CWE-78 · OS Command Injection (page 45)
Page 45 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-1594 | High | 7.5 | 2021-10-06 | A vulnerability in the REST API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to perform a command injection attack a… |
CVE-2021-22557 | Medium | 5.3 | 2021-10-04 | SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We re… |
CVE-2021-34352 | High | 7.2 | 2021-10-01 | A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arb… |
CVE-2021-35028 | High | 7.3 | 2021-09-29 | A command injection vulnerability in the CGI program of the Zyxel VPN2S firmware version 1.12 could allow an authenticated, local user to execute arbitrary OS… |
CVE-2021-21570 | Medium | 6.8 | 2021-09-28 | Dell NetWorker, versions 18.x and 19.x contain an Information disclosure vulnerability. A NetWorker server user with remote access to NetWorker clients may pot… |
CVE-2021-21569 | Medium | 6.8 | 2021-09-28 | Dell NetWorker, versions 18.x and 19.x contain a Path traversal vulnerability. A NetWorker server user with remote access to NetWorker clients may potentially… |
CVE-2021-20035 | Medium | 6.5 | 2021-09-27 | Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody… |
CVE-2021-39826 | High | 8.6 | 2021-09-27 | Adobe Digital Editions 4.5.11.187646 (and earlier) are affected by an arbitrary command execution vulnerability. An authenticated attacker could leverage this… |
CVE-2021-31605 | High | 7.5 | 2021-09-27 | furlongm openvpn-monitor through 1.1.3 allows %0a command injection via the OpenVPN management interface socket. This can shut down the server via signal%20SIG… |
CVE-2021-34351 | Critical | 9.8 | 2021-09-27 | A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arb… |
CVE-2021-34349 | High | 7.2 | 2021-09-27 | A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arb… |
CVE-2021-34348 | Critical | 9.8 | 2021-09-27 | A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arb… |
CVE-2021-34729 | Medium | 6.7 | 2021-09-23 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software and Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands… |
CVE-2021-34726 | Medium | 6.7 | 2021-09-23 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root-level pr… |
CVE-2021-34725 | Medium | 6.7 | 2021-09-23 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root-l… |
CVE-2021-37925 | Critical | 9.8 | 2021-09-22 | Zoho ManageEngine ADManager Plus version 7110 and prior has a Post-Auth OS command injection vulnerability. |
CVE-2021-36260 | Critical | 9.8 | 2021-09-22 | A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability… |
CVE-2020-26301 | High | 7.5 | 2021-09-20 | ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue on… |
CVE-2021-41315 | High | 8.8 | 2021-09-17 | The Device42 Remote Collector before 17.05.01 does not sanitize user input in its SNMP Connectivity utility. This allows an authenticated attacker (with access… |
CVE-2021-37913 | Critical | 9.8 | 2021-09-15 | The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page. Remote attackers… |
CVE-2021-37912 | Critical | 9.8 | 2021-09-15 | The HGiga OAKlouds mobile portal does not filter special characters of the Ethernet number parameter of the network interface card setting page. Remote attacke… |
CVE-2021-23025 | High | 8.8 | 2021-09-14 | On version 15.1.x before 15.1.0.5, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all versions of 12.1.x and 11.6.x, an authenticated remote command execu… |
CVE-2021-23031 | Critical | 9.9 | 2021-09-14 | On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x before 11.6.5.3, an aut… |
CVE-2021-37531 | High | 8.8 | 2021-09-14 | SAP NetWeaver Knowledge Management XML Forms versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, contains an XSLT vulnerability which allows a non-administrative au… |
CVE-2021-31891 | Critical | 10.0 | 2021-09-14 | A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier)… |
CVE-2021-33554 | High | 7.2 | 2021-09-13 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute ar… |
CVE-2021-33553 | High | 7.2 | 2021-09-13 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute ar… |
CVE-2021-33552 | High | 7.2 | 2021-09-13 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute ar… |
CVE-2021-33551 | High | 7.2 | 2021-09-13 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute ar… |
CVE-2021-33550 | High | 7.2 | 2021-09-13 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute ar… |
CVE-2021-33548 | High | 7.2 | 2021-09-13 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute ar… |
CVE-2021-33544 | High | 7.2 | 2021-09-13 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute ar… |
CVE-2021-40222 | High | 7.2 | 2021-09-09 | Rittal CMC PU III Web management Version affected: V3.11.00_2. Version fixed: V3.17.10 is affected by a remote code execution vulnerablity. It is possible to i… |
CVE-2021-39459 | High | 7.2 | 2021-09-09 | Remote code execution in the modules component in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user to execute code on the hosting syst… |
CVE-2021-34728 | High | 7.8 | 2021-09-09 | Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker with a low-privileged account to elevate privileges o… |
CVE-2021-34722 | Medium | 6.7 | 2021-09-09 | Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to gain access to the underlying root shell of an aff… |
