CWE-78 · OS Command Injection (page 44)
Page 44 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-4144 | High | 8.8 | 2021-12-23 | TP-Link wifi router TL-WR802N V4(JP), with firmware version prior to 211202, is vulnerable to OS command injection. |
CVE-2021-21888 | Critical | 9.1 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager SslGenerateCertificate functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A speci… |
CVE-2021-21884 | Critical | 9.1 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP… |
CVE-2021-21883 | Critical | 9.9 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager Diagnostics: Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HT… |
CVE-2021-21882 | High | 8.8 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP reque… |
CVE-2021-21881 | Critical | 9.9 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-cra… |
CVE-2021-21877 | Critical | 9.1 | 2021-12-22 | Specially-crafted HTTP requests can lead to arbitrary command execution in “GET” requests. An attacker can make authenticated HTTP requests to trigger this vul… |
CVE-2021-21876 | Critical | 9.1 | 2021-12-22 | Specially-crafted HTTP requests can lead to arbitrary command execution in PUT requests. An attacker can make authenticated HTTP requests to trigger this vulne… |
CVE-2021-21875 | Critical | 9.1 | 2021-12-22 | A specially-crafted HTTP request can lead to arbitrary command execution in EC keypasswd parameter. An attacker can make an authenticated HTTP request to trigg… |
CVE-2021-21874 | Critical | 9.1 | 2021-12-22 | A specially-crafted HTTP request can lead to arbitrary command execution in DSA keypasswd parameter. An attacker can make an authenticated HTTP request to trig… |
CVE-2021-21873 | Critical | 9.1 | 2021-12-22 | A specially-crafted HTTP request can lead to arbitrary command execution in RSA keypasswd parameter. An attacker can make an authenticated HTTP request to trig… |
CVE-2021-21872 | Critical | 9.9 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager Diagnostics: Traceroute functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-craf… |
CVE-2020-19316 | High | 8.8 | 2021-12-20 | OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17. |
CVE-2020-8105 | Critical | 9.6 | 2021-12-20 | OS Command Injection vulnerability in the wirelessConnect handler of Abode iota All-In-One Security Kit allows an attacker to inject commands and gain root acc… |
CVE-2021-42912 | High | 8.8 | 2021-12-16 | FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. This vulnerability allows the attacker, once logged in, to send com… |
CVE-2021-44235 | Medium | 6.7 | 2021-12-14 | Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allow an attacker… |
CVE-2021-39065 | Critical | 9.8 | 2021-12-13 | IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation o… |
CVE-2021-21954 | Critical | 9.9 | 2021-12-09 | A command execution vulnerability exists in the wifi_country_code_update functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. A special… |
CVE-2021-20144 | High | 8.8 | 2021-12-09 | An unauthenticated command injection vulnerability exists in the parameters of operation 49 in the controller_server service on Gryphon Tower routers. An unaut… |
CVE-2021-20143 | High | 8.8 | 2021-12-09 | An unauthenticated command injection vulnerability exists in the parameters of operation 48 in the controller_server service on Gryphon Tower routers. An unaut… |
CVE-2021-20142 | High | 8.8 | 2021-12-09 | An unauthenticated command injection vulnerability exists in the parameters of operation 41 in the controller_server service on Gryphon Tower routers. An unaut… |
CVE-2021-20141 | High | 8.8 | 2021-12-09 | An unauthenticated command injection vulnerability exists in the parameters of operation 32 in the controller_server service on Gryphon Tower routers. An unaut… |
CVE-2021-20140 | High | 8.8 | 2021-12-09 | An unauthenticated command injection vulnerability exists in the parameters of operation 10 in the controller_server service on Gryphon Tower routers. An unaut… |
CVE-2021-20139 | High | 8.8 | 2021-12-09 | An unauthenticated command injection vulnerability exists in the parameters of operation 3 in the controller_server service on Gryphon Tower routers. An unauth… |
CVE-2021-20138 | High | 8.8 | 2021-12-09 | An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web interface at /cgi-bin/luci/rc. An unauthenti… |
CVE-2021-42759 | Medium | 6.7 | 2021-12-09 | A violation of secure design principles in Fortinet Meru AP version 8.6.1 and below, version 8.5.5 and below allows attacker to execute unauthorized code or co… |
CVE-2021-23862 | High | 7.2 | 2021-12-08 | A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. This issue also affect… |
CVE-2021-36195 | Medium | 4.2 | 2021-12-08 | Multiple command injection vulnerabilities in the command line interpreter of FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, and 6… |
CVE-2021-36180 | High | 8.1 | 2021-12-08 | Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and be… |
CVE-2021-20044 | High | 8.8 | 2021-12-08 | A post-authentication remote command injection vulnerability in SonicWall SMA100 allows a remote authenticated attacker to execute OS system commands in the ap… |
CVE-2021-20039 | High | 8.8 | 2021-12-08 | Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to i… |
CVE-2021-44685 | Critical | 9.8 | 2021-12-07 | Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to run the… |
