CWE-78 · OS Command Injection (page 51)

Page 51 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.

All CVEs classified under CWE-78 — newest first (page 51 of 65)
CVESeverityScorePublishedSummary
CVE-2020-3276High7.22020-06-18Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an…
CVE-2020-3275High7.22020-06-18Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an…
CVE-2020-3274High7.22020-06-18Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an…
CVE-2020-4469Critical9.82020-06-15IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP comman…
CVE-2020-14081High8.82020-06-15TRENDnet TEW-827DRU devices through 2.06B04 contain multiple command injections in apply.cgi via the action send_log_email with the key auth_acname (or auth_pa…
CVE-2020-14075High8.82020-06-15TRENDnet TEW-827DRU devices through 2.06B04 contain multiple command injections in apply.cgi via the action pppoe_connect, ru_pppoe_connect, or dhcp_connect wi…
CVE-2020-13851High8.82020-06-11Artica Pandora FMS 7.44 allows remote command execution via the events feature.
CVE-2020-2029High7.22020-06-10An OS Command Injection vulnerability in the PAN-OS web management interface allows authenticated administrators to execute arbitrary OS commands with root pri…
CVE-2020-2028High7.22020-06-10An OS Command Injection vulnerability in PAN-OS management server allows authenticated administrators to execute arbitrary OS commands with root privileges whe…
CVE-2020-13978High7.22020-06-09Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS comman…
CVE-2020-13976High8.82020-06-09An issue was discovered in DD-WRT through 16214. The Diagnostic page allows remote attackers to execute arbitrary commands via shell metacharacters in the host…
CVE-2020-3224High8.82020-06-03A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to in…
CVE-2020-3212High7.22020-06-03A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the…
CVE-2020-3211High7.22020-06-03A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the…
CVE-2020-3210Medium6.72020-06-03A vulnerability in the CLI parsers of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series C…
CVE-2020-3207Medium6.72020-06-03A vulnerability in the processing of boot options of specific Cisco IOS XE Software switches could allow an authenticated, local attacker with root shell acces…
CVE-2020-3205High8.82020-06-03A vulnerability in the implementation of the inter-VM channel of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial IS…
CVE-2020-13782High8.82020-06-03D-Link DIR-865L Ax 1.20B01 Beta devices allow Command Injection.
CVE-2020-4180High8.82020-06-03IBM Security Guardium 11.1 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an…
CVE-2020-2200High8.82020-06-03Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the `play` command on the Jenkins master for a form validation endpoint, resulti…
CVE-2014-8945Critical9.82020-06-01admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields.
CVE-2014-7173Critical9.82020-06-01FarLinX X25 Gateway through 2014-09-25 allows command injection via shell metacharacters to sysSaveMonitorData.php, fsx25MonProxy.php, syseditdate.php, iframeu…
CVE-2020-13694High8.82020-06-01In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user can execute sudo mysql without a password, which means that…
CVE-2020-13448High8.82020-06-01QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8 allows an authenticated remote attacker to execute code on the server via command inject…
CVE-2020-8816High7.22020-05-29Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
CVE-2019-20807Medium5.32020-05-28In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).
CVE-2020-11950High8.82020-05-28VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to upload and execute a script (with r…
CVE-2020-8605High8.82020-05-27A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbitrary code on affected installations. Aut…
CVE-2020-12393High7.82020-05-26The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user use…
CVE-2020-8171Critical9.82020-05-26We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prio…
CVE-2020-13388Critical9.82020-05-22An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with…
CVE-2020-1956High8.82020-05-22Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to…
CVE-2020-13252High8.82020-05-21Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabase_status_path (via a main.get.ph…
CVE-2020-13167Critical9.82020-05-19Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command li…
CVE-2020-11766High8.82020-05-19sendfax.php in iFAX AvantFAX before 3.3.6 and HylaFAX Enterprise Web Interface before 0.2.5 allows authenticated Command Injection.