CVE-2021-34721 | Medium | 6.7 | 2021-09-09 | Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to gain access to the underlying root shell of an aff… |
CVE-2021-34719 | High | 7.8 | 2021-09-09 | Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker with a low-privileged account to elevate privileges o… |
CVE-2020-26300 | Medium | 5.9 | 2021-09-09 | systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command… |
CVE-2020-26772 | Critical | 9.8 | 2021-09-08 | Command Injection in PPGo_Jobs v2.8.0 allows remote attackers to execute arbitrary code via the 'AjaxRun()' function. |
CVE-2021-28571 | High | 8.3 | 2021-09-08 | Adobe After Effects version 18.1 (and earlier) is affected by a potential Command injection vulnerability when chained with a development and debugging tool fo… |
CVE-2021-36182 | High | 8.8 | 2021-09-08 | A Improper neutralization of special elements used in a command ('Command Injection') in Fortinet FortiWeb version 6.3.13 and below allows attacker to execute… |
CVE-2021-39279 | High | 8.8 | 2021-09-07 | Certain MOXA devices allow Authenticated Command Injection via /forms/web_importTFTP. This affects WAC-2004 1.7, WAC-1001 2.1, WAC-1001-T 2.1, OnCell G3470A-LT… |
CVE-2021-36024 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements Us… |
CVE-2021-36022 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Upd… |
CVE-2021-27556 | High | 7.2 | 2021-08-31 | The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers (who have admin access) to execute arbitrary code by setting the type parameter to System. |
CVE-2021-35062 | High | 8.1 | 2021-08-30 | A Shell Metacharacter Injection vulnerability in result.php in DRK Odenwaldkreis Testerfassung March-2021 allow an attacker with a valid token of a COVID-19 te… |
CVE-2021-33055 | Critical | 9.8 | 2021-08-30 | Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions. |
CVE-2021-27944 | Critical | 9.8 | 2021-08-26 | Several high privileged APIs on the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs do not enforce access controls, allowing an unauthenticated threa… |
CVE-2021-1584 | Medium | 6.0 | 2021-08-25 | A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated, local attacker to ele… |
CVE-2021-39159 | Critical | 9.6 | 2021-08-25 | BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositories. In affected ve… |
CVE-2021-39160 | Critical | 9.6 | 2021-08-25 | nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could… |
CVE-2021-38306 | Critical | 9.8 | 2021-08-24 | Network Attached Storage on LG N1T1*** 10124 devices allows an unauthenticated attacker to gain root access via OS command injection in the en/ajp/plugins/acce… |
CVE-2021-33191 | Critical | 9.8 | 2021-08-24 | From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patchi… |
CVE-2021-39244 | High | 8.8 | 2021-08-23 | Authenticated Semi-Blind Command Injection (via Parameter Injection) exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices via the getlogs.cgi tcpdump… |
CVE-2021-36011 | High | 8.3 | 2021-08-20 | Adobe Illustrator version 25.2.3 (and earlier) is affected by a potential Command injection vulnerability when chained with a development and debugging tool fo… |
CVE-2021-28634 | High | 8.2 | 2021-08-20 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Improper Neutralizati… |
CVE-2020-22345 | High | 8.8 | 2021-08-18 | /graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabase_… |
CVE-2021-32830 | Low | 3.9 | 2021-08-17 | The @diez/generation npm package is a client for Diez. The locateFont method of @diez/generation has a command injection vulnerability. Clients of the @diez/ge… |
CVE-2021-3617 | High | 7.2 | 2021-08-17 | A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow command injection by setting a specially crafted network configuration. Th… |
CVE-2021-3459 | Medium | 6.8 | 2021-08-17 | A privilege escalation vulnerability was reported in the MM1000 device configuration web server, which could allow privileged shell access and/or arbitrary pri… |
CVE-2021-21599 | Medium | 6.0 | 2021-08-16 | Dell EMC PowerScale OneFS versions 8.2.x - 9.2.1.x contain an OS command injection vulnerability. This may allow a user with ISI_PRIV_LOGIN_SSH or ISI_PRIV_LOG… |
CVE-2021-32826 | Medium | 6.8 | 2021-08-16 | Proxyee-Down is open source proxy software. An attacker being able to provide an extension script (eg: through a MiTM attack or by hosting a malicious extensio… |
CVE-2021-37708 | High | 8.8 | 2021-08-16 | Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a command injection vulnerability in mail agent settings. Version 6.4.3.1 cont… |
CVE-2021-35394 | Critical | 9.8 | 2021-08-16 | Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affe… |
CVE-2021-23422 | High | 7.8 | 2021-08-16 | This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing Inline Tag Command metadata is processed. When an arbit… |
CVE-2021-3708 | High | 7.8 | 2021-08-16 | D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to OS command injection. An unauthenticated attacker on the local network may exp… |
CVE-2021-37028 | Medium | 6.7 | 2021-08-13 | There is a command injection vulnerability in the HG8045Q product. When the command-line interface is enabled, which is disabled by default, attackers with adm… |
