CWE-78 · OS Command Injection (page 49)
Page 49 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-39065 | Critical | 9.8 | 2021-12-13 | IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation o… |
CVE-2021-21954 | Critical | 9.9 | 2021-12-09 | A command execution vulnerability exists in the wifi_country_code_update functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. A special… |
CVE-2021-20144 | High | 8.8 | 2021-12-09 | An unauthenticated command injection vulnerability exists in the parameters of operation 49 in the controller_server service on Gryphon Tower routers. An unaut… |
CVE-2021-20143 | High | 8.8 | 2021-12-09 | An unauthenticated command injection vulnerability exists in the parameters of operation 48 in the controller_server service on Gryphon Tower routers. An unaut… |
CVE-2021-20142 | High | 8.8 | 2021-12-09 | An unauthenticated command injection vulnerability exists in the parameters of operation 41 in the controller_server service on Gryphon Tower routers. An unaut… |
CVE-2021-20141 | High | 8.8 | 2021-12-09 | An unauthenticated command injection vulnerability exists in the parameters of operation 32 in the controller_server service on Gryphon Tower routers. An unaut… |
CVE-2021-20140 | High | 8.8 | 2021-12-09 | An unauthenticated command injection vulnerability exists in the parameters of operation 10 in the controller_server service on Gryphon Tower routers. An unaut… |
CVE-2021-20139 | High | 8.8 | 2021-12-09 | An unauthenticated command injection vulnerability exists in the parameters of operation 3 in the controller_server service on Gryphon Tower routers. An unauth… |
CVE-2021-20138 | High | 8.8 | 2021-12-09 | An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web interface at /cgi-bin/luci/rc. An unauthenti… |
CVE-2021-42759 | Medium | 6.7 | 2021-12-09 | A violation of secure design principles in Fortinet Meru AP version 8.6.1 and below, version 8.5.5 and below allows attacker to execute unauthorized code or co… |
CVE-2021-23862 | High | 7.2 | 2021-12-08 | A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. This issue also affect… |
CVE-2021-36195 | Medium | 4.2 | 2021-12-08 | Multiple command injection vulnerabilities in the command line interpreter of FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, and 6… |
CVE-2021-36180 | High | 8.1 | 2021-12-08 | Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and be… |
CVE-2021-20044 | High | 8.8 | 2021-12-08 | A post-authentication remote command injection vulnerability in SonicWall SMA100 allows a remote authenticated attacker to execute OS system commands in the ap… |
CVE-2021-20039 | High | 8.8 | 2021-12-08 | Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to i… |
CVE-2021-44685 | Critical | 9.8 | 2021-12-07 | Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to run the… |
CVE-2021-44684 | Critical | 9.8 | 2021-12-07 | naholyr github-todos 3.1.0 is vulnerable to command injection. The range argument for the _hook subcommand is concatenated without any validation, and is direc… |
CVE-2021-43033 | Critical | 9.8 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Multiple functions in the bpserverd daemon were vulnerable to arbitrary remote code… |
CVE-2021-20863 | High | 8.0 | 2021-12-01 | OS command injection vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1… |
CVE-2021-20859 | High | 8.0 | 2021-12-01 | ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmwa… |
CVE-2021-20854 | Medium | 6.8 | 2021-12-01 | ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent attacker with an administrator p… |
CVE-2021-20853 | Medium | 6.8 | 2021-12-01 | ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent attacker with an administrator p… |
CVE-2021-43283 | High | 8.8 | 2021-11-30 | An issue was discovered on Victure WR1200 devices through 1.0.3. A command injection vulnerability was found within the web interface of the device, allowing a… |
CVE-2020-7879 | High | 8.8 | 2021-11-30 | This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME IP camera because th… |
CVE-2021-3769 | High | 7.5 | 2021-11-30 | # Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `refined` themes **Description**: these themes use `print -P` on user-supplied strings to print them… |
CVE-2021-3727 | High | 7.5 | 2021-11-30 | # Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch quotes from quotationspage.com and hitokoto.cn re… |
CVE-2021-3726 | High | 7.5 | 2021-11-30 | # Vulnerability in `title` function **Description**: the `title` function defined in `lib/termsupport.zsh` uses `print` to set the terminal title to a user-sup… |
CVE-2021-3725 | High | 7.5 | 2021-11-30 | Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, us… |
CVE-2021-41243 | Critical | 9.1 | 2021-11-26 | There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissions to upload files… |
CVE-2021-38685 | Critical | 9.8 | 2021-11-26 | A command injection vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerability allows remote attackers to run arbitrary c… |
CVE-2021-20850 | Critical | 9.8 | 2021-11-24 | PowerCMS XMLRPC API of PowerCMS 5.19 and earlier, PowerCMS 4.49 and earlier, PowerCMS 3.295 and earlier, and PowerCMS 2 Series (End-of-Life, EOL) allows a remo… |
CVE-2021-42784 | Critical | 9.8 | 2021-11-23 | OS Command Injection vulnerability in debug_fcgi of D-Link DWR-932C E1 firmware allows a remote attacker to perform command injection via a crafted HTTP reques… |