CVE-2020-2014High8.82020-05-13An OS Command Injection vulnerability in PAN-OS management server allows authenticated users to inject and execute arbitrary shell commands with root privilege…
CVE-2020-2010High7.22020-05-13An OS command injection vulnerability in PAN-OS management interface allows an authenticated administrator to execute arbitrary OS commands with root privilege…
CVE-2020-2008High7.22020-05-13An OS command injection and external control of filename vulnerability in Palo Alto Networks PAN-OS allows authenticated administrators to execute code with ro…
CVE-2020-2007High7.22020-05-13An OS command injection vulnerability in the management server component of PAN-OS allows an authenticated user to potentially execute arbitrary commands with…
CVE-2020-10795High7.22020-05-07Gira TKS-IP-Gateway 4.0.7.7 is vulnerable to authenticated remote code execution via the backup functionality of the web frontend. This can be combined with CV…
CVE-2020-4428Critical9.12020-05-07IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 1…
CVE-2020-7805Critical9.82020-05-07An issue was discovered on KT Slim egg IML500 (R7283, R8112, R8424) and IML520 (R8112, R8368, R8411) wifi device. This issue is a command injection allowing at…
CVE-2020-7646Critical9.82020-05-07curlrequest through 1.0.1 allows reading any file by populating the file parameter with user input.
CVE-2020-6651High8.82020-05-07Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functionality allows attacker…
CVE-2020-5332High7.22020-05-04RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain a command injection vulnerability. AN authenticated malicious user with administrator privileges could…
CVE-2020-12109High8.82020-05-04Certain TP-Link devices allow Command Injection. This affects NC200 2.1.9 build 200225, NC210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 2…
CVE-2020-12641Critical9.82020-05-04rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert…
CVE-2020-12111High8.82020-05-04Certain TP-Link devices allow Command Injection. This affects NC260 1.5.2 build 200304 and NC450 1.5.3 build 200304.
CVE-2020-7645Critical9.82020-05-02All versions of chrome-launcher allow execution of arbitrary commands, by controlling the $HOME environment variable in Linux operating systems.
CVE-2020-7351High7.32020-05-01An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on t…
CVE-2020-11016Critical9.12020-04-30IntelMQ Manager from version 1.1.0 and before version 2.1.1 has a vulnerability where the backend incorrectly handled messages given by user-input in the "send…
CVE-2019-19220High8.82020-04-30BMC Control-M/Agent 7.0.00.000 allows OS Command Injection (issue 2 of 2).
CVE-2019-19217High8.82020-04-30BMC Control-M/Agent 7.0.00.000 allows OS Command Injection.
CVE-2019-5623Critical9.82020-04-29Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-77: Improper Neutralization of Special Elements used in a Command ('Comma…
CVE-2016-11061Critical9.82020-04-29Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, and 7970i devices before 073.xxx.086.15410 do not properly…
CVE-2020-7804Medium6.42020-04-29ActiveX Control(HShell.dll) in Handy Groupware 1.7.3.1 for Windows 7, 8, and 10 allows an attacker to execute arbitrary command via the ShellExec method.
CVE-2020-12246High8.82020-04-29Beeline Smart Box 2.0.38 routers allow "Advanced settings > Other > Diagnostics" OS command injection via the Ping ping_ipaddr parameter, the Nslookup nslookup…
CVE-2018-21225Medium6.82020-04-28Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7000 before 1.0.1.60, D7800 before 1.0.1.34, D8500 before 1.0…
CVE-2017-18858Critical9.82020-04-28Certain NETGEAR devices are affected by command execution. This affects M4200-10MG-POE+ 12.0.2.11 and earlier, M4300-28G 12.0.2.11 and earlier, M4300-52G 12.0…
CVE-2016-11054High7.22020-04-28NETGEAR DGN2200v4 devices before 2017-01-06 are affected by command execution and an FTP insecure root directory.
