CWE-78 · OS Command Injection (page 47)
Page 47 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-20711 | Critical | 9.8 | 2021-04-26 | Aterm WG2600HS firmware Ver1.5.1 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors. |
CVE-2021-20708 | High | 7.2 | 2021-04-26 | NEC Aterm devices (Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware Ver1.5.1 and earlier… |
CVE-2021-20696 | High | 8.8 | 2021-04-26 | DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to execute arbitrary OS commands by sending a specially crafted request to… |
CVE-2020-7034 | High | 7.2 | 2021-04-23 | A command injection vulnerability in Avaya Session Border Controller for Enterprise could allow an authenticated, remote attacker to send specially crafted mes… |
CVE-2021-31607 | High | 7.8 | 2021-04-23 | In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion… |
CVE-2021-0265 | High | 8.1 | 2021-04-22 | An unvalidated REST API in the AppFormix Agent of Juniper Networks AppFormix allows an unauthenticated remote attacker to execute commands as root on the host… |
CVE-2021-29465 | High | 8.3 | 2021-04-22 | Discord-Recon is a bot for the Discord chat service. Versions of Discord-Recon 0.0.3 and prior contain a vulnerability in which a remote attacker is able to ov… |
CVE-2020-35314 | Critical | 9.8 | 2021-04-20 | A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attackers to upload a custo… |
CVE-2021-21526 | Medium | 6.0 | 2021-04-20 | Dell PowerScale OneFS 8.1.0 - 9.1.0 contains a privilege escalation in SmartLock compliance mode that may allow compadmin to execute arbitrary commands as root. |
CVE-2021-20991 | Critical | 9.8 | 2021-04-19 | In Fibaro Home Center 2 and Lite devices with firmware version 4.540 and older an authenticated user can run commands as root user using a command injection vu… |
CVE-2021-23381 | High | 7.3 | 2021-04-18 | This affects all versions of package killing. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is… |
CVE-2021-23380 | Medium | 5.6 | 2021-04-18 | This affects all versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certain operating system… |
CVE-2021-23379 | High | 7.3 | 2021-04-18 | This affects all versions of package portkiller. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. Th… |
CVE-2021-23378 | Critical | 9.8 | 2021-04-18 | This affects all versions of package picotts. If attacker-controlled user input is given to the say function, it is possible for an attacker to execute arbitra… |
CVE-2021-23377 | Critical | 9.8 | 2021-04-18 | This affects all versions of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an attacker to execut… |
CVE-2021-23376 | Critical | 9.8 | 2021-04-18 | This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function, it is possible for an attacker to execu… |
CVE-2021-23375 | High | 7.3 | 2021-04-18 | This affects all versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitra… |
CVE-2021-23374 | High | 7.3 | 2021-04-18 | This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arb… |
CVE-2020-2509 | Critical | 9.8 | 2021-04-17 | A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary command… |
CVE-2021-27692 | Critical | 9.8 | 2021-04-16 | Command Injection in Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary O… |
CVE-2021-27691 | Critical | 9.8 | 2021-04-16 | Command Injection in Tenda G0 routers with firmware versions v15.11.0.6(9039)_CN and v15.11.0.5(5876)_CN , and Tenda G1 and G3 routers with firmware versions v… |
CVE-2021-29449 | Medium | 6.3 | 2021-04-14 | Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were discovered in vers… |
CVE-2021-27710 | Critical | 9.8 | 2021-04-14 | Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote… |
CVE-2021-27708 | Critical | 9.8 | 2021-04-14 | Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote… |
CVE-2021-27252 | High | 8.8 | 2021-04-14 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Authentica… |
CVE-2021-27249 | High | 8.8 | 2021-04-14 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access points. Aut… |
CVE-2021-27113 | Critical | 9.8 | 2021-04-14 | An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of… |
CVE-2020-27227 | Critical | 9.8 | 2021-04-13 | An exploitable unatuhenticated command injection exists in the OpenClinic GA 5.173.3. Specially crafted web requests can cause commands to be executed on the s… |
CVE-2021-29003 | Critical | 9.8 | 2021-04-13 | Genexis PLATINUM 4410 2.1 P4410-V2-1.28 devices allow remote attackers to execute arbitrary code via shell metacharacters to sys_config_valid.xgi, as demonstra… |
CVE-2021-29379 | High | 8.8 | 2021-04-12 | An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can perfor… |
CVE-2021-21433 | Critical | 9.9 | 2021-04-09 | Discord Recon Server is a bot that allows you to do your reconnaissance process from your Discord. Remote code execution in version 0.0.1 would allow remote us… |
CVE-2020-21883 | High | 8.8 | 2021-04-09 | Unibox U-50 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a OS command injection vulnerability in /tools/ping, which can leads to c… |
CVE-2021-1473 | Medium | 5.3 | 2021-04-08 | Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary comma… |
