CWE-78 · OS Command Injection (page 48)
Page 48 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-25064 | Critical | 9.8 | 2022-02-25 | TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a remote code execution (RCE) vulnerability via the function oal_wan6_setIpAddr. |
CVE-2022-25061 | Critical | 9.8 | 2022-02-25 | TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_setIp6DefaultRoute. |
CVE-2022-25060 | Critical | 9.8 | 2022-02-25 | TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_startPing. |
CVE-2022-25328 | Medium | 5.0 | 2022-02-25 | The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circums… |
CVE-2022-24288 | High | 8.8 | 2022-02-25 | In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection fr… |
CVE-2022-25084 | Critical | 9.8 | 2022-02-24 | TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to exe… |
CVE-2022-25083 | Critical | 9.8 | 2022-02-24 | TOTOLink A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers… |
CVE-2022-25082 | Critical | 9.8 | 2022-02-24 | TOTOLink A950RG V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 were discovered to contain a command injection vulnerability in the "Main" function. This vuln… |
CVE-2022-25081 | Critical | 9.8 | 2022-02-24 | TOTOLink T10 V5.9c.5061_B20200511 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to ex… |
CVE-2022-25080 | Critical | 9.8 | 2022-02-24 | TOTOLink A830R V5.9c.4729_B20191112 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to… |
CVE-2022-25079 | Critical | 9.8 | 2022-02-24 | TOTOLink A810R V4.1.2cu.5182_B20201026 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers… |
CVE-2022-25078 | Critical | 9.8 | 2022-02-24 | TOTOLink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers… |
CVE-2022-25077 | Critical | 9.8 | 2022-02-24 | TOTOLink A3100R V4.1.2cu.5050_B20200504 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers… |
CVE-2022-25076 | Critical | 9.8 | 2022-02-24 | TOTOLink A800R V4.1.2cu.5137_B20200730 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers… |
CVE-2022-25075 | Critical | 9.8 | 2022-02-24 | TOTOLink A3000RU V5.9c.2280_B20180512 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers t… |
CVE-2021-4029 | High | 8.8 | 2022-02-24 | A command injection vulnerability in the CGI program of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary OS commands via a LAN inter… |
CVE-2022-20650 | High | 8.8 | 2022-02-23 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges… |
CVE-2022-21143 | High | 7.5 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not prope… |
CVE-2021-46319 | Critical | 9.8 | 2022-02-17 | Remote Code Execution (RCE) vulnerability exists in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicious users can use thi… |
CVE-2021-46315 | Critical | 9.8 | 2022-02-17 | Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetWizardConfig.php in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA… |
CVE-2021-46314 | Critical | 9.8 | 2022-02-17 | A Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetNetworkTomographySettings.php of D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR8… |
CVE-2021-45382 | Critical | 9.8 | 2022-02-17 | A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via th… |
CVE-2021-3781 | Critical | 9.9 | 2022-02-16 | A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This… |
CVE-2022-22945 | High | 7.8 | 2022-02-16 | VMware NSX Edge contains a CLI shell injection vulnerability. A malicious actor with SSH access to an NSX-Edge appliance can execute arbitrary commands on the… |
CVE-2021-26726 | High | 8.8 | 2022-02-16 | A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges… |
CVE-2022-25175 | High | 8.8 | 2022-02-15 | Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing atta… |
CVE-2022-25174 | High | 8.8 | 2022-02-15 | Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries, all… |
CVE-2022-25173 | High | 8.8 | 2022-02-15 | Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jen… |
CVE-2022-23389 | Critical | 9.8 | 2022-02-14 | PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulnerability via the cmdarray parameter. |
CVE-2022-0557 | High | 7.2 | 2022-02-11 | OS Command Injection in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-20708 | Critical | 10.0 | 2022-02-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbi… |
CVE-2021-26616 | High | 7.8 | 2022-02-09 | An OS command injection was found in SecuwaySSL, when special characters injection on execute command with runCommand arguments. |
CVE-2021-43928 | Critical | 9.9 | 2022-02-07 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in mail sending and receiving component in Synology Ma… |
CVE-2022-24552 | Critical | 9.8 | 2022-02-06 | A flaw was found in the REST API in StarWind Stack. REST command, which manipulates a virtual disk, doesn’t check input parameters. Some of them go directly to… |
CVE-2022-23611 | High | 8.1 | 2022-02-04 | iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize image file p… |
CVE-2022-0365 | Critical | 9.1 | 2022-02-04 | The affected product is vulnerable to an authenticated OS command injection, which may allow an attacker to inject and execute arbitrary shell commands as the… |
