CWE-78 · OS Command Injection (page 46)
Page 46 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-24015 | High | 7.2 | 2021-07-12 | An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of FortiMail before 6.4.4 may allow an authe… |
CVE-2021-26106 | High | 7.8 | 2021-07-09 | An improper neutralization of special elements used in an OS Command vulnerability in FortiAP's console 6.4.1 through 6.4.5 and 6.2.4 through 6.2.5 may allow a… |
CVE-2021-34616 | Medium | 6.3 | 2021-07-08 | A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has rel… |
CVE-2021-34615 | Medium | 6.3 | 2021-07-08 | A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has rel… |
CVE-2021-34613 | Medium | 6.3 | 2021-07-08 | A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has rel… |
CVE-2021-34612 | Medium | 6.3 | 2021-07-08 | A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has rel… |
CVE-2021-34614 | Medium | 6.3 | 2021-07-08 | A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has rel… |
CVE-2021-34611 | High | 7.2 | 2021-07-08 | A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has rel… |
CVE-2021-34610 | High | 7.2 | 2021-07-08 | A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has rel… |
CVE-2021-32534 | Critical | 9.8 | 2021-07-07 | QSAN SANOS factory reset function does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands with… |
CVE-2021-32533 | Critical | 9.8 | 2021-07-07 | The QSAN SANOS setting page does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without pe… |
CVE-2021-32531 | Critical | 9.8 | 2021-07-07 | OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to execute arbitrary commands without permissions. The referred vulner… |
CVE-2021-32530 | Critical | 9.8 | 2021-07-07 | OS command injection vulnerability in Array function in QSAN XEVO allows remote unauthenticated attackers to execute arbitrary commands via status parameter. T… |
CVE-2021-32524 | Critical | 9.1 | 2021-07-07 | Command injection vulnerability in QSAN Storage Manager allows remote privileged users to execute arbitrary commands. Suggest contacting with QSAN and refer to… |
CVE-2021-32513 | Critical | 9.8 | 2021-07-07 | QsanTorture in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and execute arbitrary co… |
CVE-2021-32512 | Critical | 9.8 | 2021-07-07 | QuickInstall in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and execute arbitrary c… |
CVE-2021-20739 | High | 8.8 | 2021-07-07 | WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S all versions allows an u… |
CVE-2021-28804 | Critical | 9.8 | 2021-07-01 | A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary comm… |
CVE-2021-28802 | Critical | 9.8 | 2021-07-01 | A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary comm… |
CVE-2021-31838 | High | 8.4 | 2021-06-29 | A command injection vulnerability in MVISION EDR (MVEDR) prior to 3.4.0 allows an authenticated MVEDR administrator to trigger the EDR client to execute arbitr… |
CVE-2021-23399 | High | 7.3 | 2021-06-28 | This affects all versions of package wincred. If attacker-controlled user input is given to the getCredential function, it is possible for an attacker to execu… |
CVE-2021-20745 | High | 7.8 | 2021-06-28 | Inkdrop versions prior to v5.3.1 allows an attacker to execute arbitrary OS commands on the system where it runs by loading a file or code snippet containing a… |
CVE-2021-20740 | High | 8.8 | 2021-06-28 | Hitachi Virtual File Platform Versions prior to 5.5.3-09 and Versions prior to 6.4.3-09, and NEC Storage M Series NAS Gateway Nh4a/Nh8a versions prior to FOS 5… |
CVE-2021-33534 | High | 7.2 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the hostname functionality. A specially cr… |
CVE-2021-33533 | High | 8.8 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iw_webs functionality. A specially cra… |
CVE-2021-33532 | High | 8.8 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iw_webs functionality. A specially cra… |
CVE-2021-33530 | High | 8.8 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in encrypted diagnostic script functionality… |
CVE-2021-35049 | Critical | 9.9 | 2021-06-25 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface. The vulnerability could allow a s… |
CVE-2021-35047 | Critical | 9.9 | 2021-06-25 | Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with user level access to the CLI to in… |
CVE-2021-28958 | Critical | 9.8 | 2021-06-25 | Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password. |
CVE-2021-28800 | High | 8.1 | 2021-06-24 | A command injection vulnerability has been reported to affect QNAP NAS running legacy versions of QTS. If exploited, this vulnerability allows attackers to exe… |
CVE-2021-21809 | Critical | 9.1 | 2021-06-23 | A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to comm… |
CVE-2021-31769 | High | 8.8 | 2021-06-21 | MyQ Server in MyQ X Smart before 8.2 allows remote code execution by unprivileged users because administrative session data can be read in the %PROGRAMFILES%\M… |
