CWE-78 · OS Command Injection (page 53)
Page 53 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-3999 | High | 7.8 | 2020-02-25 | Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, unauthenticated attacker to execute arbi… |
CVE-2019-5142 | High | 7.2 | 2020-02-25 | An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted entry to n… |
CVE-2019-5141 | High | 8.8 | 2020-02-25 | An exploitable command injection vulnerability exists in the iw_webs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted iw_serverip… |
CVE-2019-5140 | High | 8.8 | 2020-02-25 | An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted diagnostic s… |
CVE-2019-5138 | Critical | 9.9 | 2020-02-25 | An exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131A firmware version 1.13. A specially cra… |
CVE-2020-9374 | Critical | 9.8 | 2020-02-24 | On TP-Link TL-WR849N 0.9.1 4.16 devices, a remote command execution vulnerability in the diagnostics area can be exploited when an attacker sends specific shel… |
CVE-2019-12511 | Critical | 9.8 | 2020-02-24 | In NETGEAR Nighthawk X10-R9000 prior to 1.0.4.26, an attacker may execute arbitrary system commands as root by sending a specially-crafted MAC address to the "… |
CVE-2019-10799 | High | 8.2 | 2020-02-24 | compile-sass prior to 1.0.5 allows execution of arbritary commands. The function "setupCleanupOnExit(cssPath)" within "dist/index.js" is executed as part of th… |
CVE-2019-10796 | Critical | 9.8 | 2020-02-24 | rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of e… |
CVE-2020-4222 | Critical | 9.8 | 2020-02-24 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, a… |
CVE-2020-4213 | Critical | 9.8 | 2020-02-24 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, a… |
CVE-2020-4211 | Critical | 9.8 | 2020-02-24 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, a… |
CVE-2020-4210 | Critical | 9.8 | 2020-02-24 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, a… |
CVE-2020-8130 | Medium | 6.4 | 2020-02-24 | There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`. |
CVE-2019-18183 | Critical | 9.8 | 2020-02-24 | pacman before 5.2 is vulnerable to arbitrary command injection in lib/libalpm/sync.c in the apply_deltas() function. This can be exploited when unsigned databa… |
CVE-2019-18182 | Critical | 9.8 | 2020-02-24 | pacman before 5.2 is vulnerable to arbitrary command injection in conf.c in the download_with_xfercommand() function. This can be exploited when unsigned datab… |
CVE-2020-8813 | High | 8.8 | 2020-02-22 | graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph… |
CVE-2020-6842 | High | 7.2 | 2020-02-21 | D-Link DCH-M225 1.05b01 and earlier devices allow remote authenticated admins to execute arbitrary OS commands via shell metacharacters in the media renderer n… |
CVE-2020-6841 | Critical | 9.8 | 2020-02-21 | D-Link DCH-M225 1.05b01 and earlier devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the spotifyConnect.php userName… |
CVE-2020-5534 | High | 8.0 | 2020-02-21 | Aterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges… |
CVE-2020-5525 | High | 8.0 | 2020-02-21 | Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows a… |
CVE-2020-5524 | High | 8.8 | 2020-02-21 | Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows a… |
CVE-2014-2727 | Critical | 9.8 | 2020-02-19 | The STARTTLS implementation in MailMarshal before 7.2 allows plaintext command injection. |
CVE-2019-10791 | Critical | 9.8 | 2020-02-18 | promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be controlled by user… |
CVE-2014-4981 | Critical | 9.8 | 2020-02-17 | LPAR2RRD in 3.5 and earlier allows remote attackers to execute arbitrary commands due to insufficient input sanitization of the web GUI parameters. |
CVE-2020-7597 | High | 8.8 | 2020-02-17 | codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by… |
CVE-2020-9027 | Critical | 9.8 | 2020-02-17 | ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the TRACE field of the resource ping.cmd. The NTP-2 device is also affected. |
CVE-2020-9026 | Critical | 9.8 | 2020-02-17 | ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the PING field of the resource ping.cmd. The NTP-2 device is also affected. |
CVE-2020-9021 | Critical | 9.8 | 2020-02-17 | Post Oak AWAM Bluetooth Field Device 7400v2.08.21.2018, 7800SD.2015.1.16, 2011.3, 7400v2.02.01.2019, and 7800SD.2012.12.5 is vulnerable to injections of operat… |
CVE-2020-9020 | Critical | 9.8 | 2020-02-17 | Iteris Vantage Velocity Field Unit 2.3.1, 2.4.2, and 3.0 devices allow the injection of OS commands into cgi-bin/timeconfig.py via shell metacharacters in the… |
CVE-2020-8858 | High | 8.8 | 2020-02-14 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication i… |
CVE-2020-8963 | Critical | 9.8 | 2020-02-13 | TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003, and T550… |
CVE-2020-8949 | High | 8.8 | 2020-02-12 | Gocloud S2A_WL 4.2.7.16471, S2A 4.2.7.17278, S2A 4.3.0.15815, S2A 4.3.0.17193, S3A K2P MTK 4.2.7.16528, S3A 4.3.0.16572, and ISP3000 4.3.0.17190 devices allows… |