CVE-2021-29393 | Critical | 9.8 | 2022-02-04 | Remote Code Execution in cominput.jsp and comoutput.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to inje… |
CVE-2021-45987 | Critical | 9.8 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetNetCheckTools. This vulnerabil… |
CVE-2021-45986 | Critical | 9.8 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetUSBShareInfo. This vulnerabili… |
CVE-2021-41018 | High | 8.8 | 2022-02-02 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below all… |
CVE-2021-43073 | High | 8.8 | 2022-02-02 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and b… |
CVE-2021-41016 | High | 7.8 | 2022-02-02 | A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiExtender version 7.0.1 and below, 4.2.3 and below, 4.1.7… |
CVE-2021-40412 | High | 7.2 | 2022-01-28 | An OScommand injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [8] the devname variable… |
CVE-2021-40411 | High | 7.2 | 2022-01-28 | An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [6] the dns_data->dns2 va… |
CVE-2021-40410 | High | 7.2 | 2022-01-28 | An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [4] the dns_data->dns1 va… |
CVE-2021-40409 | Critical | 9.8 | 2022-01-28 | An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS… |
CVE-2021-40408 | Critical | 9.8 | 2022-01-28 | An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS… |
CVE-2021-40407 | High | 7.2 | 2022-01-28 | An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS… |
CVE-2020-28885 | High | 7.2 | 2022-01-28 | Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject commands through the Gogo Shell modu… |
CVE-2020-28884 | High | 7.2 | 2022-01-28 | Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject Groovy script to execute any OS comm… |
CVE-2021-32849 | High | 8.8 | 2022-01-26 | Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in ve… |
CVE-2021-36296 | High | 7.2 | 2022-01-25 | Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. A remote malicious user with privileges ma… |
CVE-2021-36295 | High | 7.2 | 2022-01-25 | Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. A remote malicious user with privileges ma… |
CVE-2021-45845 | High | 7.8 | 2022-01-25 | The Path Sanity Check script of FreeCAD 0.19 is vulnerable to OS command injection, allowing an attacker to execute arbitrary commands via a crafted FCStd docu… |
CVE-2021-45844 | High | 7.8 | 2022-01-25 | Improper sanitization in the invocation of ODA File Converter from FreeCAD 0.19 allows an attacker to inject OS commands via a crafted filename. |
CVE-2022-23935 | High | 7.8 | 2022-01-25 | lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection. |
CVE-2021-43589 | Medium | 6.0 | 2022-01-24 | Dell EMC Unity, Dell EMC UnityVSA and Dell EMC Unity XT versions prior to 5.1.2.0.5.007 contain an operating system (OS) command injection Vulnerability. A loc… |
CVE-2021-44981 | High | 8.8 | 2022-01-24 | In QuickBox Pro v2.5.8 and below, the config.php file has a variable which takes a GET parameter value and parses it into a shell_exec(''); function without pr… |
CVE-2021-31854 | High | 7.7 | 2022-01-19 | A command Injection Vulnerability in McAfee Agent (MA) for Windows prior to 5.7.5 allows local users to inject arbitrary shell code into the file cleanup.exe… |
CVE-2021-38965 | High | 8.8 | 2022-01-17 | IBM FileNet Content Manager 5.5.4, 5.5.6, and 5.5.7 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specia… |
CVE-2021-33827 | High | 7.2 | 2022-01-15 | The files_antivirus component before 1.0.0 for ownCloud allows OS Command Injection via the administration settings. |
CVE-2021-33962 | Critical | 9.8 | 2022-01-14 | China Mobile An Lianbao WF-1 router v1.0.1 is affected by an OS command injection vulnerability in the web interface /api/ZRUsb/pop_usb_device component. |
CVE-2022-22991 | High | 7.8 | 2022-01-13 | A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP cal… |
CVE-2022-20617 | High | 8.8 | 2022-01-12 | Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable… |
CVE-2022-21668 | High | 8.0 | 2022-01-10 | pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files a… |
CVE-2021-23154 | Medium | 6.3 | 2022-01-10 | In Lens prior to 5.3.4, custom helm chart configuration creates helm commands from string concatenation of provided arguments which are then executed in the us… |
CVE-2021-43779 | Critical | 9.9 | 2022-01-05 | GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 suffers from authenti… |
CVE-2021-45912 | High | 7.8 | 2022-01-04 | An unauthenticated Named Pipe channel in Controlup Real-Time Agent (cuAgent.exe) before 8.5 potentially allows an attacker to run OS commands via the ProcessAc… |
CVE-2021-45979 | High | 7.8 | 2022-01-04 | Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via app.launchURL in the JavaScript API. |
CVE-2021-45978 | High | 7.8 | 2022-01-04 | Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via xfa.host.gotoURL in the XFA API. |
