CWE-78 · OS Command Injection (page 46)
Page 46 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-31446 | Critical | 9.8 | 2022-06-14 | Tenda AC18 router V15.03.05.19 and V15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the Mac parameter at ip/goform/WriteF… |
CVE-2022-30311 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-refresh-request" POST request doesn’t check for port syntax. This… |
CVE-2022-30310 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-acknerr-request" POST request doesn’t check for port syntax. This… |
CVE-2022-30309 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax… |
CVE-2022-30308 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax… |
CVE-2021-41738 | High | 8.8 | 2022-06-11 | ZeroShell 3.9.5 has a command injection vulnerability in /cgi-bin/kerbynet IP parameter, which may allow an authenticated attacker to execute system commands. |
CVE-2022-1986 | Critical | 9.8 | 2022-06-09 | OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9. |
CVE-2019-25066 | Medium | 6.3 | 2022-06-09 | A vulnerability has been found in ajenti 2.1.31 and classified as critical. This vulnerability affects unknown code of the component API. The manipulation lead… |
CVE-2019-25065 | Medium | 6.3 | 2022-06-09 | A vulnerability was found in OpenNetAdmin 18.1.1. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads t… |
CVE-2022-29013 | Critical | 9.8 | 2022-06-09 | A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST… |
CVE-2022-1703 | High | 8.8 | 2022-06-08 | Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attacker to inject OS Com… |
CVE-2022-24065 | High | 8.1 | 2022-06-08 | The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code wi… |
CVE-2021-35531 | Medium | 6.7 | 2022-06-07 | Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub CoreTec 4 product, allows an attacker with acc… |
CVE-2022-31486 | High | 8.8 | 2022-06-06 | An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts prod… |
CVE-2022-31479 | Critical | 9.6 | 2022-06-06 | An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection… |
CVE-2021-42890 | Critical | 9.8 | 2022-06-03 | TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function NTPSyncWithHost of the file system.so which can control hostTime t… |
CVE-2021-42888 | Critical | 9.8 | 2022-06-03 | TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setLanguageCfg of the file global.so which can control langType to… |
CVE-2021-42885 | Critical | 9.8 | 2022-06-03 | TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceMac of the file global.so which can control deviceName to… |
CVE-2021-42884 | Critical | 9.8 | 2022-06-03 | TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceName of the file global.so which can control thedeviceNam… |
CVE-2022-26868 | Medium | 6.4 | 2022-06-02 | Dell EMC PowerStore versions 2.0.0.x, 2.0.1.x, and 2.1.0.x are vulnerable to a command injection flaw. An authenticated attacker could potentially exploit this… |
CVE-2021-42875 | Critical | 9.8 | 2022-06-02 | TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the file lib/cste_modules/system.so to cont… |
CVE-2022-30425 | High | 8.8 | 2022-06-02 | Tenda Technology Co.,Ltd HG6 3.3.0-210926 was discovered to contain a command injection vulnerability via the pingAddr and traceAddr parameters. This vulnerabi… |
CVE-2021-44080 | High | 7.2 | 2022-06-02 | A Command Injection vulnerability in httpd web server (setup.cgi) in SerComm h500s, FW: lowi-h500s-v3.4.22 allows logged in administrators to arbitrary OS comm… |
CVE-2021-42872 | Critical | 9.8 | 2022-06-02 | TOTOLINK EX1200T V4.1.2cu.5215 is affected by a command injection vulnerability that can remotely execute arbitrary code. |
CVE-2021-34084 | Critical | 9.8 | 2022-06-02 | OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary commands via the metada… |
CVE-2021-34083 | High | 8.1 | 2022-06-02 | Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browse… |
CVE-2021-34082 | Critical | 9.8 | 2022-06-02 | OS Command Injection vulnerability in allenhwkim proctree through 0.1.1 and commit 0ac10ae575459457838f14e21d5996f2fa5c7593 for Node.js, allows attackers to ex… |
CVE-2021-34081 | High | 8.8 | 2022-06-02 | OS Command Injection vulnerability in bbultman gitsome through 0.2.3 allows attackers to execute arbitrary commands via a crafted tag name of the target git re… |
CVE-2021-34080 | Critical | 9.8 | 2022-06-02 | OS Command Injection vulnerability in es128 ssl-utils 1.0.0 for Node.js allows attackers to execute arbitrary commands via unsanitized shell metacharacters pro… |
CVE-2021-34079 | Critical | 9.8 | 2022-06-02 | OS Command injection vulnerability in Mintzo Docker-Tester through 1.2.1 allows attackers to execute arbitrary commands via shell metacharacters in the 'ports'… |
CVE-2021-34078 | High | 8.8 | 2022-06-02 | lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file. |
