CWE-78 · OS Command Injection (page 52)
Page 52 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7633 | Critical | 9.8 | 2020-04-06 | apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via the pluginUri argument. |
CVE-2020-7632 | Critical | 9.8 | 2020-04-06 | node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument. |
CVE-2020-7631 | Critical | 9.8 | 2020-04-06 | diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument. |
CVE-2020-7630 | Critical | 9.8 | 2020-04-02 | git-add-remote through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the name argument. |
CVE-2020-7629 | Critical | 9.8 | 2020-04-02 | install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument. |
CVE-2020-7628 | Critical | 9.8 | 2020-04-02 | umount through 1.1.6 is vulnerable to Command Injection. The argument device can be controlled by users without any sanitization. |
CVE-2020-7627 | Critical | 9.8 | 2020-04-02 | node-key-sender through 1.0.11 is vulnerable to Command Injection. It allows execution of arbitrary commands via the 'arrParams' argument in the 'execute()' fu… |
CVE-2020-7626 | Critical | 9.8 | 2020-04-02 | karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument. |
CVE-2020-7625 | Critical | 9.8 | 2020-04-02 | op-browser through 1.0.6 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function. |
CVE-2020-7624 | Critical | 9.8 | 2020-04-02 | effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument. |
CVE-2020-7623 | Critical | 9.8 | 2020-04-02 | jscover through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary command via the source argument. |
CVE-2020-7621 | Critical | 9.8 | 2020-04-02 | strong-nginx-controller through 1.0.2 is vulnerable to Command Injection. It allows execution of arbitrary command as part of the '_nginxCmd()' function. |
CVE-2020-7620 | Critical | 9.8 | 2020-04-02 | pomelo-monitor through 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' params. |
CVE-2020-7619 | Critical | 9.8 | 2020-04-02 | get-git-data through 1.3.1 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments provided to get-git-data. |
CVE-2020-11490 | High | 7.2 | 2020-04-02 | Manage::Certificates in Zen Load Balancer 3.10.1 allows remote authenticated admins to execute arbitrary OS commands via shell metacharacters in the index.cgi… |
CVE-2020-4242 | High | 8.8 | 2020-03-31 | IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system… |
CVE-2020-4241 | High | 8.8 | 2020-03-31 | IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system… |
CVE-2020-4206 | High | 8.8 | 2020-03-31 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary commands on the system in the context of root user, caused b… |
CVE-2019-19606 | Critical | 9.8 | 2020-03-30 | X-Plane before 11.41 has multiple improper path validations that could allow reading and writing files from/to arbitrary paths (or a leak of OS credentials to… |
CVE-2020-10886 | Critical | 9.8 | 2020-03-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authen… |
CVE-2020-10882 | High | 8.8 | 2020-03-25 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 route… |
CVE-2020-5282 | High | 7.2 | 2020-03-25 | In Nick Chan Bot before version 1.0.0-beta there is a vulnerability in the `npm` command which is part of this software package. This allows arbitrary shell ex… |
CVE-2020-10789 | Critical | 9.8 | 2020-03-25 | openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are mishandled on an s… |
CVE-2020-5561 | Critical | 9.8 | 2020-03-25 | Keijiban Tsumiki v1.15 allows remote attackers to execute arbitrary OS commands via unspecified vectors. |
CVE-2020-5560 | Critical | 9.8 | 2020-03-25 | WL-Enq 1.11 and 1.12 allows remote attackers to execute arbitrary OS commands with the administrative privilege via unspecified vectors. |
CVE-2020-5556 | Critical | 9.8 | 2020-03-25 | Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to execute arbitrary OS commands via unspecified vectors. |
CVE-2020-10879 | Critical | 9.8 | 2020-03-23 | rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the… |
CVE-2019-19034 | High | 7.2 | 2020-03-23 | Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username when dynamically generating a command t… |
CVE-2016-11022 | High | 7.2 | 2020-03-23 | NETGEAR Prosafe WC9500 5.1.0.17, WC7600 5.1.0.17, and WC7520 2.5.0.35 devices allow a remote attacker to execute code with root privileges via shell metacharac… |
CVE-2020-10818 | High | 7.2 | 2020-03-22 | Artica Proxy 4.26 allows remote command execution for an authenticated user via shell metacharacters in the "Modify the hostname" field. |
CVE-2020-10808 | High | 8.8 | 2020-03-22 | Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a… |
CVE-2019-12767 | Critical | 9.8 | 2020-03-21 | An issue was discovered on D-Link DAP-1650 devices before 1.04B02_J65H Hot Fix. Attackers can execute arbitrary commands. |
CVE-2019-19148 | Critical | 9.8 | 2020-03-20 | Tellabs Optical Line Terminal (OLT) 1150 devices allow Remote Command Execution via the -l option to TELNET or SSH. Tellabs has addressed this issue in the SR3… |
CVE-2019-19487 | High | 8.8 | 2020-03-20 | Command Injection in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to achieve command injection via a plugin test. |
