CWE-78 · OS Command Injection (page 52)
Page 52 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-23375 | High | 7.3 | 2021-04-18 | This affects all versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitra… |
CVE-2021-23374 | High | 7.3 | 2021-04-18 | This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arb… |
CVE-2020-2509 | Critical | 9.8 | 2021-04-17 | A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary command… |
CVE-2021-27692 | Critical | 9.8 | 2021-04-16 | Command Injection in Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary O… |
CVE-2021-27691 | Critical | 9.8 | 2021-04-16 | Command Injection in Tenda G0 routers with firmware versions v15.11.0.6(9039)_CN and v15.11.0.5(5876)_CN , and Tenda G1 and G3 routers with firmware versions v… |
CVE-2021-29449 | Medium | 6.3 | 2021-04-14 | Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were discovered in vers… |
CVE-2021-27710 | Critical | 9.8 | 2021-04-14 | Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote… |
CVE-2021-27708 | Critical | 9.8 | 2021-04-14 | Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote… |
CVE-2021-27252 | High | 8.8 | 2021-04-14 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Authentica… |
CVE-2021-27249 | High | 8.8 | 2021-04-14 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access points. Aut… |
CVE-2021-27113 | Critical | 9.8 | 2021-04-14 | An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of… |
CVE-2020-27227 | Critical | 9.8 | 2021-04-13 | An exploitable unatuhenticated command injection exists in the OpenClinic GA 5.173.3. Specially crafted web requests can cause commands to be executed on the s… |
CVE-2021-29003 | Critical | 9.8 | 2021-04-13 | Genexis PLATINUM 4410 2.1 P4410-V2-1.28 devices allow remote attackers to execute arbitrary code via shell metacharacters to sys_config_valid.xgi, as demonstra… |
CVE-2021-29379 | High | 8.8 | 2021-04-12 | An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can perfor… |
CVE-2021-21433 | Critical | 9.9 | 2021-04-09 | Discord Recon Server is a bot that allows you to do your reconnaissance process from your Discord. Remote code execution in version 0.0.1 would allow remote us… |
CVE-2020-21883 | High | 8.8 | 2021-04-09 | Unibox U-50 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a OS command injection vulnerability in /tools/ping, which can leads to c… |
CVE-2021-1473 | Medium | 5.3 | 2021-04-08 | Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary comma… |
CVE-2021-28927 | High | 7.8 | 2021-04-07 | The text-to-speech engine in libretro RetroArch for Windows 1.9.0 passes unsanitized input to PowerShell through platform_win32.c via the accessibility_speak_w… |
CVE-2021-28204 | High | 7.2 | 2021-04-06 | The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not filter the specific parameter. As obtaining the… |
CVE-2021-28203 | High | 7.2 | 2021-04-06 | The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter. As obtaining the administrator permission… |
CVE-2020-27600 | Critical | 9.8 | 2021-04-02 | HNAP1/control/SetMasterWLanSettings.php in D-Link D-Link Router DIR-846 DIR-846 A1_100.26 allows remote attackers to execute arbitrary commands via shell metac… |
CVE-2021-28113 | Medium | 6.7 | 2021-04-02 | A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to… |
CVE-2021-29083 | High | 7.2 | 2021-04-01 | Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows… |
CVE-2021-23348 | Medium | 6.3 | 2021-03-31 | This affects the package portprocesses before 1.0.5. If (attacker-controlled) user input is given to the killProcess function, it is possible for an attacker t… |
CVE-2021-21412 | Medium | 6.4 | 2021-03-30 | Potential for arbitrary code execution in npm package @thi.ng/egf `#gpg`-tagged property values (only if `decrypt: true` option is enabled). PR with patch has… |
CVE-2021-23363 | Medium | 6.3 | 2021-03-30 | This affects the package kill-by-port before 0.0.2. If (attacker-controlled) user input is given to the killByPort function, it is possible for an attacker to… |
CVE-2021-26810 | Critical | 9.8 | 2021-03-30 | D-link DIR-816 A2 v1.10 is affected by a remote code injection vulnerability. An HTTP request parameter can be used in command string construction in the handl… |
CVE-2021-25162 | High | 8.1 | 2021-03-30 | A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4… |
CVE-2021-25150 | High | 8.8 | 2021-03-30 | A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5… |
CVE-2021-25146 | High | 7.2 | 2021-03-30 | A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5… |
CVE-2021-27273 | High | 8.8 | 2021-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although… |
CVE-2020-24636 | Critical | 9.8 | 2021-03-29 | A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5… |
CVE-2020-24635 | High | 7.2 | 2021-03-29 | A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5… |
CVE-2021-21372 | High | 8.3 | 2021-03-26 | Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places… |