CVE-2021-28927 | High | 7.8 | 2021-04-07 | The text-to-speech engine in libretro RetroArch for Windows 1.9.0 passes unsanitized input to PowerShell through platform_win32.c via the accessibility_speak_w… |
CVE-2021-28204 | High | 7.2 | 2021-04-06 | The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not filter the specific parameter. As obtaining the… |
CVE-2021-28203 | High | 7.2 | 2021-04-06 | The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter. As obtaining the administrator permission… |
CVE-2020-27600 | Critical | 9.8 | 2021-04-02 | HNAP1/control/SetMasterWLanSettings.php in D-Link D-Link Router DIR-846 DIR-846 A1_100.26 allows remote attackers to execute arbitrary commands via shell metac… |
CVE-2021-28113 | Medium | 6.7 | 2021-04-02 | A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to… |
CVE-2021-29083 | High | 7.2 | 2021-04-01 | Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows… |
CVE-2021-23348 | Medium | 6.3 | 2021-03-31 | This affects the package portprocesses before 1.0.5. If (attacker-controlled) user input is given to the killProcess function, it is possible for an attacker t… |
CVE-2021-21412 | Medium | 6.4 | 2021-03-30 | Potential for arbitrary code execution in npm package @thi.ng/egf `#gpg`-tagged property values (only if `decrypt: true` option is enabled). PR with patch has… |
CVE-2021-23363 | Medium | 6.3 | 2021-03-30 | This affects the package kill-by-port before 0.0.2. If (attacker-controlled) user input is given to the killByPort function, it is possible for an attacker to… |
CVE-2021-26810 | Critical | 9.8 | 2021-03-30 | D-link DIR-816 A2 v1.10 is affected by a remote code injection vulnerability. An HTTP request parameter can be used in command string construction in the handl… |
CVE-2021-25162 | High | 8.1 | 2021-03-30 | A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4… |
CVE-2021-25150 | High | 8.8 | 2021-03-30 | A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5… |
CVE-2021-25146 | High | 7.2 | 2021-03-30 | A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5… |
CVE-2021-27273 | High | 8.8 | 2021-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although… |
CVE-2020-24636 | Critical | 9.8 | 2021-03-29 | A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5… |
CVE-2020-24635 | High | 7.2 | 2021-03-29 | A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5… |
CVE-2021-21372 | High | 8.3 | 2021-03-26 | Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places… |
CVE-2020-28695 | High | 8.8 | 2021-03-26 | Askey Fiber Router RTF3505VW-N1 BR_SV_g000_R3505VWN1001_s32_7 devices allow Remote Code Execution and retrieval of admin credentials to log into the Dashboard… |
CVE-2021-20682 | High | 7.2 | 2021-03-26 | baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via unspecified vectors. |
CVE-2020-10583 | High | 8.8 | 2021-03-25 | The /admin/admapi.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote authenticated attackers to execute arbitrary OS commands on… |
CVE-2020-1946 | Critical | 9.8 | 2021-03-25 | In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this… |
CVE-2021-21386 | Critical | 9.3 | 2021-03-24 | APKLeaks is an open-source project for scanning APK file for URIs, endpoints & secrets. APKLeaks prior to v2.0.3 allows remote attackers to execute arbitrary O… |
CVE-2021-1452 | Medium | 6.8 | 2021-03-24 | A vulnerability in the ROM Monitor (ROMMON) of Cisco IOS XE Software for Cisco Catalyst IE3200, IE3300, and IE3400 Rugged Series Switches, Cisco Catalyst IE340… |
CVE-2021-1443 | Medium | 5.5 | 2021-03-24 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the unde… |
CVE-2021-1441 | Medium | 6.7 | 2021-03-24 | A vulnerability in the hardware initialization routines of Cisco IOS XE Software for Cisco 1100 Series Industrial Integrated Services Routers and Cisco ESR6300… |
CVE-2021-1384 | Medium | 6.5 | 2021-03-24 | A vulnerability in Cisco IOx application hosting environment of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands into the… |
CVE-2021-1382 | Medium | 6.0 | 2021-03-24 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root p… |
CVE-2021-21345 | Medium | 5.8 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-23360 | High | 7.5 | 2021-03-21 | This affects the package killport before 1.0.2. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. Thi… |
CVE-2021-28961 | High | 8.8 | 2021-03-21 | applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07 allows remote authenticated users to inject arbitrary command… |
CVE-2021-23359 | High | 7.5 | 2021-03-18 | This affects all versions of package port-killer. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. T… |
CVE-2021-23356 | Medium | 5.6 | 2021-03-15 | This affects all versions of package kill-process-by-name. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary co… |
CVE-2021-23355 | Medium | 5.6 | 2021-03-15 | This affects all versions of package ps-kill. If (attacker-controlled) user input is given to the kill function, it is possible for an attacker to execute arbi… |
CVE-2021-20017 | High | 8.8 | 2021-03-13 | A post-authenticated command injection vulnerability in SonicWall SMA100 allows an authenticated attacker to execute OS commands as a 'nobody' user. This vulne… |