CVE-2020-12078High8.82020-04-28An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit…
CVE-2020-7640Critical9.82020-04-27pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitizati…
CVE-2018-21157Medium6.82020-04-27Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.28, R6700 before 1.0.1.44, R6900 before 1.0…
CVE-2018-21154Medium6.82020-04-27Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.34, DM200 before 1.0.0.50, R6100 before 1.0…
CVE-2018-21152Medium6.82020-04-27Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.34, R7500v2 before 1.0.3.26, R7800 before 1…
CVE-2018-21100High8.02020-04-27NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVE-2018-21099High8.02020-04-27NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVE-2018-21098Medium6.82020-04-27NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVE-2020-11941High8.82020-04-27An issue was discovered in Open-AudIT 3.2.2. There is OS Command injection in Discovery.
CVE-2020-12242High7.82020-04-27Valve Source allows local users to gain privileges by writing to the /tmp/hl2_relaunch file, which is later executed in the context of a different user account.
CVE-2020-5868Critical9.82020-04-24In BIG-IQ 6.0.0-7.0.0, a remote access vulnerability has been discovered that may allow a remote user to execute shell commands on affected systems using HTTP…
CVE-2018-21164High7.22020-04-23Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6220 before 1.1.0.64 and WNDR3700v5 before 1.1.0.54.
CVE-2018-21162Critical9.82020-04-23Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D6400 before 1.0.0.78, EX6200 before 1.0.3.86, EX7000 be…
CVE-2018-21110Medium6.82020-04-23NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVE-2018-21109Medium6.82020-04-23NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVE-2018-21108Medium6.82020-04-23NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVE-2018-21107Medium6.82020-04-23NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVE-2018-21106Medium6.82020-04-23NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVE-2018-21105Medium6.82020-04-23NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVE-2018-21104Medium6.82020-04-23NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVE-2018-21103Medium6.82020-04-23NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVE-2018-21101High8.02020-04-23NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVE-2020-8797Medium6.72020-04-23Juplink RX4-1500 v1.0.3 allows remote attackers to gain root access to the Linux subsystem via an unsanitized exec call (aka Command Line Injection), if the un…
CVE-2020-7350Medium6.12020-04-22Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted use…
CVE-2018-21130High8.82020-04-22Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects WAC505 before 5.0.0.17 and WAC510 before 5.0.0.17.
CVE-2018-21127High8.82020-04-22Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects WAC505 before 5.0.0.17 and WAC510 before 5.0.0.17.
CVE-2018-21126High8.82020-04-22Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects WAC505 before 5.0.0.17 and WAC510 before 5.0.0.17.
CVE-2020-11963Critical9.82020-04-21IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacharacter Injection. N…
CVE-2020-5350High7.92020-04-15Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component. A remote authent…
CVE-2020-10511Critical9.82020-04-15HGiga C&Cmail CCMAILQ before olln-base-6.0-418.i386.rpm and CCMAILN before olln-base-5.0-418.i386.rpm contains insecure configurations. Attackers can exploit t…
CVE-2020-9478High8.82020-04-13An issue was discovered in Rubrik 5.0.3-2296. An OS command injection vulnerability allows an authenticated attacker to remotely execute arbitrary code on Rubr…
CVE-2020-6765High7.22020-04-10D-Link DSL-GS225 J1 AU_1.0.4 devices allow an admin to execute OS commands by placing shell metacharacters after a supported CLI command, as demonstrated by pi…
CVE-2020-10603High8.82020-04-09WebAccess/NMS (versions prior to 3.0.2) does not properly sanitize user input and may allow an attacker to inject system commands remotely.
CVE-2020-7615High7.82020-04-07fsa through 0.5.1 is vulnerable to Command Injection. The first argument of 'execGitCommand()', located within 'lib/rep.js#63' can be controlled by users witho…
CVE-2020-7614Critical9.82020-04-07npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated together without any validation and are…
CVE-2020-7613High8.12020-04-07clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the `_is_clamav_binary` function located with…
CVE-2020-11581High8.12020-04-06An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients wh…
CVE-2020-7636Critical9.82020-04-06adb-driver through 0.1.8 is vulnerable to Command Injection.It allows execution of arbitrary commands via the command function.
CVE-2020-7635Critical9.82020-04-06compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument.
CVE-2020-7634Critical9.82020-04-06heroku-addonpool through 0.1.15 is vulnerable to Command Injection.