CVE-2021-36313 | Critical | 9.1 | 2021-11-23 | Dell EMC CloudLink 7.1 and all prior versions contain an OS command injection Vulnerability. A remote high privileged attacker, may potentially exploit this vu… |
CVE-2021-23732 | Critical | 9.0 | 2021-11-22 | This affects all versions of package docker-cli-js. If the command parameter of the Docker.command method can at least be partially controlled by a user, they… |
CVE-2021-41280 | Critical | 9.8 | 2021-11-19 | Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go… |
CVE-2021-3723 | High | 7.2 | 2021-11-12 | A command injection vulnerability was reported in the Integrated Management Module (IMM) of legacy IBM System x 3550 M3 and IBM System x 3650 M3 servers that c… |
CVE-2021-3577 | High | 8.8 | 2021-11-12 | An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker on the same n… |
CVE-2021-41254 | High | 8.8 | 2021-11-12 | kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for infrastructure and workloads defined with Kubernetes ma… |
CVE-2021-3934 | High | 7.5 | 2021-11-12 | ohmyzsh is vulnerable to Improper Neutralization of Special Elements used in an OS Command |
CVE-2021-3061 | Medium | 6.4 | 2021-11-10 | An OS command injection vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables an authenticated administrator with access to the C… |
CVE-2021-3060 | High | 8.1 | 2021-11-10 | An OS command injection vulnerability in the Simple Certificate Enrollment Protocol (SCEP) feature of PAN-OS software allows an unauthenticated network-based a… |
CVE-2021-3059 | High | 8.1 | 2021-11-10 | An OS command injection vulnerability in the Palo Alto Networks PAN-OS management interface exists when performing dynamic updates. This vulnerability enables… |
CVE-2021-3058 | High | 8.8 | 2021-11-10 | An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permissions to use XML API the… |
CVE-2021-39474 | High | 7.2 | 2021-11-10 | Vulnerability in the product Docsis 3.0 UBC1319BA00 Router supported affected version 1319010201r009. The vulnerability allows an attacker with privileges and… |
CVE-2021-37158 | High | 8.8 | 2021-11-10 | An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14. An authenticated attacker could inject OS commands by starting a Counter-Strike se… |
CVE-2021-42372 | High | 8.8 | 2021-11-08 | A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows authenticated remote attackers to execute arbitrary… |
CVE-2021-41228 | High | 7.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's `saved_model_cli` tool is vulnerable to a code injection as it ca… |
CVE-2021-40120 | Medium | 6.5 | 2021-11-04 | A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker with admi… |
CVE-2021-40113 | Critical | 10.0 | 2021-11-04 | Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ON… |
CVE-2020-25368 | Critical | 9.8 | 2021-11-04 | A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker is able to execute arbit… |
CVE-2020-25367 | Critical | 9.8 | 2021-11-04 | A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker is able to execute arbit… |
CVE-2021-43266 | High | 7.3 | 2021-11-02 | In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell metacharacters in a collec… |
CVE-2021-36185 | High | 8.8 | 2021-11-02 | A improper neutralization of special elements used in an OS command ('OS Command Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to ex… |
CVE-2020-36381 | Critical | 9.8 | 2021-10-31 | An issue was discovered in the singleCrunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters. |
CVE-2020-36380 | Critical | 9.8 | 2021-10-31 | An issue was discovered in the crunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters. |
CVE-2020-36379 | Critical | 9.8 | 2021-10-31 | An issue was discovered in the remove function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters. |
CVE-2020-36378 | Critical | 9.8 | 2021-10-31 | An issue was discovered in the packageCmd function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters. |
CVE-2020-36377 | Critical | 9.8 | 2021-10-31 | An issue was discovered in the dump function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters. |
CVE-2020-36376 | Critical | 9.8 | 2021-10-31 | An issue was discovered in the list function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters. |
CVE-2020-26707 | Critical | 9.8 | 2021-10-31 | An issue was discovered in the add function in Shenzhim AAPTJS 1.3.1 which allows attackers to execute arbitrary code via the filePath parameter. |
CVE-2021-34756 | Medium | 6.7 | 2021-10-27 | Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands… |
CVE-2021-34755 | Medium | 6.7 | 2021-10-27 | Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands… |
CVE-2011-2195 | Critical | 9.8 | 2021-10-26 | A flaw was found in WebSVN 2.3.2. Without prior authentication, if the 'allowDownload' option is enabled in config.php, an attacker can invoke the dl.php scrip… |
CVE-2021-20837 | Critical | 9.8 | 2021-10-26 | Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (… |
CVE-2021-38294 | Critical | 9.8 | 2021-10-25 | A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specia… |
CVE-2021-42538 | High | 8.0 | 2021-10-22 | The affected product is vulnerable to a parameter injection via passphrase, which enables the attacker to supply uncontrolled input. |