CVE-2020-25755 | High | 8.8 | 2021-06-16 | An issue was discovered on Enphase Envoy R3.x and D4.x (and other current) devices. The upgrade_start function in /installer/upgrade_start allows remote authen… |
CVE-2021-32682 | Critical | 9.8 | 2021-06-14 | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities c… |
CVE-2021-32556 | Low | 3.8 | 2021-06-12 | It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would… |
CVE-2021-33358 | High | 8.8 | 2021-06-09 | Multiple vulnerabilities exist in RaspAP 2.3 to 2.6.5 in the "interface", "ssid" and "wpa_passphrase" POST parameters in /hostapd, when the parameter values co… |
CVE-2021-33357 | Critical | 9.8 | 2021-06-09 | A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/get_netcfg.php, when the "iface" parameter value contains specia… |
CVE-2021-33841 | Critical | 10.0 | 2021-06-09 | SGE-PLC1000 device, in its 0.9.2b firmware version, does not handle some requests correctly, allowing a remote attacker to inject code into the operating syste… |
CVE-2021-20731 | High | 8.8 | 2021-06-09 | WSR-1166DHP3 firmware Ver.1.16 and prior and WSR-1166DHP4 firmware Ver.1.02 and prior allow an attacker to execute arbitrary OS commands with root privileges v… |
CVE-2021-26472 | Critical | 10.0 | 2021-06-08 | In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/secure/download.php. Using this command… |
CVE-2021-32673 | High | 8.8 | 2021-06-08 | reg-keygen-git-hash-plugin is a reg-suit plugin to detect the snapshot key to be compare with using Git commit hash. reg-keygen-git-hash-plugin through and inc… |
CVE-2021-28811 | High | 7.2 | 2021-06-08 | If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. Roon Labs has already fixed this vulnerability in th… |
CVE-2021-1538 | Medium | 4.7 | 2021-06-04 | A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to execute arbi… |
CVE-2021-24023 | High | 7.8 | 2021-06-03 | An improper input validation in FortiAI v1.4.0 and earlier may allow an authenticated user to gain system shell access via a malicious payload in the "diagnose… |
CVE-2021-28812 | High | 8.8 | 2021-06-03 | A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to ex… |
CVE-2021-22123 | High | 7.6 | 2021-06-01 | An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated… |
CVE-2020-26670 | High | 8.8 | 2021-06-01 | A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted re… |
CVE-2021-3515 | Medium | 6.7 | 2021-06-01 | A shell injection flaw was found in pglogical in versions before 2.3.4 and before 3.6.26. An attacker with CREATEDB privileges on a PostgreSQL server can craft… |
CVE-2021-24312 | High | 7.2 | 2021-06-01 | The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super C… |
CVE-2021-20026 | High | 8.8 | 2021-05-27 | A vulnerability in the SonicWall NSM On-Prem product allows an authenticated attacker to perform OS command injection using a crafted HTTP request. This vulner… |
CVE-2021-30187 | Medium | 5.3 | 2021-05-25 | CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command. |
CVE-2021-33525 | High | 8.8 | 2021-05-24 | EyesOfNetwork eonweb through 5.3-11 allows Remote Command Execution (by authenticated users) via shell metacharacters in the nagios_path parameter to lilac/exp… |
CVE-2021-29300 | Critical | 9.8 | 2021-05-24 | The @ronomon/opened library before 1.5.2 is vulnerable to a command injection vulnerability which would allow a remote attacker to execute commands on the syst… |
CVE-2021-20557 | High | 7.2 | 2021-05-24 | IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM… |
CVE-2021-1560 | Medium | 6.5 | 2021-05-22 | Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, remote attacker to perform a command injection attack on an affected devic… |
CVE-2021-1559 | Medium | 6.5 | 2021-05-22 | Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, remote attacker to perform a command injection attack on an affected devic… |
CVE-2021-1558 | Medium | 6.0 | 2021-05-22 | Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the… |
CVE-2021-1557 | Medium | 6.0 | 2021-05-22 | Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the… |
CVE-2021-1487 | High | 8.8 | 2021-05-22 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Evolved Programmable Network (EPN) Manager could allow an authenticated… |
CVE-2021-33514 | High | 8.8 | 2021-05-21 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker via the vulnerable /sqfs/lib/libsal.so.0.0 library used by a CGI appli… |
CVE-2021-20719 | Medium | 6.8 | 2021-05-20 | RFNTPS firmware versions System_01000004 and earlier, and Web_01000004 and earlier allow an attacker on the same network segment to execute arbitrary OS comman… |
CVE-2021-31324 | Critical | 9.8 | 2021-05-18 | The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution. |
CVE-2021-32305 | Critical | 9.8 | 2021-05-18 | WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter. |
CVE-2020-36198 | Medium | 6.7 | 2021-05-13 | A command injection vulnerability has been reported to affect certain versions of Malware Remover. If exploited, this vulnerability allows remote attackers to… |