CVE-2020-28695 | High | 8.8 | 2021-03-26 | Askey Fiber Router RTF3505VW-N1 BR_SV_g000_R3505VWN1001_s32_7 devices allow Remote Code Execution and retrieval of admin credentials to log into the Dashboard… |
CVE-2021-20682 | High | 7.2 | 2021-03-26 | baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via unspecified vectors. |
CVE-2020-10583 | High | 8.8 | 2021-03-25 | The /admin/admapi.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote authenticated attackers to execute arbitrary OS commands on… |
CVE-2020-1946 | Critical | 9.8 | 2021-03-25 | In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this… |
CVE-2021-21386 | Critical | 9.3 | 2021-03-24 | APKLeaks is an open-source project for scanning APK file for URIs, endpoints & secrets. APKLeaks prior to v2.0.3 allows remote attackers to execute arbitrary O… |
CVE-2021-1452 | Medium | 6.8 | 2021-03-24 | A vulnerability in the ROM Monitor (ROMMON) of Cisco IOS XE Software for Cisco Catalyst IE3200, IE3300, and IE3400 Rugged Series Switches, Cisco Catalyst IE340… |
CVE-2021-1443 | Medium | 5.5 | 2021-03-24 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the unde… |
CVE-2021-1441 | Medium | 6.7 | 2021-03-24 | A vulnerability in the hardware initialization routines of Cisco IOS XE Software for Cisco 1100 Series Industrial Integrated Services Routers and Cisco ESR6300… |
CVE-2021-1384 | Medium | 6.5 | 2021-03-24 | A vulnerability in Cisco IOx application hosting environment of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands into the… |
CVE-2021-1382 | Medium | 6.0 | 2021-03-24 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root p… |
CVE-2021-21345 | Medium | 5.8 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-23360 | High | 7.5 | 2021-03-21 | This affects the package killport before 1.0.2. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. Thi… |
CVE-2021-28961 | High | 8.8 | 2021-03-21 | applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07 allows remote authenticated users to inject arbitrary command… |
CVE-2021-23359 | High | 7.5 | 2021-03-18 | This affects all versions of package port-killer. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. T… |
CVE-2021-23356 | Medium | 5.6 | 2021-03-15 | This affects all versions of package kill-process-by-name. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary co… |
CVE-2021-23355 | Medium | 5.6 | 2021-03-15 | This affects all versions of package ps-kill. If (attacker-controlled) user input is given to the kill function, it is possible for an attacker to execute arbi… |
CVE-2021-20017 | High | 8.8 | 2021-03-13 | A post-authenticated command injection vulnerability in SonicWall SMA100 allows an authenticated attacker to execute OS commands as a 'nobody' user. This vulne… |
CVE-2021-28143 | High | 8.0 | 2021-03-11 | /jsonrpc on D-Link DIR-841 3.03 and 3.04 devices allows authenticated command injection via ping, ping6, or traceroute (under System Tools). |
CVE-2021-28144 | High | 8.8 | 2021-03-11 | prog.cgi on D-Link DIR-3060 devices before 1.11b04 HF2 allows remote authenticated users to inject arbitrary commands in an admin or root context because SetVi… |
CVE-2021-28132 | Critical | 9.8 | 2021-03-11 | LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool (in the Support section) allows upload o… |
CVE-2021-24033 | Medium | 5.6 | 2021-03-09 | react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This func… |
CVE-2021-21503 | High | 7.8 | 2021-03-08 | PowerScale OneFS 8.1.2,8.2.2 and 9.1.0 contains an improper input sanitization issue in a command. The Compadmin user could potentially exploit this vulnerabil… |
CVE-2020-27575 | High | 8.8 | 2021-03-08 | Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability. The web administration contains functionality in which administrators are able… |
CVE-2021-27256 | High | 8.8 | 2021-03-05 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Although a… |
CVE-2021-26970 | Medium | 6.3 | 2021-03-05 | A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabili… |
CVE-2021-26962 | High | 7.2 | 2021-03-05 | A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabili… |
CVE-2021-27886 | Critical | 9.8 | 2021-03-02 | rakibtg Docker Dashboard before 2021-02-28 allows command injection in backend/utilities/terminal.js via shell metacharacters in the command parameter of an AP… |
CVE-2021-3342 | Critical | 9.8 | 2021-03-01 | EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted LaTeX input to a cgi/latex2png?latex= URI. |
CVE-2021-26704 | High | 8.8 | 2021-03-01 | EPrints 3.4.2 allows remote attackers to execute arbitrary commands via crafted input to the verb parameter in a cgi/toolbox/toolbox URI. |
CVE-2021-26476 | Critical | 9.8 | 2021-03-01 | EPrints 3.4.2 allows remote attackers to execute OS commands via crafted LaTeX input to a cgi/cal?year= URI. |
CVE-2019-25022 | Critical | 9.8 | 2021-02-27 | An issue was discovered in Scytl sVote 2.1. An attacker can inject code that gets executed by creating an election-event and injecting a payload over an event… |
CVE-2021-21302 | Medium | 6.8 | 2021-02-26 | PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using sho… |