CVE-2021-34362 | High | 8.7 | 2021-10-22 | A command injection vulnerability has been reported to affect QNAP device running Media Streaming add-on. If exploited, this vulnerability allow remote attacke… |
CVE-2021-1529 | High | 7.8 | 2021-10-21 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. The… |
CVE-2021-31358 | High | 7.8 | 2021-10-19 | A command injection vulnerability in sftp command processing on Juniper Networks Junos OS Evolved allows an attacker with authenticated CLI access to be able t… |
CVE-2021-31357 | High | 7.8 | 2021-10-19 | A command injection vulnerability in tcpdump command processing on Juniper Networks Junos OS Evolved allows an attacker with authenticated CLI access to be abl… |
CVE-2021-31356 | High | 7.8 | 2021-10-19 | A command injection vulnerability in command processing on Juniper Networks Junos OS Evolved allows an attacker with authenticated CLI access to be able to byp… |
CVE-2021-30358 | High | 7.2 | 2021-10-19 | Mobile Access Portal Native Applications who's path is defined by the administrator with environment variables may run applications from other locations by the… |
CVE-2021-38478 | Critical | 9.1 | 2021-10-19 | InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a traceroute tool to inject commands into the device. T… |
CVE-2021-38470 | Critical | 9.1 | 2021-10-19 | InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a ping tool to inject commands into the device. This ma… |
CVE-2021-24684 | High | 8.8 | 2021-10-18 | The WordPress PDF Light Viewer Plugin WordPress plugin before 1.4.12 allows users with Author roles to execute arbitrary OS command on the server via OS Comman… |
CVE-2021-27561 | Critical | 9.8 | 2021-10-15 | Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication. |
CVE-2020-22724 | Critical | 9.8 | 2021-10-14 | A remote command execution vulnerability exists in add_server_service of PPTP_SERVER in Mercury Router MER1200 v1.0.1 and Mercury Router MER1200G v1.0.1. |
CVE-2021-37732 | High | 7.2 | 2021-10-12 | A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.17 and below; Aru… |
CVE-2021-37730 | High | 7.2 | 2021-10-12 | A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aru… |
CVE-2021-37727 | High | 7.2 | 2021-10-12 | A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5… |
CVE-2021-20122 | High | 7.2 | 2021-10-11 | The Telus Wi-Fi Hub (PRV65B444A-S-TS) with firmware version 3.00.20 is affected by an authenticated command injection vulnerability in multiple parameters pass… |
CVE-2021-42071 | Critical | 9.8 | 2021-10-07 | In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py Use… |
CVE-2021-34748 | High | 8.8 | 2021-10-06 | A vulnerability in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to perform a command… |
CVE-2021-34710 | High | 8.8 | 2021-10-06 | Multiple vulnerabilities in the Cisco ATA 190 Series Analog Telephone Adapter Software could allow an attacker to perform a command injection attack resulting… |
CVE-2021-1594 | High | 7.5 | 2021-10-06 | A vulnerability in the REST API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to perform a command injection attack a… |
CVE-2021-22557 | Medium | 5.3 | 2021-10-04 | SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We re… |
CVE-2021-34352 | High | 7.2 | 2021-10-01 | A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arb… |
CVE-2021-35028 | High | 7.3 | 2021-09-29 | A command injection vulnerability in the CGI program of the Zyxel VPN2S firmware version 1.12 could allow an authenticated, local user to execute arbitrary OS… |
CVE-2021-21570 | Medium | 6.8 | 2021-09-28 | Dell NetWorker, versions 18.x and 19.x contain an Information disclosure vulnerability. A NetWorker server user with remote access to NetWorker clients may pot… |
CVE-2021-21569 | Medium | 6.8 | 2021-09-28 | Dell NetWorker, versions 18.x and 19.x contain a Path traversal vulnerability. A NetWorker server user with remote access to NetWorker clients may potentially… |
CVE-2021-20035 | Medium | 6.5 | 2021-09-27 | Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody… |
CVE-2021-39826 | High | 8.6 | 2021-09-27 | Adobe Digital Editions 4.5.11.187646 (and earlier) are affected by an arbitrary command execution vulnerability. An authenticated attacker could leverage this… |
CVE-2021-31605 | High | 7.5 | 2021-09-27 | furlongm openvpn-monitor through 1.1.3 allows %0a command injection via the OpenVPN management interface socket. This can shut down the server via signal%20SIG… |
CVE-2021-34351 | Critical | 9.8 | 2021-09-27 | A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arb… |
CVE-2021-34349 | High | 7.2 | 2021-09-27 | A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arb… |
CVE-2021-34348 | Critical | 9.8 | 2021-09-27 | A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arb… |
CVE-2021-34729 | Medium | 6.7 | 2021-09-23 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software and Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands… |
CVE-2021-34726 | Medium | 6.7 | 2021-09-23 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root-level pr… |
CVE-2021-34725 | Medium | 6.7 | 2021-09-23 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root-l… |
CVE-2021-37925 | Critical | 9.8 | 2021-09-22 | Zoho ManageEngine ADManager Plus version 7110 and prior has a Post-Auth OS command injection vulnerability. |