CVE-2018-20334 | Critical | 9.8 | 2020-03-20 | An issue was discovered in ASUSWRT 3.0.0.4.384.20308. When processing the /start_apply.htm POST data, there is a command injection issue via shell metacharacte… |
CVE-2019-16072 | Critical | 9.8 | 2020-03-20 | An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an attacker to execute arbitrary code… |
CVE-2020-3266 | High | 7.8 | 2020-03-19 | A vulnerability in the CLI of Cisco SD-WAN Solution software could allow an authenticated, local attacker to inject arbitrary commands that are executed with r… |
CVE-2020-10674 | Critical | 9.8 | 2020-03-18 | PerlSpeak through 2.01 allows attackers to execute arbitrary OS commands, as demonstrated by use of system and 2-argument open. |
CVE-2019-12132 | Critical | 9.8 | 2020-03-18 | An issue was discovered in ONAP SDNC before Dublin. By executing sla/dgUpload with a crafted filename parameter, an unauthenticated attacker can execute an arb… |
CVE-2019-12123 | High | 8.8 | 2020-03-18 | An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsXml with a crafted module parameter, an authenticated user can execute an arbitrary… |
CVE-2019-12113 | High | 8.8 | 2020-03-18 | An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsGv with a crafted module parameter, an authenticated user can execute an arbitrary… |
CVE-2019-12112 | Critical | 9.8 | 2020-03-18 | An issue was discovered in ONAP SDNC before Dublin. By executing sla/upload with a crafted filename parameter, an unauthenticated attacker can execute an arbit… |
CVE-2019-11689 | High | 8.1 | 2020-03-18 | An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl fail to properly validate server… |
CVE-2019-19940 | High | 7.2 | 2020-03-16 | Incorrect input sanitation in text-oriented user interfaces (telnet, ssh) in Swisscom Centro Grande before 6.16.12 allows remote authenticated users to execute… |
CVE-2019-15708 | Medium | 6.7 | 2020-03-15 | A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.0 under CLI admin c… |
CVE-2020-7607 | Critical | 9.8 | 2020-03-15 | gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in 'index.js' can be controlled by users w… |
CVE-2020-7606 | Critical | 9.8 | 2020-03-15 | docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within 'index.js' of the package, the function 'exec(serviceName, cmd, fnStdout… |
CVE-2020-7605 | Critical | 9.8 | 2020-03-15 | gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options. |
CVE-2020-7604 | Critical | 9.8 | 2020-03-15 | pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attacker. This function u… |
CVE-2020-7603 | Critical | 9.8 | 2020-03-15 | closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled b… |
CVE-2020-7602 | Critical | 9.8 | 2020-03-15 | node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand()" is called by "getDevices()" function in file "linux/manager.js", whic… |
CVE-2020-7601 | Critical | 9.8 | 2020-03-15 | gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command… |
CVE-2019-11355 | High | 7.2 | 2020-03-12 | An issue was discovered in Poly (formerly Polycom) HDX 3.1.13. A feature exists that allows the creation of a server / client certificate, or the upload of the… |
CVE-2020-9436 | High | 8.8 | 2020-03-12 | PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.0… |
CVE-2020-10390 | High | 7.2 | 2020-03-12 | OS Command Injection in export.php (vulnerable function called from include/functions-article.php) in Chadha PHPKB Standard Multi-Language 9 allows remote atta… |
CVE-2019-5171 | High | 7.8 | 2020-03-12 | An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). An attack… |
CVE-2019-5170 | High | 7.8 | 2020-03-12 | An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). A special… |
CVE-2019-5169 | High | 7.8 | 2020-03-12 | An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). A special… |
CVE-2019-5175 | High | 7.8 | 2020-03-11 | An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). A special… |
CVE-2019-5174 | High | 7.8 | 2020-03-11 | An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). A specially crafte… |
CVE-2019-5173 | High | 7.8 | 2020-03-11 | An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). A special… |
CVE-2019-5172 | High | 7.8 | 2020-03-11 | An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). An attack… |
CVE-2019-5168 | High | 7.8 | 2020-03-11 | An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). An attacker can se… |
CVE-2019-5167 | High | 7.8 | 2020-03-11 | An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). At 0x1e3f0 the ext… |
CVE-2019-5157 | High | 7.2 | 2020-03-11 | An exploitable command injection vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02.02(14), 03.01.07(13), and… |
CVE-2019-5156 | High | 7.2 | 2020-03-11 | An exploitable command injection vulnerability exists in the cloud connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.01.07(13), and 03.00.39(… |
CVE-2019-5155 | High | 7.2 | 2020-03-11 | An exploitable command injection vulnerability exists in the cloud connectivity feature of WAGO PFC200. An attacker can inject operating system commands into a… |