CVE-2022-20797 | Medium | 5.5 | 2022-05-27 | A vulnerability in the web-based management interface of Cisco Secure Network Analytics, formerly Cisco Stealthwatch Enterprise, could allow an authenticated… |
CVE-2022-29256 | Medium | 6.5 | 2022-05-25 | sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at `npm install` tim… |
CVE-2022-29337 | Critical | 9.8 | 2022-05-24 | C-DATA FD702XW-X-R430 v2.1.13_X001 was discovered to contain a command injection vulnerability via the va_cmd parameter in formlanipv6. This vulnerability allo… |
CVE-2022-26532 | High | 7.8 | 2022-05-24 | A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware v… |
CVE-2022-1813 | Critical | 9.8 | 2022-05-22 | OS Command Injection in GitHub repository yogeshojha/rengine prior to 1.2.0. |
CVE-2022-31245 | High | 8.8 | 2022-05-20 | mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug option in conjunction… |
CVE-2021-34111 | Critical | 9.8 | 2022-05-20 | Thecus 4800Eco was discovered to contain a command injection vulnerability via the username parameter in /adm/setmain.php. |
CVE-2022-30105 | Critical | 9.8 | 2022-05-18 | In Belkin N300 Firmware 1.00.08, the script located at /setting_hidden.asp, which is accessible before and after configuring the device, exhibits multiple remo… |
CVE-2021-42852 | High | 8.0 | 2022-05-18 | A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execute operating system… |
CVE-2022-29516 | Critical | 9.8 | 2022-05-18 | The web console of FUJITSU Network IPCOM series (IPCOM EX2 IN(3200, 3500), IPCOM EX2 LB(1100, 3200, 3500), IPCOM EX2 SC(1100, 3200, 3500), IPCOM EX2 NW(1100, 3… |
CVE-2022-1362 | Medium | 5.0 | 2022-05-17 | The affected On-Premise cnMaestro is vulnerable inside a specific route where a user can upload a crafted package to the system. An attacker could abuse this u… |
CVE-2022-1360 | High | 8.2 | 2022-05-17 | The affected On-Premise cnMaestro is vulnerable to execution of code on the cnMaestro hosting server. This could allow a remote attacker to change server confi… |
CVE-2022-1359 | Medium | 5.7 | 2022-05-17 | The affected On-Premise cnMaestro is vulnerable to an arbitrary file-write through improper limitation of a pathname to a restricted directory inside a specifi… |
CVE-2022-1357 | Critical | 9.8 | 2022-05-17 | The affected On-Premise cnMaestro allows an unauthenticated attacker to access the cnMaestro server and execute arbitrary code in the privileges of the web ser… |
CVE-2022-1356 | High | 7.1 | 2022-05-17 | cnMaestro is vulnerable to a local privilege escalation. By default, a user does not have root privileges. However, a user can run scripts as sudo, which could… |
CVE-2022-24394 | High | 8.8 | 2022-05-17 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “update_checkfile” value… |
CVE-2022-24393 | High | 8.8 | 2022-05-17 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “check_vertica_upgrade”… |
CVE-2022-24392 | High | 8.8 | 2022-05-17 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “feed_comm_test” value f… |
CVE-2022-24390 | High | 8.8 | 2022-05-17 | Vulnerability in rconfig “remote_text_file” enables an attacker with user level access to the CLI to inject user level commands into Fidelis Network and Decept… |
CVE-2022-24389 | High | 8.8 | 2022-05-17 | Vulnerability in rconfig “cert_utils” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception Co… |
CVE-2022-24388 | High | 8.8 | 2022-05-17 | Vulnerability in rconfig “date” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandP… |
CVE-2022-23673 | High | 7.2 | 2022-05-17 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23672 | High | 7.2 | 2022-05-17 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23667 | High | 7.2 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23666 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23665 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23664 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23663 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23662 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23661 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2021-42897 | Critical | 9.8 | 2022-05-16 | A remote command execution (RCE) vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. The $_POST[r_name] is directly passed into the $my… |
CVE-2021-42969 | High | 8.8 | 2022-05-13 | Certain Anaconda3 2021.05 are affected by OS command injection. When a user installs Anaconda, an attacker can create a new file and write something in usercus… |
CVE-2022-26518 | High | 8.8 | 2022-05-12 | An OS command injection vulnerability exists in the console infactory_net functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of n… |
CVE-2022-26420 | High | 8.8 | 2022-05-12 | An OS command injection vulnerability exists in the console infactory_port functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of… |
CVE-2022-26085 | High | 8.8 | 2022-05-12 | An OS command injection vulnerability exists in the httpd wlscan_ASP functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can… |