CVE-2021-20173 | High | 8.8 | 2021-12-30 | Netgear Nighthawk R6700 version 1.0.4.120 contains a command injection vulnerability in update functionality of the device. By triggering a system update check… |
CVE-2021-20160 | High | 8.8 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 contains a command injection vulnerability in the smb functionality of the device. The username parameter used when… |
CVE-2021-20159 | High | 8.8 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 is vulnerable to command injection. The system log functionality of the firmware allows for command injection as roo… |
CVE-2021-35032 | Medium | 6.4 | 2021-12-28 | A vulnerability in the 'libsal.so' of the Zyxel GS1900 series firmware version 2.60 could allow an authenticated local user to execute arbitrary OS commands vi… |
CVE-2021-35031 | Medium | 6.8 | 2021-12-28 | A vulnerability in the TFTP client of Zyxel GS1900 series firmware, XGS1210 series firmware, and XGS1250 series firmware, which could allow an authenticated LA… |
CVE-2021-43857 | Critical | 9.8 | 2021-12-27 | Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in versio… |
CVE-2021-45602 | Medium | 6.1 | 2021-12-26 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.66, EX2700 before 1.0.1.68, WN3000RPv2 befo… |
CVE-2021-3621 | High | 8.8 | 2021-12-23 | A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows… |
CVE-2021-44453 | Critical | 10.0 | 2021-12-23 | mySCADA myPRO: Versions 8.20.0 and prior has a vulnerable debug interface which includes a ping utility, which may allow an attacker to inject arbitrary operat… |
CVE-2021-43984 | Critical | 10.0 | 2021-12-23 | mySCADA myPRO: Versions 8.20.0 and prior has a feature where the firmware can be updated, which may allow an attacker to inject arbitrary operating system comm… |
CVE-2021-43981 | Critical | 10.0 | 2021-12-23 | mySCADA myPRO: Versions 8.20.0 and prior has a feature to send emails, which may allow an attacker to inject arbitrary operating system commands through a spec… |
CVE-2021-3584 | High | 7.2 | 2021-12-23 | A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite… |
CVE-2021-23198 | Critical | 10.0 | 2021-12-23 | mySCADA myPRO: Versions 8.20.0 and prior has a feature where the password can be specified, which may allow an attacker to inject arbitrary operating system co… |
CVE-2021-22657 | Critical | 10.0 | 2021-12-23 | mySCADA myPRO: Versions 8.20.0 and prior has a feature where the API password can be specified, which may allow an attacker to inject arbitrary operating syste… |
CVE-2021-4144 | High | 8.8 | 2021-12-23 | TP-Link wifi router TL-WR802N V4(JP), with firmware version prior to 211202, is vulnerable to OS command injection. |
CVE-2021-21888 | Critical | 9.1 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager SslGenerateCertificate functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A speci… |
CVE-2021-21884 | Critical | 9.1 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP… |
CVE-2021-21883 | Critical | 9.9 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager Diagnostics: Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HT… |
CVE-2021-21882 | High | 8.8 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP reque… |
CVE-2021-21881 | Critical | 9.9 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-cra… |
CVE-2021-21877 | Critical | 9.1 | 2021-12-22 | Specially-crafted HTTP requests can lead to arbitrary command execution in “GET” requests. An attacker can make authenticated HTTP requests to trigger this vul… |
CVE-2021-21876 | Critical | 9.1 | 2021-12-22 | Specially-crafted HTTP requests can lead to arbitrary command execution in PUT requests. An attacker can make authenticated HTTP requests to trigger this vulne… |
CVE-2021-21875 | Critical | 9.1 | 2021-12-22 | A specially-crafted HTTP request can lead to arbitrary command execution in EC keypasswd parameter. An attacker can make an authenticated HTTP request to trigg… |
CVE-2021-21874 | Critical | 9.1 | 2021-12-22 | A specially-crafted HTTP request can lead to arbitrary command execution in DSA keypasswd parameter. An attacker can make an authenticated HTTP request to trig… |
CVE-2021-21873 | Critical | 9.1 | 2021-12-22 | A specially-crafted HTTP request can lead to arbitrary command execution in RSA keypasswd parameter. An attacker can make an authenticated HTTP request to trig… |
CVE-2021-21872 | Critical | 9.9 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager Diagnostics: Traceroute functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-craf… |
CVE-2020-19316 | High | 8.8 | 2021-12-20 | OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17. |
CVE-2020-8105 | Critical | 9.6 | 2021-12-20 | OS Command Injection vulnerability in the wirelessConnect handler of Abode iota All-In-One Security Kit allows an attacker to inject commands and gain root acc… |
CVE-2021-42912 | High | 8.8 | 2021-12-16 | FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. This vulnerability allows the attacker, once logged in, to send com… |
CVE-2021-44235 | Medium | 6.7 | 2021-12-14 | Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allow an attacker… |