CVE-2021-44684 | Critical | 9.8 | 2021-12-07 | naholyr github-todos 3.1.0 is vulnerable to command injection. The range argument for the _hook subcommand is concatenated without any validation, and is direc… |
CVE-2021-43033 | Critical | 9.8 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Multiple functions in the bpserverd daemon were vulnerable to arbitrary remote code… |
CVE-2021-20863 | High | 8.0 | 2021-12-01 | OS command injection vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1… |
CVE-2021-20859 | High | 8.0 | 2021-12-01 | ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmwa… |
CVE-2021-20854 | Medium | 6.8 | 2021-12-01 | ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent attacker with an administrator p… |
CVE-2021-20853 | Medium | 6.8 | 2021-12-01 | ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent attacker with an administrator p… |
CVE-2021-43283 | High | 8.8 | 2021-11-30 | An issue was discovered on Victure WR1200 devices through 1.0.3. A command injection vulnerability was found within the web interface of the device, allowing a… |
CVE-2020-7879 | High | 8.8 | 2021-11-30 | This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME IP camera because th… |
CVE-2021-3769 | High | 7.5 | 2021-11-30 | # Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `refined` themes **Description**: these themes use `print -P` on user-supplied strings to print them… |
CVE-2021-3727 | High | 7.5 | 2021-11-30 | # Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch quotes from quotationspage.com and hitokoto.cn re… |
CVE-2021-3726 | High | 7.5 | 2021-11-30 | # Vulnerability in `title` function **Description**: the `title` function defined in `lib/termsupport.zsh` uses `print` to set the terminal title to a user-sup… |
CVE-2021-3725 | High | 7.5 | 2021-11-30 | Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, us… |
CVE-2021-41243 | Critical | 9.1 | 2021-11-26 | There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissions to upload files… |
CVE-2021-38685 | Critical | 9.8 | 2021-11-26 | A command injection vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerability allows remote attackers to run arbitrary c… |
CVE-2021-20850 | Critical | 9.8 | 2021-11-24 | PowerCMS XMLRPC API of PowerCMS 5.19 and earlier, PowerCMS 4.49 and earlier, PowerCMS 3.295 and earlier, and PowerCMS 2 Series (End-of-Life, EOL) allows a remo… |
CVE-2021-42784 | Critical | 9.8 | 2021-11-23 | OS Command Injection vulnerability in debug_fcgi of D-Link DWR-932C E1 firmware allows a remote attacker to perform command injection via a crafted HTTP reques… |
CVE-2021-36313 | Critical | 9.1 | 2021-11-23 | Dell EMC CloudLink 7.1 and all prior versions contain an OS command injection Vulnerability. A remote high privileged attacker, may potentially exploit this vu… |
CVE-2021-23732 | Critical | 9.0 | 2021-11-22 | This affects all versions of package docker-cli-js. If the command parameter of the Docker.command method can at least be partially controlled by a user, they… |
CVE-2021-41280 | Critical | 9.8 | 2021-11-19 | Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go… |
CVE-2021-3723 | High | 7.2 | 2021-11-12 | A command injection vulnerability was reported in the Integrated Management Module (IMM) of legacy IBM System x 3550 M3 and IBM System x 3650 M3 servers that c… |
CVE-2021-3577 | High | 8.8 | 2021-11-12 | An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker on the same n… |
CVE-2021-41254 | High | 8.8 | 2021-11-12 | kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for infrastructure and workloads defined with Kubernetes ma… |
CVE-2021-3934 | High | 7.5 | 2021-11-12 | ohmyzsh is vulnerable to Improper Neutralization of Special Elements used in an OS Command |
CVE-2021-3061 | Medium | 6.4 | 2021-11-10 | An OS command injection vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables an authenticated administrator with access to the C… |
CVE-2021-3060 | High | 8.1 | 2021-11-10 | An OS command injection vulnerability in the Simple Certificate Enrollment Protocol (SCEP) feature of PAN-OS software allows an unauthenticated network-based a… |
CVE-2021-3059 | High | 8.1 | 2021-11-10 | An OS command injection vulnerability in the Palo Alto Networks PAN-OS management interface exists when performing dynamic updates. This vulnerability enables… |
CVE-2021-3058 | High | 8.8 | 2021-11-10 | An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permissions to use XML API the… |
CVE-2021-39474 | High | 7.2 | 2021-11-10 | Vulnerability in the product Docsis 3.0 UBC1319BA00 Router supported affected version 1319010201r009. The vulnerability allows an attacker with privileges and… |
CVE-2021-37158 | High | 8.8 | 2021-11-10 | An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14. An authenticated attacker could inject OS commands by starting a Counter-Strike se… |
CVE-2021-42372 | High | 8.8 | 2021-11-08 | A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows authenticated remote attackers to execute arbitrary… |
CVE-2021-41228 | High | 7.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's `saved_model_cli` tool is vulnerable to a code injection as it ca… |
CVE-2021-40120 | Medium | 6.5 | 2021-11-04 | A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker with admi… |
CVE-2021-40113 | Critical | 10.0 | 2021-11-04 | Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ON… |