CVE-2022-26075 | High | 8.8 | 2022-05-12 | An OS command injection vulnerability exists in the console infactory_wlan functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of… |
CVE-2022-26042 | High | 8.8 | 2022-05-12 | An OS command injection vulnerability exists in the daretools binary functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request c… |
CVE-2022-26007 | High | 7.2 | 2022-05-12 | An OS command injection vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request ca… |
CVE-2022-29303 | Critical | 9.8 | 2022-05-12 | SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php. |
CVE-2022-29539 | Critical | 9.8 | 2022-05-12 | resi-calltrace in RESI Gemini-Net 4.2 is affected by OS Command Injection. It does not properly check the parameters sent as input before they are processed on… |
CVE-2022-30525 | Critical | 9.8 | 2022-05-12 | A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5… |
CVE-2021-30361 | Medium | 6.7 | 2022-05-11 | The Check Point Gaia Portal's GUI Clients allowed authenticated administrators with permission for the GUI Clients settings to inject a command that would run… |
CVE-2022-22454 | High | 7.8 | 2022-05-10 | IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on the system by sending a specially crafted… |
CVE-2022-28915 | Critical | 9.8 | 2022-05-10 | D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a command injection vulnerability via the admuser and admpass parameters in /goform/setSysAdm. |
CVE-2022-28913 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUploadSetting. |
CVE-2022-28912 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUpgradeFW. |
CVE-2022-28911 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/CloudACMunualUpdate. |
CVE-2022-28910 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the devicename parameter in /setting/setDeviceName. |
CVE-2022-28909 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the webwlanidx parameter in /setting/setWebWlanIdx. |
CVE-2022-28908 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the ipdoamin parameter in /setting/setDiagnosisCfg. |
CVE-2022-28907 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the hosttime function in /setting/NTPSyncWithHost. |
CVE-2022-28906 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the langtype parameter in /setting/setLanguageCfg. |
CVE-2022-28905 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the devicemac parameter in /setting/setDeviceName. |
CVE-2022-28901 | Critical | 9.8 | 2022-05-10 | A command injection vulnerability in the component /SetTriggerLEDBlink/Blink of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to root… |
CVE-2022-28896 | Critical | 9.8 | 2022-05-10 | A command injection vulnerability in the component /setnetworksettings/SubnetMask of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to… |
CVE-2022-28895 | Critical | 9.8 | 2022-05-10 | A command injection vulnerability in the component /setnetworksettings/IPAddress of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to… |
CVE-2022-27224 | High | 7.2 | 2022-05-09 | An issue was discovered in Galleon NTS-6002-GPS 4.14.103-Galleon-NTS-6002.V12 4. An authenticated attacker can perform command injection as root via shell meta… |
CVE-2022-28584 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setWiFiWpsStart interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows a… |
CVE-2022-28583 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setWiFiWpsCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an… |
CVE-2022-28582 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setWiFiSignalCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows… |
CVE-2022-28581 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setWiFiAdvancedCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allow… |
CVE-2022-28580 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setL2tpServerCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows… |
CVE-2022-28579 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setParentalRules interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows… |
CVE-2022-28578 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setOpenVpnCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an… |
CVE-2022-28577 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the delParentalRules interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows… |
CVE-2022-28575 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setopenvpnclientcfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allo… |
CVE-2022-29592 | Critical | 9.8 | 2022-05-05 | Tenda TX9 Pro 22.03.02.10 devices allow OS command injection via set_route (called by doSystemCmd_route). |
CVE-2021-41739 | Critical | 9.8 | 2022-05-05 | A OS Command Injection vulnerability was discovered in Artica Proxy 4.30.000000. Attackers can execute OS commands in cyrus.events.php with GET param logs and… |
CVE-2022-20801 | Medium | 4.7 | 2022-05-04 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to… |