CVE-2021-28143 | High | 8.0 | 2021-03-11 | /jsonrpc on D-Link DIR-841 3.03 and 3.04 devices allows authenticated command injection via ping, ping6, or traceroute (under System Tools). |
CVE-2021-28144 | High | 8.8 | 2021-03-11 | prog.cgi on D-Link DIR-3060 devices before 1.11b04 HF2 allows remote authenticated users to inject arbitrary commands in an admin or root context because SetVi… |
CVE-2021-28132 | Critical | 9.8 | 2021-03-11 | LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool (in the Support section) allows upload o… |
CVE-2021-24033 | Medium | 5.6 | 2021-03-09 | react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This func… |
CVE-2021-21503 | High | 7.8 | 2021-03-08 | PowerScale OneFS 8.1.2,8.2.2 and 9.1.0 contains an improper input sanitization issue in a command. The Compadmin user could potentially exploit this vulnerabil… |
CVE-2020-27575 | High | 8.8 | 2021-03-08 | Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability. The web administration contains functionality in which administrators are able… |
CVE-2021-27256 | High | 8.8 | 2021-03-05 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Although a… |
CVE-2021-26970 | Medium | 6.3 | 2021-03-05 | A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabili… |
CVE-2021-26962 | High | 7.2 | 2021-03-05 | A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabili… |
CVE-2021-27886 | Critical | 9.8 | 2021-03-02 | rakibtg Docker Dashboard before 2021-02-28 allows command injection in backend/utilities/terminal.js via shell metacharacters in the command parameter of an AP… |
CVE-2021-3342 | Critical | 9.8 | 2021-03-01 | EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted LaTeX input to a cgi/latex2png?latex= URI. |
CVE-2021-26704 | High | 8.8 | 2021-03-01 | EPrints 3.4.2 allows remote attackers to execute arbitrary commands via crafted input to the verb parameter in a cgi/toolbox/toolbox URI. |
CVE-2021-26476 | Critical | 9.8 | 2021-03-01 | EPrints 3.4.2 allows remote attackers to execute OS commands via crafted LaTeX input to a cgi/cal?year= URI. |
CVE-2019-25022 | Critical | 9.8 | 2021-02-27 | An issue was discovered in Scytl sVote 2.1. An attacker can inject code that gets executed by creating an election-event and injecting a payload over an event… |
CVE-2021-21302 | Medium | 6.8 | 2021-02-26 | PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using sho… |
CVE-2021-20658 | Critical | 9.8 | 2021-02-24 | SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to execute arbitrary OS commands with the web server privilege via unspecified vectors. |
CVE-2021-26680 | High | 7.2 | 2021-02-23 | A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vu… |
CVE-2021-26679 | High | 7.2 | 2021-02-23 | A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vu… |
CVE-2021-26684 | High | 7.2 | 2021-02-23 | A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vu… |
CVE-2021-26683 | High | 7.2 | 2021-02-23 | A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vu… |
CVE-2021-26681 | High | 7.2 | 2021-02-23 | A remote authenticated command Injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vu… |
CVE-2020-28429 | High | 7.3 | 2021-02-23 | All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",functio… |
CVE-2021-26724 | High | 7.2 | 2021-02-22 | OS Command Injection vulnerability when changing date settings or hostname using web GUI of Nozomi Networks Guardian and CMC allows authenticated administrator… |
CVE-2021-3149 | High | 7.2 | 2021-02-22 | On Netshield NANO 25 10.2.18 devices, /usr/local/webmin/System/manual_ping.cgi allows OS command injection (after authentication by the attacker) because the s… |
CVE-2020-36246 | High | 7.8 | 2021-02-19 | Amaze File Manager before 3.5.1 allows attackers to obtain root privileges via shell metacharacters in a symbolic link. |
CVE-2019-25024 | Critical | 9.8 | 2021-02-19 | OpenRepeater (ORP) before 2.2 allows unauthenticated command injection via shell metacharacters in the functions/ajax_system.php post_service parameter. |
CVE-2021-26747 | Critical | 9.8 | 2021-02-18 | Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command, leading to remote code execution. |
CVE-2020-28490 | Critical | 9.1 | 2021-02-18 | The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks). For example: git.reset('atouch HACKEDb') |
CVE-2020-29664 | High | 7.8 | 2021-02-18 | A command injection issue in dji_sys in DJI Mavic 2 Remote Controller before firmware version 01.00.0510 allows for code execution via a malicious firmware upg… |
CVE-2021-20655 | High | 7.2 | 2021-02-17 | FileZen (V3.0.0 to V4.2.7 and V5.0.0 to V5.0.2) allows a remote attacker with administrator rights to execute arbitrary OS commands via unspecified vectors. |
CVE-2021-27104 | Critical | 9.8 | 2021-02-16 | Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380… |
CVE-2021-27102 | High | 7.8 | 2021-02-16 | Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later. |
CVE-2021-20074 | High | 8.8 | 2021-02-16 | Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows users to escape the provided command line interface and execute arbitrary OS commands. |