CVE-2020-25368 | Critical | 9.8 | 2021-11-04 | A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker is able to execute arbit… |
CVE-2020-25367 | Critical | 9.8 | 2021-11-04 | A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker is able to execute arbit… |
CVE-2021-43266 | High | 7.3 | 2021-11-02 | In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell metacharacters in a collec… |
CVE-2021-36185 | High | 8.8 | 2021-11-02 | A improper neutralization of special elements used in an OS command ('OS Command Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to ex… |
CVE-2020-36381 | Critical | 9.8 | 2021-10-31 | An issue was discovered in the singleCrunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters. |
CVE-2020-36380 | Critical | 9.8 | 2021-10-31 | An issue was discovered in the crunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters. |
CVE-2020-36379 | Critical | 9.8 | 2021-10-31 | An issue was discovered in the remove function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters. |
CVE-2020-36378 | Critical | 9.8 | 2021-10-31 | An issue was discovered in the packageCmd function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters. |
CVE-2020-36377 | Critical | 9.8 | 2021-10-31 | An issue was discovered in the dump function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters. |
CVE-2020-36376 | Critical | 9.8 | 2021-10-31 | An issue was discovered in the list function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters. |
CVE-2020-26707 | Critical | 9.8 | 2021-10-31 | An issue was discovered in the add function in Shenzhim AAPTJS 1.3.1 which allows attackers to execute arbitrary code via the filePath parameter. |
CVE-2021-34756 | Medium | 6.7 | 2021-10-27 | Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands… |
CVE-2021-34755 | Medium | 6.7 | 2021-10-27 | Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands… |
CVE-2011-2195 | Critical | 9.8 | 2021-10-26 | A flaw was found in WebSVN 2.3.2. Without prior authentication, if the 'allowDownload' option is enabled in config.php, an attacker can invoke the dl.php scrip… |
CVE-2021-20837 | Critical | 9.8 | 2021-10-26 | Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (… |
CVE-2021-38294 | Critical | 9.8 | 2021-10-25 | A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specia… |
CVE-2021-42538 | High | 8.0 | 2021-10-22 | The affected product is vulnerable to a parameter injection via passphrase, which enables the attacker to supply uncontrolled input. |
CVE-2021-34362 | High | 8.7 | 2021-10-22 | A command injection vulnerability has been reported to affect QNAP device running Media Streaming add-on. If exploited, this vulnerability allow remote attacke… |
CVE-2021-1529 | High | 7.8 | 2021-10-21 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. The… |
CVE-2021-31358 | High | 7.8 | 2021-10-19 | A command injection vulnerability in sftp command processing on Juniper Networks Junos OS Evolved allows an attacker with authenticated CLI access to be able t… |
CVE-2021-31357 | High | 7.8 | 2021-10-19 | A command injection vulnerability in tcpdump command processing on Juniper Networks Junos OS Evolved allows an attacker with authenticated CLI access to be abl… |
CVE-2021-31356 | High | 7.8 | 2021-10-19 | A command injection vulnerability in command processing on Juniper Networks Junos OS Evolved allows an attacker with authenticated CLI access to be able to byp… |
CVE-2021-30358 | High | 7.2 | 2021-10-19 | Mobile Access Portal Native Applications who's path is defined by the administrator with environment variables may run applications from other locations by the… |
CVE-2021-38478 | Critical | 9.1 | 2021-10-19 | InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a traceroute tool to inject commands into the device. T… |
CVE-2021-38470 | Critical | 9.1 | 2021-10-19 | InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a ping tool to inject commands into the device. This ma… |
CVE-2021-24684 | High | 8.8 | 2021-10-18 | The WordPress PDF Light Viewer Plugin WordPress plugin before 1.4.12 allows users with Author roles to execute arbitrary OS command on the server via OS Comman… |
CVE-2021-27561 | Critical | 9.8 | 2021-10-15 | Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication. |
CVE-2020-22724 | Critical | 9.8 | 2021-10-14 | A remote command execution vulnerability exists in add_server_service of PPTP_SERVER in Mercury Router MER1200 v1.0.1 and Mercury Router MER1200G v1.0.1. |
CVE-2021-37732 | High | 7.2 | 2021-10-12 | A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.17 and below; Aru… |
CVE-2021-37730 | High | 7.2 | 2021-10-12 | A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aru… |
CVE-2021-37727 | High | 7.2 | 2021-10-12 | A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5… |
CVE-2021-20122 | High | 7.2 | 2021-10-11 | The Telus Wi-Fi Hub (PRV65B444A-S-TS) with firmware version 3.00.20 is affected by an authenticated command injection vulnerability in multiple parameters pass… |
CVE-2021-42071 | Critical | 9.8 | 2021-10-07 | In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py Use… |
CVE-2021-34748 | High | 8.8 | 2021-10-06 | A vulnerability in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to perform a command… |
CVE-2021-34710 | High | 8.8 | 2021-10-06 | Multiple vulnerabilities in the Cisco ATA 190 Series Analog Telephone Adapter Software could allow an attacker to perform a command injection attack resulting… |