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent root access because some common OS commands are blocked but (f… |
CVE-2021-34602 | High | 8.8 | 2022-04-27 | In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands i… |
CVE-2021-46422 | Critical | 9.8 | 2022-04-27 | Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication. |
CVE-2021-46441 | High | 8.8 | 2022-04-27 | In the "webupg" binary of D-Link DIR-825 G1, because of the lack of parameter verification, attackers can use "cmd" parameters to execute arbitrary system comm… |
CVE-2022-1440 | Critical | 9.8 | 2022-04-22 | Command Injection vulnerability in git-interface@2.1.1 in GitHub repository yarkeev/git-interface prior to 2.1.2. If both are provided by user input, then the… |
CVE-2022-28810 | Medium | 6.8 | 2022-04-18 | Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the… |
CVE-2022-20718 | Medium | 5.5 | 2022-04-15 | Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into… |
CVE-2022-20693 | Medium | 4.7 | 2022-04-15 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected… |
CVE-2022-27188 | High | 7.8 | 2022-04-15 | OS command injection vulnerability exists in CENTUM VP R4.01.00 to R4.03.00, CENTUM VP Small R4.01.00 to R4.03.00, CENTUM VP Basic R4.01.00 to R4.03.00, and B/… |
CVE-2021-22795 | Critical | 9.1 | 2022-04-13 | A CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote code execution… |
CVE-2022-29080 | Critical | 9.8 | 2022-04-12 | The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions with a JSON object in… |
CVE-2022-1262 | High | 7.8 | 2022-04-11 | A command injection vulnerability in the protest binary allows an attacker with access to the remote command line interface to execute arbitrary commands as ro… |
CVE-2022-0999 | High | 8.8 | 2022-04-11 | An authenticated user may be able to misuse parameters to inject arbitrary operating system commands into mySCADA myPRO versions 8.25.0 and prior. |
CVE-2022-26413 | High | 8.0 | 2022-04-11 | A command injection vulnerability in the CGI program of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0 could allow a local authenticated attacker to execut… |
CVE-2022-27276 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function s… |
CVE-2022-27275 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function s… |
CVE-2022-27274 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function s… |
CVE-2022-27273 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function s… |
CVE-2022-27272 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function s… |
CVE-2022-27271 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the component… |
CVE-2022-27270 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the component… |
CVE-2022-27269 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the component… |
CVE-2022-27268 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the component… |
CVE-2021-36293 | Medium | 6.4 | 2022-04-08 | Dell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability. A local malicious admin may potentially exploit vulnerability… |
CVE-2021-36287 | High | 7.3 | 2022-04-08 | Dell VNX2 for file version 8.1.21.266 and earlier, contain an unauthenticated remote code execution vulnerability which may lead unauthenticated users to execu… |
CVE-2022-26670 | High | 8.8 | 2022-04-07 | D-Link DIR-878 has inadequate filtering for special characters in the webpage input field. An unauthenticated LAN attacker can perform command injection attack… |
CVE-2022-25597 | High | 8.8 | 2022-04-07 | ASUS RT-AC86U’s LPD service has insufficient filtering for special characters in the user request, which allows an unauthenticated LAN attacker to perform comm… |
CVE-2022-23900 | Critical | 9.8 | 2022-04-07 | A command injection vulnerability in the API of the Wavlink WL-WN531P3 router, version M31G3.V5030.201204, allows an attacker to achieve unauthorized remote co… |
CVE-2020-27373 | High | 8.8 | 2022-04-07 | Dr Trust USA iCheck Connect BP Monitor BP Testing 118 1.2.1 is vulnerable to Plain text command over BLE. |
CVE-2021-26116 | Medium | 6.7 | 2022-04-06 | An improper neutralization of special elements used in an OS command vulnerability in the command line interpreter of FortiAuthenticator before 6.3.1 may allow… |
CVE-2021-26104 | High | 7.8 | 2022-04-06 | Multiple OS command injection (CWE-78) vulnerabilities in the command line interface of FortiManager 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x… |
CVE-2021-22127 | High | 7.1 | 2022-04-06 | An improper input validation vulnerability in FortiClient for Linux 6.4.x before 6.4.3, FortiClient for Linux 6.2.x before 6.2.9 may allow an unauthenticated a… |
CVE-2021-24009 | High | 7.2 | 2022-04-06 | Multiple improper neutralization of special elements used in an OS command vulnerabilities (CWE-78) in the Web GUI of FortiWAN before 4.5.9 may allow an authen… |
CVE-2021-42324 | High | 7.4 | 2022-04-05 | An issue was discovered on DCN (Digital China Networks) S4600-10P-SI devices before R0241.0470. Due to improper parameter validation in the console interface… |