CVE-2020-8947 | High | 7.2 | 2020-02-12 | functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/ne… |
CVE-2020-8946 | High | 8.8 | 2020-02-12 | Netis WF2471 v1.2.30142 devices allow an authenticated attacker to execute arbitrary OS commands via shell metacharacters in the /cgi-bin-igd/sys_log_clean.cgi… |
CVE-2020-8429 | High | 8.8 | 2020-02-11 | The Admin web application in Kinetica 7.0.9.2.20191118151947 does not properly sanitise the input for the function getLogs. This lack of sanitisation could be… |
CVE-2013-0517 | High | 7.8 | 2020-02-11 | A Command Execution Vulnerability exists in IBM Sterling External Authentication Server 2.2.0, 2.3.01, 2.4.0, and 2.4.1 via an unspecified OS command, which co… |
CVE-2019-14514 | Critical | 9.8 | 2020-02-11 | An issue was discovered in Microvirt MEmu all versions prior to 7.0.2. A guest Android operating system inside the MEmu emulator contains a /system/bin/systemd… |
CVE-2013-4267 | Critical | 9.8 | 2020-02-11 | Ajaxeplorer before 5.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) archive_name parameter to the Power FS modul… |
CVE-2019-19356 | High | 7.5 | 2020-02-07 | Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been found in fir… |
CVE-2020-8126 | High | 7.8 | 2020-02-07 | A privilege escalation in the EdgeSwitch prior to version 1.7.1, an CGI script don't fully sanitize the user input resulting in local commands execution, allow… |
CVE-2020-8654 | High | 8.8 | 2020-02-07 | An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS com… |
CVE-2020-6760 | Critical | 9.8 | 2020-02-06 | Schmid ZI 620 V400 VPN 090 routers allow an attacker to execute OS commands as root via shell metacharacters to an entry on the SSH subcommand menu, as demonst… |
CVE-2019-10789 | Critical | 9.8 | 2020-02-06 | All versions of curling.js are vulnerable to Command Injection via the run function. The command argument can be controlled by users without any sanitization. |
CVE-2019-10788 | Critical | 9.8 | 2020-02-04 | im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument. It is possible to inject arbitrary commands as part of… |
CVE-2019-10787 | Critical | 9.8 | 2020-02-04 | im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js, can be controlled… |
CVE-2019-10786 | Critical | 9.8 | 2020-02-04 | network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync()" argument. |
CVE-2015-3611 | High | 8.8 | 2020-02-04 | A Command Injection vulnerability exists in FortiManager 5.2.1 and earlier and FortiManager 5.0.10 and earlier via unspecified vectors, which could let a malic… |
CVE-2020-8515 | Critical | 9.8 | 2020-02-01 | DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without… |
CVE-2013-3322 | High | 7.2 | 2020-01-31 | NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to inject arbitrary commands in the Halt/Reboot interface. |
CVE-2020-1931 | High | 8.1 | 2020-01-30 | A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run syste… |
CVE-2020-1930 | High | 8.1 | 2020-01-30 | A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configured to run… |
CVE-2019-20050 | Medium | 6.8 | 2020-01-30 | Pandora FMS ≤ 7.42 suffers from a remote code execution vulnerability. To exploit the vulnerability, an authenticated user should create a new folder with a "t… |
CVE-2020-8438 | High | 7.2 | 2020-01-29 | Ruckus ZoneFlex R500 104.0.0.0.1347 devices allow an authenticated attacker to execute arbitrary OS commands via the hidden /forms/nslookupHandler form, as dem… |
CVE-2019-10783 | Critical | 9.8 | 2020-01-29 | All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse… |
CVE-2013-2573 | Critical | 9.8 | 2020-01-29 | A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless_mft.cgi file in TP-Link IP Cameras TL-SC 3130, TL-SC 3130G, 3171G. an… |
CVE-2013-2570 | Critical | 9.8 | 2020-01-29 | A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to the sub_C8C8 function of the binary /opt… |
CVE-2013-2568 | Critical | 9.8 | 2020-01-29 | A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireless_mft.cgi, which could let a remote mali… |
CVE-2020-7247 | Critical | 9.8 | 2020-01-29 | smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via… |
CVE-2019-20217 | Critical | 9.8 | 2020-01-29 | D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htd… |
CVE-2019-20216 | Critical | 9.8 | 2020-01-29 | D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htd… |
CVE-2019-20215 | Critical | 9.8 | 2020-01-29 | D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in /htdoc… |
CVE-2013-1599 | Critical | 9.8 | 2020-01-28 | A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100… |
CVE-2012-6610 | High | 8.8 | 2020-01-28 | Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote authenticated users to execute arbitrary commands as demonstrated by a ; (sem… |
CVE-2013-2060 | Critical | 9.8 | 2020-01-28 | The download_from_url function in OpenShift Origin allows remote attackers to execute arbitrary commands via shell metacharacters in the URL of a request to do… |