CVE-2021-36380 | Critical | 9.8 | 2021-08-13 | Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi. |
CVE-2021-37346 | Critical | 9.8 | 2021-08-13 | Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements used in an OS Comma… |
CVE-2021-37344 | Critical | 9.8 | 2021-08-13 | Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used in an OS Command (… |
CVE-2021-31698 | Critical | 9.8 | 2021-08-12 | Quectel EG25-G devices through 202006130814 allow executing arbitrary code remotely by using an AT command to place shell metacharacters in quectel_handle_fumo… |
CVE-2021-3050 | High | 8.8 | 2021-08-11 | An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to execute arbitrary OS commands to… |
CVE-2021-33721 | High | 7.2 | 2021-08-10 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2). The affected application incorrectly neutralizes special elements when creating bat… |
CVE-2020-23151 | Critical | 9.8 | 2021-08-09 | rConfig 3.9.5 allows command injection by sending a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php since the path parameter is passed directly to… |
CVE-2021-21585 | Critical | 9.1 | 2021-08-09 | Dell OpenManage Enterprise versions prior to 3.6.1 contain an OS command injection vulnerability in RACADM and IPMI tools. A remote authenticated malicious use… |
CVE-2021-36706 | Critical | 9.8 | 2021-08-06 | In ProLink PRC2402M V1.0.18 and older, the set_sys_cmd function in the adm.cgi binary, accessible with a page parameter value of sysCMD contains a trivial comm… |
CVE-2021-36705 | Critical | 9.8 | 2021-08-06 | In ProLink PRC2402M V1.0.18 and older, the set_TR069 function in the adm.cgi binary, accessible with a page parameter value of TR069 contains a trivial command… |
CVE-2021-21805 | Critical | 9.8 | 2021-08-05 | An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP request… |
CVE-2021-1602 | High | 8.2 | 2021-08-04 | A vulnerability in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticat… |
CVE-2021-26097 | High | 8.8 | 2021-08-04 | An improper neutralization of special elements used in an OS Command vulnerability in FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through… |
CVE-2021-32772 | High | 8.8 | 2021-08-03 | Poddycast is a podcast app made with Electron. Prior to version 0.8.1, an attacker can create a podcast or episode with malicious characters and execute comman… |
CVE-2021-31799 | High | 7.0 | 2021-07-30 | In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename. |
CVE-2021-23412 | High | 8.1 | 2021-07-23 | All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be exec… |
CVE-2021-3198 | Medium | 6.5 | 2021-07-22 | By abusing the 'install rpm url' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue was fixe… |
CVE-2021-31580 | High | 8.7 | 2021-07-22 | The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be bypassed by switching the OpenSSH channel from `shell` to `exec` and providi… |
CVE-2020-7389 | Medium | 5.5 | 2021-07-22 | Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web app… |
CVE-2021-33032 | Critical | 10.0 | 2021-07-22 | A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up… |
CVE-2021-1618 | Medium | 6.5 | 2021-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to conduct a… |
CVE-2021-29143 | High | 7.2 | 2021-07-22 | A remote execution of arbitrary commands vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Arub… |
CVE-2020-21937 | Critical | 9.8 | 2021-07-21 | An command injection vulnerability in HNAP1/SetWLanApcliSettings of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to execute arbitrar… |
CVE-2020-21935 | Critical | 9.8 | 2021-07-21 | A command injection vulnerability in HNAP1/GetNetworkTomographySettings of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to execute a… |
CVE-2021-32751 | High | 7.5 | 2021-07-20 | Gradle is a build tool with a focus on build automation. In versions prior to 7.2, start scripts generated by the `application` plugin and the `gradlew` script… |
CVE-2020-25206 | High | 7.2 | 2021-07-20 | The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 allows authenticated command injection in the Throughput, WANStats, PhyStats, and QosStats… |
CVE-2021-22125 | Medium | 6.3 | 2021-07-20 | An instance of improper neutralization of special elements in the sniffer module of FortiSandbox before 3.2.2 may allow an authenticated administrator to execu… |
CVE-2020-5322 | Critical | 9.1 | 2021-07-19 | Dell EMC OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a command injection vulnerability. A remote authenticated malicious user with… |
CVE-2020-29499 | Medium | 6.4 | 2021-07-19 | Dell EMC PowerStore versions prior to 1.0.3.0.5.006 contain an OS Command Injection vulnerability in PowerStore X environment . A locally authenticated attacke… |
CVE-2021-32749 | Medium | 6.1 | 2021-07-16 | fail2ban is a daemon to ban hosts that cause multiple authentication errors. In versions 0.9.7 and prior, 0.10.0 through 0.10.6, and 0.11.0 through 0.11.2, the… |
CVE-2021-21819 | High | 7.2 | 2021-07-16 | A code execution vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to… |
CVE-2020-19907 | High | 8.8 | 2021-07-12 | A command injection vulnerability in the sandcat plugin of Caldera 2.3.1 and earlier allows authenticated attackers to execute any command or service. |