CVE-2021-32974 | Critical | 9.8 | 2022-04-01 | Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to execute c… |
CVE-2021-32933 | Critical | 10.0 | 2022-04-01 | An attacker could leverage an API to pass along a malicious file that could then manipulate the process creation command line in MDT AutoSave versions prior to… |
CVE-2022-25017 | Critical | 9.1 | 2022-04-01 | Hitron CHITA 7.2.2.0.3b6-CD devices contain a command injection vulnerability via the Device/DDNS ddnsUsername field. |
CVE-2022-24803 | Critical | 10.0 | 2022-04-01 | Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied i… |
CVE-2022-24796 | Critical | 10.0 | 2022-03-31 | RaspberryMatic is a free and open-source operating system for running a cloud-free smart-home using the homematicIP / HomeMatic hardware line of IoT devices. A… |
CVE-2022-22986 | High | 8.8 | 2022-03-31 | Netcommunity OG410X and OG810X series (Netcommunity OG410Xa, OG410Xi, OG810Xa, and OG810Xi firmware Ver.2.28 and earlier) allow an attacker on the adjacent net… |
CVE-2021-46007 | Critical | 9.8 | 2022-03-30 | totolink a3100r V5.9c.4577 is vulnerable to os command injection. The backend of a page is executing the "ping" command, and the input field does not adequatel… |
CVE-2022-26258 | Critical | 9.8 | 2022-03-28 | D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp. |
CVE-2022-27947 | High | 8.8 | 2022-03-26 | NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the ipv6_fix.cgi i… |
CVE-2022-27946 | High | 8.8 | 2022-03-26 | NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd a… |
CVE-2022-27945 | High | 8.8 | 2022-03-26 | NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd a… |
CVE-2022-27811 | Critical | 9.8 | 2022-03-24 | GNOME OCRFeeder before 0.8.4 allows OS command injection via shell metacharacters in a PDF or image filename. |
CVE-2022-26290 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/WriteFacMac. |
CVE-2022-26289 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/exeCommand. |
CVE-2022-22951 | Critical | 9.1 | 2022-03-23 | VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS command injection v… |
CVE-2022-1030 | High | 8.8 | 2022-03-23 | Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An… |
CVE-2021-27476 | Critical | 10.0 | 2022-03-23 | A vulnerability exists in the SaveConfigFile function of the RACompare Service, which may allow for OS command injection. This vulnerability may allow a remote… |
CVE-2022-24237 | High | 8.8 | 2022-03-21 | The snaptPowered2 component of Snapt Aria v12.8 was discovered to contain a command injection vulnerability. This vulnerability allows authenticated attackers… |
CVE-2021-36100 | Medium | 6.4 | 2022-03-21 | Specially crafted string in OTRS system configuration can allow the execution of any system command. |
CVE-2022-26265 | Critical | 9.8 | 2022-03-18 | Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter. |
CVE-2022-25441 | Critical | 9.8 | 2022-03-18 | Tenda AC9 v15.03.2.21 was discovered to contain a remote command execution (RCE) vulnerability via the vlanid parameter in the SetIPTVCfg function. |
CVE-2022-25438 | Critical | 9.8 | 2022-03-18 | Tenda AC9 v15.03.2.21 was discovered to contain a remote command execution (RCE) vulnerability via the SetIPTVCfg function. |
CVE-2021-45966 | Critical | 9.8 | 2022-03-18 | An issue was discovered in Pascom Cloud Phone System before 7.20.x. In the management REST API, /services/apply in exd.pl allows remote attackers to execute ar… |
CVE-2021-23632 | Medium | 6.6 | 2022-03-17 | All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS comma… |
CVE-2022-22273 | Critical | 9.8 | 2022-03-17 | Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products and older f… |
CVE-2022-27005 | Critical | 9.8 | 2022-03-15 | Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the setWanCf… |
CVE-2022-27004 | Critical | 9.8 | 2022-03-15 | Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6… |
CVE-2022-27003 | Critical | 9.8 | 2022-03-15 | Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6… |
CVE-2022-26994 | Critical | 9.8 | 2022-03-15 | Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the pptp f… |
CVE-2022-26993 | Critical | 9.8 | 2022-03-15 | Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the pppoe… |
CVE-2022-26992 | Critical | 9.8 | 2022-03-15 | Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the ddns f… |
CVE-2022-26991 | Critical | 9.8 | 2022-03-15 | Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the ntp fu… |
CVE-2022-26990 | Critical | 9.8 | 2022-03-15 | Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the firewa… |
CVE-2022-26214 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-26213 | Critical | 9.8 | 2022-03-15 | Totolink X5000R_Firmware v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function setNtpCfg, via the tz parameters. T… |
CVE-2022-26212 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-26211 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-26210 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-26209 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-26208 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |