CWE-78 · OS Command Injection (page 43)
Page 43 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-26206 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-25621 | Critical | 9.8 | 2022-03-11 | UUNIVERGE WA 1020 Ver8.2.11 and prior, UNIVERGE WA 1510 Ver8.2.11 and prior, UNIVERGE WA 1511 Ver8.2.11 and prior, UNIVERGE WA 1512 Ver8.2.11 and prior, UNIVER… |
CVE-2021-32475 | Medium | 5.4 | 2022-03-11 | ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8… |
CVE-2022-24193 | Critical | 9.8 | 2022-03-10 | CasaOS before v0.2.7 was discovered to contain a command injection vulnerability. |
CVE-2022-24753 | High | 7.7 | 2022-03-09 | Stripe CLI is a command-line tool for the Stripe eCommerce platform. A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directo… |
CVE-2021-46704 | Critical | 9.8 | 2022-03-06 | In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/pi… |
CVE-2021-44827 | High | 8.8 | 2022-03-04 | There is remote authenticated OS command injection on TP-Link Archer C20i 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n devices vie the X_TP_ExternalIPv6Address HT… |
CVE-2022-0848 | Critical | 9.8 | 2022-03-04 | OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11. |
CVE-2022-24725 | Medium | 6.2 | 2022-03-03 | Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bas… |
CVE-2022-0841 | Critical | 9.8 | 2022-03-03 | OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4. |
CVE-2022-22301 | High | 7.8 | 2022-03-02 | An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiAP-C console 5.4.0 through 5.4.3, 5.2.0 through 5.2.1 may a… |
CVE-2021-43075 | High | 8.8 | 2022-03-01 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and be… |
CVE-2021-4039 | Critical | 9.8 | 2022-03-01 | A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device. |
CVE-2020-12775 | Critical | 9.8 | 2022-03-01 | Hicos citizen certificate client-side component does not filter special characters for command parameters in specific web URLs. An unauthenticated remote attac… |
CVE-2022-0764 | Medium | 6.7 | 2022-02-26 | Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0. |
CVE-2022-25263 | Critical | 9.8 | 2022-02-25 | JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. |
CVE-2022-25064 | Critical | 9.8 | 2022-02-25 | TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a remote code execution (RCE) vulnerability via the function oal_wan6_setIpAddr. |
CVE-2022-25061 | Critical | 9.8 | 2022-02-25 | TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_setIp6DefaultRoute. |
CVE-2022-25060 | Critical | 9.8 | 2022-02-25 | TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_startPing. |
CVE-2022-25328 | Medium | 5.0 | 2022-02-25 | The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circums… |
CVE-2022-24288 | High | 8.8 | 2022-02-25 | In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection fr… |
CVE-2022-25084 | Critical | 9.8 | 2022-02-24 | TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to exe… |
CVE-2022-25083 | Critical | 9.8 | 2022-02-24 | TOTOLink A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers… |
CVE-2022-25082 | Critical | 9.8 | 2022-02-24 | TOTOLink A950RG V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 were discovered to contain a command injection vulnerability in the "Main" function. This vuln… |
CVE-2022-25081 | Critical | 9.8 | 2022-02-24 | TOTOLink T10 V5.9c.5061_B20200511 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to ex… |
CVE-2022-25080 | Critical | 9.8 | 2022-02-24 | TOTOLink A830R V5.9c.4729_B20191112 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to… |
CVE-2022-25079 | Critical | 9.8 | 2022-02-24 | TOTOLink A810R V4.1.2cu.5182_B20201026 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers… |
CVE-2022-25078 | Critical | 9.8 | 2022-02-24 | TOTOLink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers… |
CVE-2022-25077 | Critical | 9.8 | 2022-02-24 | TOTOLink A3100R V4.1.2cu.5050_B20200504 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers… |
CVE-2022-25076 | Critical | 9.8 | 2022-02-24 | TOTOLink A800R V4.1.2cu.5137_B20200730 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers… |
CVE-2022-25075 | Critical | 9.8 | 2022-02-24 | TOTOLink A3000RU V5.9c.2280_B20180512 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers t… |
CVE-2021-4029 | High | 8.8 | 2022-02-24 | A command injection vulnerability in the CGI program of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary OS commands via a LAN inter… |
CVE-2022-20650 | High | 8.8 | 2022-02-23 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges… |
CVE-2022-21143 | High | 7.5 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not prope… |
CVE-2021-46319 | Critical | 9.8 | 2022-02-17 | Remote Code Execution (RCE) vulnerability exists in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicious users can use thi… |
CVE-2021-46315 | Critical | 9.8 | 2022-02-17 | Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetWizardConfig.php in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA… |
CVE-2021-46314 | Critical | 9.8 | 2022-02-17 | A Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetNetworkTomographySettings.php of D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR8… |
CVE-2021-45382 | Critical | 9.8 | 2022-02-17 | A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via th… |
CVE-2021-3781 | Critical | 9.9 | 2022-02-16 | A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This… |
CVE-2022-22945 | High | 7.8 | 2022-02-16 | VMware NSX Edge contains a CLI shell injection vulnerability. A malicious actor with SSH access to an NSX-Edge appliance can execute arbitrary commands on the… |
CVE-2021-26726 | High | 8.8 | 2022-02-16 | A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges… |
CVE-2022-25175 | High | 8.8 | 2022-02-15 | Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing atta… |
CVE-2022-25174 | High | 8.8 | 2022-02-15 | Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries, all… |
CVE-2022-25173 | High | 8.8 | 2022-02-15 | Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jen… |
CVE-2022-23389 | Critical | 9.8 | 2022-02-14 | PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulnerability via the cmdarray parameter. |
CVE-2022-0557 | High | 7.2 | 2022-02-11 | OS Command Injection in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-20708 | Critical | 10.0 | 2022-02-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbi… |
CVE-2021-26616 | High | 7.8 | 2022-02-09 | An OS command injection was found in SecuwaySSL, when special characters injection on execute command with runCommand arguments. |
CVE-2021-43928 | Critical | 9.9 | 2022-02-07 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in mail sending and receiving component in Synology Ma… |
CVE-2022-24552 | Critical | 9.8 | 2022-02-06 | A flaw was found in the REST API in StarWind Stack. REST command, which manipulates a virtual disk, doesn’t check input parameters. Some of them go directly to… |
CVE-2022-23611 | High | 8.1 | 2022-02-04 | iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize image file p… |
CVE-2022-0365 | Critical | 9.1 | 2022-02-04 | The affected product is vulnerable to an authenticated OS command injection, which may allow an attacker to inject and execute arbitrary shell commands as the… |
CVE-2021-29393 | Critical | 9.8 | 2022-02-04 | Remote Code Execution in cominput.jsp and comoutput.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to inje… |
CVE-2021-45987 | Critical | 9.8 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetNetCheckTools. This vulnerabil… |
CVE-2021-45986 | Critical | 9.8 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetUSBShareInfo. This vulnerabili… |
CVE-2021-41018 | High | 8.8 | 2022-02-02 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below all… |
CVE-2021-43073 | High | 8.8 | 2022-02-02 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and b… |
CVE-2021-41016 | High | 7.8 | 2022-02-02 | A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiExtender version 7.0.1 and below, 4.2.3 and below, 4.1.7… |
CVE-2021-40412 | High | 7.2 | 2022-01-28 | An OScommand injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [8] the devname variable… |
CVE-2021-40411 | High | 7.2 | 2022-01-28 | An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [6] the dns_data->dns2 va… |
CVE-2021-40410 | High | 7.2 | 2022-01-28 | An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [4] the dns_data->dns1 va… |
CVE-2021-40409 | Critical | 9.8 | 2022-01-28 | An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS… |
CVE-2021-40408 | Critical | 9.8 | 2022-01-28 | An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS… |
CVE-2021-40407 | High | 7.2 | 2022-01-28 | An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS… |
CVE-2020-28885 | High | 7.2 | 2022-01-28 | Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject commands through the Gogo Shell modu… |
CVE-2020-28884 | High | 7.2 | 2022-01-28 | Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject Groovy script to execute any OS comm… |
CVE-2021-32849 | High | 8.8 | 2022-01-26 | Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in ve… |
CVE-2021-36296 | High | 7.2 | 2022-01-25 | Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. A remote malicious user with privileges ma… |
CVE-2021-36295 | High | 7.2 | 2022-01-25 | Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. A remote malicious user with privileges ma… |
CVE-2021-45845 | High | 7.8 | 2022-01-25 | The Path Sanity Check script of FreeCAD 0.19 is vulnerable to OS command injection, allowing an attacker to execute arbitrary commands via a crafted FCStd docu… |
CVE-2021-45844 | High | 7.8 | 2022-01-25 | Improper sanitization in the invocation of ODA File Converter from FreeCAD 0.19 allows an attacker to inject OS commands via a crafted filename. |
CVE-2022-23935 | High | 7.8 | 2022-01-25 | lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection. |
CVE-2021-43589 | Medium | 6.0 | 2022-01-24 | Dell EMC Unity, Dell EMC UnityVSA and Dell EMC Unity XT versions prior to 5.1.2.0.5.007 contain an operating system (OS) command injection Vulnerability. A loc… |
CVE-2021-44981 | High | 8.8 | 2022-01-24 | In QuickBox Pro v2.5.8 and below, the config.php file has a variable which takes a GET parameter value and parses it into a shell_exec(''); function without pr… |
CVE-2021-31854 | High | 7.7 | 2022-01-19 | A command Injection Vulnerability in McAfee Agent (MA) for Windows prior to 5.7.5 allows local users to inject arbitrary shell code into the file cleanup.exe… |
CVE-2021-38965 | High | 8.8 | 2022-01-17 | IBM FileNet Content Manager 5.5.4, 5.5.6, and 5.5.7 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specia… |
CVE-2021-33827 | High | 7.2 | 2022-01-15 | The files_antivirus component before 1.0.0 for ownCloud allows OS Command Injection via the administration settings. |
CVE-2021-33962 | Critical | 9.8 | 2022-01-14 | China Mobile An Lianbao WF-1 router v1.0.1 is affected by an OS command injection vulnerability in the web interface /api/ZRUsb/pop_usb_device component. |
CVE-2022-22991 | High | 7.8 | 2022-01-13 | A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP cal… |
CVE-2022-20617 | High | 8.8 | 2022-01-12 | Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable… |
CVE-2022-21668 | High | 8.0 | 2022-01-10 | pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files a… |
CVE-2021-23154 | Medium | 6.3 | 2022-01-10 | In Lens prior to 5.3.4, custom helm chart configuration creates helm commands from string concatenation of provided arguments which are then executed in the us… |
CVE-2021-43779 | Critical | 9.9 | 2022-01-05 | GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 suffers from authenti… |
CVE-2021-45912 | High | 7.8 | 2022-01-04 | An unauthenticated Named Pipe channel in Controlup Real-Time Agent (cuAgent.exe) before 8.5 potentially allows an attacker to run OS commands via the ProcessAc… |
CVE-2021-45979 | High | 7.8 | 2022-01-04 | Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via app.launchURL in the JavaScript API. |
CVE-2021-45978 | High | 7.8 | 2022-01-04 | Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via xfa.host.gotoURL in the XFA API. |
CVE-2021-20173 | High | 8.8 | 2021-12-30 | Netgear Nighthawk R6700 version 1.0.4.120 contains a command injection vulnerability in update functionality of the device. By triggering a system update check… |
CVE-2021-20160 | High | 8.8 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 contains a command injection vulnerability in the smb functionality of the device. The username parameter used when… |
CVE-2021-20159 | High | 8.8 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 is vulnerable to command injection. The system log functionality of the firmware allows for command injection as roo… |
CVE-2021-35032 | Medium | 6.4 | 2021-12-28 | A vulnerability in the 'libsal.so' of the Zyxel GS1900 series firmware version 2.60 could allow an authenticated local user to execute arbitrary OS commands vi… |
CVE-2021-35031 | Medium | 6.8 | 2021-12-28 | A vulnerability in the TFTP client of Zyxel GS1900 series firmware, XGS1210 series firmware, and XGS1250 series firmware, which could allow an authenticated LA… |
CVE-2021-43857 | Critical | 9.8 | 2021-12-27 | Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in versio… |
CVE-2021-45602 | Medium | 6.1 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.66, EX2700 before 1.0.1.68, WN3000RPv2 befo… |
CVE-2021-3621 | High | 8.8 | 2021-12-23 | A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows… |
CVE-2021-44453 | Critical | 10.0 | 2021-12-23 | mySCADA myPRO: Versions 8.20.0 and prior has a vulnerable debug interface which includes a ping utility, which may allow an attacker to inject arbitrary operat… |
CVE-2021-43984 | Critical | 10.0 | 2021-12-23 | mySCADA myPRO: Versions 8.20.0 and prior has a feature where the firmware can be updated, which may allow an attacker to inject arbitrary operating system comm… |
CVE-2021-43981 | Critical | 10.0 | 2021-12-23 | mySCADA myPRO: Versions 8.20.0 and prior has a feature to send emails, which may allow an attacker to inject arbitrary operating system commands through a spec… |
CVE-2021-3584 | High | 7.2 | 2021-12-23 | A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite… |
CVE-2021-23198 | Critical | 10.0 | 2021-12-23 | mySCADA myPRO: Versions 8.20.0 and prior has a feature where the password can be specified, which may allow an attacker to inject arbitrary operating system co… |
CVE-2021-22657 | Critical | 10.0 | 2021-12-23 | mySCADA myPRO: Versions 8.20.0 and prior has a feature where the API password can be specified, which may allow an attacker to inject arbitrary operating syste… |