CVE-2019-10807 | Critical | 9.8 | 2020-03-11 | Blamer versions prior to 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of the arguments provided to blamer. |
CVE-2020-1980 | High | 7.8 | 2020-03-11 | A shell command injection vulnerability in the PAN-OS CLI allows a local authenticated user to escape the restricted shell and escalate privileges. This issue… |
CVE-2019-9859 | High | 8.8 | 2020-03-10 | Vesta Control Panel (VestaCP) 0.9.7 through 0.9.8-23 is vulnerable to an authenticated command execution that can result in remote root access on the server. T… |
CVE-2020-10250 | Critical | 9.8 | 2020-03-09 | BWA DiREX-Pro 1.2181 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the PKG parameter to uninstall.php3. |
CVE-2020-2159 | High | 8.8 | 2020-03-09 | Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins master as the OS user a… |
CVE-2020-10235 | High | 8.8 | 2020-03-09 | An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database… |
CVE-2019-20504 | Critical | 9.8 | 2020-03-09 | service/krashrpt.php in Quest KACE K1000 Systems Management Appliance before 6.4 SP3 (6.4.120822) allows a remote attacker to execute code via shell metacharac… |
CVE-2016-11021 | High | 7.2 | 2020-03-09 | setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter. |
CVE-2020-10221 | High | 8.8 | 2020-03-08 | lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName… |
CVE-2020-10216 | High | 8.8 | 2020-03-07 | An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the date parameter in a system_time… |
CVE-2020-10215 | High | 8.8 | 2020-03-07 | An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the dns_query_name parameter in a d… |
CVE-2020-10213 | High | 8.8 | 2020-03-07 | An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the wps_sta_enrollee_pin parameter… |
CVE-2019-17642 | High | 8.8 | 2020-03-05 | An issue was discovered in Centreon before 18.10.8, 19.10.1, and 19.04.2. It allows CSRF with resultant remote command execution via shell metacharacters in a… |
CVE-2020-10173 | High | 8.8 | 2020-03-05 | Comtrend VR-3033 DE11-416SSG-C01_R02.A2pvI042j1.d26m devices have Multiple Authenticated Command Injection vulnerabilities via the ping and traceroute diagnost… |
CVE-2019-20501 | High | 7.8 | 2020-03-05 | D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Upgrade Firmware functionality in the Web interface… |
CVE-2019-20500 | High | 7.8 | 2020-03-05 | D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface… |
CVE-2019-20499 | High | 7.8 | 2020-03-05 | D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Configuration functionality in the Web interf… |
CVE-2020-9054 | Critical | 9.8 | 2020-03-04 | Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may all… |
CVE-2020-3176 | Medium | 6.7 | 2020-03-04 | A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affect… |
CVE-2020-5535 | High | 8.8 | 2020-03-04 | OpenBlocks IoT VX2 prior to Ver.4.0.0 (Ver.3 Series) allows an attacker on the same network segment to execute arbitrary OS commands with root privileges via u… |
CVE-2020-1734 | High | 7.4 | 2020-03-03 | A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by o… |
CVE-2019-20488 | Critical | 9.8 | 2020-03-02 | An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the web management interface (setup.cgi) are vulnerable to command injec… |
CVE-2019-10804 | Critical | 9.8 | 2020-02-28 | serial-number through 1.3.0 allows execution of arbritary commands. The "cmdPrefix" argument in serialNumber function is used by the "exec" function without an… |
CVE-2019-10803 | Critical | 9.8 | 2020-02-28 | push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable "opt.branch" is not validated before being provided t… |
CVE-2019-10802 | Critical | 9.8 | 2020-02-28 | giting version prior to 0.0.8 allows execution of arbritary commands. The first argument "repo" of function "pull()" is executed by the package without any val… |
CVE-2019-10801 | Critical | 9.8 | 2020-02-28 | enpeem through 2.2.0 allows execution of arbitrary commands. The "options.dir" argument is provided to the "exec" function without any sanitization. |
CVE-2019-15609 | Critical | 9.8 | 2020-02-28 | The kill-port-process package version < 2.2.0 is vulnerable to a Command Injection vulnerability. |
CVE-2020-9463 | High | 8.8 | 2020-02-28 | Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the server_ip field in JSON data in an api/intern… |
CVE-2020-3173 | High | 7.8 | 2020-02-26 | A vulnerability in the local management (local-mgmt) CLI of Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary comman… |
CVE-2020-3171 | High | 7.8 | 2020-02-26 | A vulnerability in the local management (local-mgmt) CLI of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker to… |
CVE-2020-3169 | Medium | 6.7 | 2020-02-26 | A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating… |
CVE-2020-3167 | High | 7.8 | 2020-02-26 | A vulnerability in the CLI of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on… |
CVE-2019-19994 | Critical | 9.8 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows blind Command Injection. An attacker without authentication is ab… |