CVE-2021-20658 | Critical | 9.8 | 2021-02-24 | SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to execute arbitrary OS commands with the web server privilege via unspecified vectors. |
CVE-2021-26680 | High | 7.2 | 2021-02-23 | A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vu… |
CVE-2021-26679 | High | 7.2 | 2021-02-23 | A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vu… |
CVE-2021-26684 | High | 7.2 | 2021-02-23 | A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vu… |
CVE-2021-26683 | High | 7.2 | 2021-02-23 | A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vu… |
CVE-2021-26681 | High | 7.2 | 2021-02-23 | A remote authenticated command Injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vu… |
CVE-2020-28429 | High | 7.3 | 2021-02-23 | All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",functio… |
CVE-2021-26724 | High | 7.2 | 2021-02-22 | OS Command Injection vulnerability when changing date settings or hostname using web GUI of Nozomi Networks Guardian and CMC allows authenticated administrator… |
CVE-2021-3149 | High | 7.2 | 2021-02-22 | On Netshield NANO 25 10.2.18 devices, /usr/local/webmin/System/manual_ping.cgi allows OS command injection (after authentication by the attacker) because the s… |
CVE-2020-36246 | High | 7.8 | 2021-02-19 | Amaze File Manager before 3.5.1 allows attackers to obtain root privileges via shell metacharacters in a symbolic link. |
CVE-2019-25024 | Critical | 9.8 | 2021-02-19 | OpenRepeater (ORP) before 2.2 allows unauthenticated command injection via shell metacharacters in the functions/ajax_system.php post_service parameter. |
CVE-2021-26747 | Critical | 9.8 | 2021-02-18 | Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command, leading to remote code execution. |
CVE-2020-28490 | Critical | 9.1 | 2021-02-18 | The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks). For example: git.reset('atouch HACKEDb') |
CVE-2020-29664 | High | 7.8 | 2021-02-18 | A command injection issue in dji_sys in DJI Mavic 2 Remote Controller before firmware version 01.00.0510 allows for code execution via a malicious firmware upg… |
CVE-2021-20655 | High | 7.2 | 2021-02-17 | FileZen (V3.0.0 to V4.2.7 and V5.0.0 to V5.0.2) allows a remote attacker with administrator rights to execute arbitrary OS commands via unspecified vectors. |
CVE-2021-27104 | Critical | 9.8 | 2021-02-16 | Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380… |
CVE-2021-27102 | High | 7.8 | 2021-02-16 | Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later. |
CVE-2021-20074 | High | 8.8 | 2021-02-16 | Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows users to escape the provided command line interface and execute arbitrary OS commands. |
CVE-2021-21315 | High | 7.1 | 2021-02-16 | The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system an… |
CVE-2021-27201 | High | 8.8 | 2021-02-15 | Endian Firewall Community (aka EFW) 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment. |
CVE-2020-24899 | High | 8.8 | 2021-02-15 | Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability. An authenticated user can inject additional commands into normal webapp query. |
CVE-2021-25298 | High | 8.8 | 2021-02-15 | Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/c… |
CVE-2021-25297 | High | 8.8 | 2021-02-15 | Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/swi… |
CVE-2021-26752 | High | 8.8 | 2021-02-12 | NeDi 1.9C allows an authenticated user to execute operating system commands in the Nodes Traffic function on the endpoint /Nodes-Traffic.php via the md or ag H… |
CVE-2021-20648 | Medium | 6.8 | 2021-02-12 | ELECOM WRC-300FEBK-S allows an attacker with administrator rights to execute arbitrary OS commands via unspecified vectors. |
CVE-2021-20639 | Medium | 6.8 | 2021-02-12 | LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors. |
CVE-2021-20638 | Medium | 6.8 | 2021-02-12 | LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors. |
CVE-2020-27861 | High | 8.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Orbi 2.5.1.16 routers. Authentication is no… |
CVE-2021-21976 | High | 7.2 | 2021-02-11 | vSphere Replication 8.3.x prior to 8.3.1.2, 8.2.x prior to 8.2.1.1, 8.1.x prior to 8.1.2.3 and 6.5.x prior to 6.5.1.5 contain a post-authentication command inj… |
CVE-2021-21018 | Critical | 9.1 | 2021-02-11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module… |
CVE-2021-21016 | Critical | 9.1 | 2021-02-11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the WebAPI. Successful exploita… |
CVE-2021-21015 | High | 8.0 | 2021-02-11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an OS command injection via the customer attribute save… |
CVE-2020-26193 | High | 7.8 | 2021-02-09 | Dell EMC PowerScale OneFS versions 8.1.0 - 9.1.0 contain an improper input validation vulnerability. A user with the ISI_PRIV_CLUSTER privilege may exploit thi… |
CVE-2021-22502 | Critical | 9.8 | 2021-02-08 | Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to al… |