CVE-2013-2612 | Critical | 9.8 | 2020-01-27 | Command-injection vulnerability in Huawei E587 3G Mobile Hotspot 11.203.27 allows remote attackers to execute arbitrary shell commands with root privileges due… |
CVE-2014-8563 | Critical | 9.8 | 2020-01-27 | Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS. |
CVE-2019-19824 | High | 8.8 | 2020-01-27 | On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd UR… |
CVE-2019-17095 | High | 8.1 | 2020-01-27 | A command injection vulnerability has been discovered in the bootstrap stage of Bitdefender BOX 2, versions 2.1.47.42 and 2.1.53.45. The API method `/api/downl… |
CVE-2019-17096 | Critical | 9.0 | 2020-01-27 | A OS Command Injection vulnerability in the bootstrap stage of Bitdefender BOX 2 allows the manipulation of the `get_image_url()` function in special circumsta… |
CVE-2019-12629 | High | 7.2 | 2020-01-26 | A vulnerability in the WebUI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject and execute arbitrary commands with vmanage u… |
CVE-2020-7980 | Critical | 9.8 | 2020-01-25 | Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a val… |
CVE-2020-7596 | High | 8.8 | 2020-01-25 | Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument. |
CVE-2013-1598 | High | 8.8 | 2020-01-24 | A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to the farseer.out binary file, which cold l… |
CVE-2019-19897 | Critical | 9.8 | 2020-01-23 | In IXP EasyInstall 6.2.13723, there is Remote Code Execution via the Agent Service. An unauthenticated attacker can communicate with the Agent Service over TCP… |
CVE-2019-19839 | Critical | 9.8 | 2020-01-23 | emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=import-cate… |
CVE-2019-19838 | Critical | 9.8 | 2020-01-23 | emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=get-platfor… |
CVE-2012-4981 | High | 8.8 | 2020-01-23 | Toshiba ConfigFree 8.0.38 has a CF7 File Remote Command Execution Vulnerability |
CVE-2019-19842 | Critical | 9.8 | 2020-01-22 | emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=spectra-ana… |
CVE-2019-19841 | Critical | 9.8 | 2020-01-22 | emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=packet-capt… |
CVE-2019-10780 | Critical | 9.8 | 2020-01-22 | BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open method through Bib… |
CVE-2020-7594 | High | 7.2 | 2020-01-21 | MultiTech Conduit MTCDT-LVW2-24XX 1.4.17-ocea-13592 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Deb… |
CVE-2020-7244 | High | 7.2 | 2020-01-20 | Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by navigating to the Poll Routes page and ent… |
CVE-2020-7243 | High | 7.2 | 2020-01-20 | Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by navigating to the Fetch URL page and enter… |
CVE-2020-7242 | High | 7.2 | 2020-01-20 | Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by navigating to the Diagnostics Trace Route… |
CVE-2020-7240 | High | 8.8 | 2020-01-20 | Meinberg Lantime M300 and M1000 devices allow attackers (with privileges to configure a device) to execute arbitrary OS commands by editing the /config/netconf… |
CVE-2020-7237 | High | 8.8 | 2020-01-20 | Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS c… |
CVE-2019-10958 | High | 7.2 | 2020-01-17 | Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote authenticated attacke… |
CVE-2019-10956 | High | 7.2 | 2020-01-17 | Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote authenticated user, u… |
CVE-2020-1609 | High | 8.8 | 2020-01-15 | When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay… |
CVE-2020-1605 | High | 8.8 | 2020-01-15 | When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay… |
CVE-2020-1602 | High | 7.1 | 2020-01-15 | When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay… |
CVE-2020-5505 | Critical | 9.8 | 2020-01-14 | Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring (in conjunction with "type":"application/x-php"} to th… |
CVE-2020-6948 | Critical | 9.8 | 2020-01-13 | A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.exec call that mish… |
CVE-2019-18894 | High | 7.8 | 2020-01-13 | In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Ban… |
CVE-2020-6757 | High | 8.8 | 2020-01-09 | contentHostProperties.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows authenticated attackers to remotely execute code via the name pa… |
CVE-2020-6756 | Critical | 9.8 | 2020-01-09 | languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows unauthenticated attackers to remotely execute code via the lang parame… |
CVE-2019-20224 | High | 8.8 | 2020-01-09 | netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in… |
CVE-2014-2650 | Critical | 9.8 | 2020-01-09 | Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection vulnerability in the web based management interface |
CVE-2019-10777 | Critical | 9.8 | 2020-01-08 | In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitizat… |