CVE-2021-32605 | Critical | 9.8 | 2021-05-11 | zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonst… |
CVE-2021-31915 | Critical | 9.8 | 2021-05-11 | In JetBrains TeamCity before 2020.2.4, OS command injection leading to remote code execution was possible. |
CVE-2021-23012 | High | 8.2 | 2021-05-10 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, and 13.1.x before 13.1.4, lack of input validation for items used in the… |
CVE-2021-32090 | Critical | 9.8 | 2021-05-07 | The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter. |
CVE-2021-28151 | High | 8.8 | 2021-05-06 | Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cgi ping command, whi… |
CVE-2021-26543 | High | 8.8 | 2021-05-06 | The "gitDiff" function in Wayfair git-parse <=1.0.4 has a command injection vulnerability. Clients of the git-parse library are unlikely to be aware of this, s… |
CVE-2021-21550 | Medium | 6.0 | 2021-05-06 | Dell EMC PowerScale OneFS 8.1.0-9.1.0 contain an improper neutralization of special elements used in an OS command vulnerability. This vulnerability can allow… |
CVE-2021-21527 | Medium | 6.0 | 2021-05-06 | Dell PowerScale OneFS 8.1.0-9.1.0 contain an improper neutralization of special elements used in an OS command vulnerability. This vulnerability may allow an a… |
CVE-2021-1514 | High | 7.8 | 2021-05-06 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with Administrator… |
CVE-2021-1498 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injecti… |
CVE-2021-1497 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injecti… |
CVE-2021-1421 | High | 7.8 | 2021-05-06 | A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to perform a command injection attack on a… |
CVE-2021-1401 | High | 8.8 | 2021-05-06 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2020-21999 | High | 8.8 | 2021-05-04 | iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using default credentials. This can be exploite… |
CVE-2021-29369 | Critical | 9.8 | 2021-05-03 | The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands. |
CVE-2021-21530 | High | 8.3 | 2021-04-30 | Dell OpenManage Enterprise-Modular (OME-M) versions prior to 1.30.00 contain a security bypass vulnerability. An authenticated malicious user with low privileg… |
CVE-2021-21388 | High | 8.9 | 2021-04-29 | systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systemi… |
CVE-2021-1488 | Medium | 6.7 | 2021-04-29 | A vulnerability in the upgrade process of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an aut… |
CVE-2021-1476 | Medium | 6.7 | 2021-04-29 | A vulnerability in the CLI of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated… |
CVE-2021-1448 | High | 7.8 | 2021-04-29 | A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with roo… |
CVE-2021-30234 | Critical | 9.8 | 2021-04-29 | The api/ZRIGMP/set_MLD_PROXY interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharact… |
CVE-2021-30233 | Critical | 9.8 | 2021-04-29 | The api/ZRIptv/setIptvInfo interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacter… |
CVE-2021-30232 | Critical | 9.8 | 2021-04-29 | The api/ZRIGMP/set_IGMP_PROXY interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharac… |
CVE-2021-30231 | Critical | 9.8 | 2021-04-29 | The api/zrDm/set_ZRElink interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters… |
CVE-2021-30230 | Critical | 9.8 | 2021-04-29 | The api/ZRFirmware/set_time_zone interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacha… |
CVE-2021-30229 | High | 8.8 | 2021-04-29 | The api/zrDm/set_zrDm interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in… |
CVE-2021-30228 | Critical | 9.8 | 2021-04-29 | The api/ZRAndlink/set_ZRAndlink interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metachar… |
CVE-2020-21992 | High | 8.8 | 2021-04-29 | Inim Electronics SmartLiving SmartLAN/G/SI <=6.x suffers from an authenticated remote command injection vulnerability. The issue exist due to the 'par' POST pa… |
CVE-2021-29147 | High | 8.8 | 2021-04-29 | A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has rel… |
CVE-2021-25167 | High | 8.8 | 2021-04-29 | A remote unauthorized access vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for Air… |
CVE-2021-25166 | High | 8.8 | 2021-04-29 | A remote unauthorized access vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for Air… |
CVE-2021-21414 | High | 7.7 | 2021-04-29 | Prisma is an open source ORM for Node.js & TypeScript. As of today, we are not aware of any Prisma users or external consumers of the `@prisma/sdk` package who… |
CVE-2021-30166 | High | 7.2 | 2021-04-28 | The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack… |
CVE-2020-22000 | High | 8.0 | 2021-04-27 | HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin. This can be exploited with a CSRF vulne… |
CVE-2021-30642 | Critical | 9.8 | 2021-04-27 | An input validation flaw in the Symantec Security Analytics web UI 7.2 prior 7.2.7, 8.1, prior to 8.1.3-NSR3, 8.2, prior to 8.2.1-NSR2 or 8.2.2 allows a remote… |