CWE-78 · OS Command Injection (page 54)
Page 54 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10778 | Critical | 9.8 | 2020-01-08 | devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable `commonName`… |
CVE-2019-17148 | High | 7.8 | 2020-01-07 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop version 14.1.3 (45485). An at… |
CVE-2019-10776 | Critical | 9.8 | 2020-01-07 | In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all version… |
CVE-2019-20348 | Medium | 6.8 | 2020-01-06 | OKER G232V1 v1.03.02.20161129 devices provide a root terminal on a UART serial interface without proper access control. This allows attackers with physical acc… |
CVE-2019-19509 | High | 8.8 | 2020-01-06 | An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php bec… |
CVE-2016-11017 | Critical | 9.8 | 2020-01-06 | The application login page in AKIPS Network Monitor 15.37 through 16.5 allows a remote unauthenticated attacker to execute arbitrary OS commands via shell meta… |
CVE-2019-15979 | High | 7.2 | 2020-01-06 | Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with admi… |
CVE-2019-15978 | High | 7.2 | 2020-01-06 | Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with admi… |
CVE-2019-5987 | High | 8.8 | 2020-01-06 | Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote authenticated attackers to execute arbitrary OS commands via the Management… |
CVE-2012-5878 | Critical | 9.8 | 2020-01-03 | Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the host… |
CVE-2012-5693 | High | 8.8 | 2020-01-03 | Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddressTB… |
CVE-2020-5179 | High | 7.2 | 2020-01-02 | Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Diagnostics Ping page an… |
CVE-2019-20197 | High | 8.8 | 2019-12-31 | In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the c… |
CVE-2019-3984 | Critical | 9.8 | 2019-12-31 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when the… |
CVE-2019-9197 | High | 8.8 | 2019-12-31 | The com.unity3d.kharma protocol handler in Unity Editor 2018.3 allows remote attackers to execute arbitrary code. |
CVE-2019-16790 | Medium | 6.5 | 2019-12-30 | In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are impacted. |
CVE-2019-17621 | Critical | 9.8 | 2019-12-30 | The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands… |
CVE-2019-10774 | Critical | 9.8 | 2019-12-30 | php-shellcommand versions before 1.6.1 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2019-6014 | High | 8.8 | 2019-12-26 | DBA-1510P firmware 1.70b009 and earlier allows an attacker to execute arbitrary OS commands via Web User Interface. |
CVE-2019-6013 | Medium | 6.6 | 2019-12-26 | DBA-1510P firmware 1.70b009 and earlier allows authenticated attackers to execute arbitrary OS commands via Command Line Interface (CLI). |
CVE-2019-19920 | High | 8.8 | 2019-12-22 | sa-exim 4.2.1 allows attackers to execute arbitrary code if they can write a .cf file or a rule. This occurs because Greylisting.pm relies on eval (rather than… |
CVE-2019-15598 | Critical | 9.8 | 2019-12-18 | A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command. |
CVE-2019-8513 | High | 7.8 | 2019-12-18 | This issue was addressed with improved checks. This issue is fixed in macOS Mojave 10.14.4. A local user may be able to execute arbitrary shell commands. |
CVE-2019-11399 | Critical | 9.8 | 2019-12-18 | An issue was discovered on TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices. OS command injection occurs through the get_set.ccp l… |
CVE-2019-18830 | Critical | 9.8 | 2019-12-16 | Barco ClickShare Button R9861500D01 devices before 1.9.0 allow OS Command Injection. The embedded 'dongle_bridge' program used to expose the functionalities of… |
CVE-2019-17364 | Critical | 9.8 | 2019-12-13 | The processCommandUploadLog() function of libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary… |
CVE-2019-16737 | Critical | 9.8 | 2019-12-13 | The processCommandSetMac() function of libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary sy… |
CVE-2019-16733 | Critical | 9.8 | 2019-12-13 | processCommandSetUid() in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands… |
CVE-2019-16730 | Critical | 9.8 | 2019-12-13 | processCommandUpgrade() in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system command… |
CVE-2018-11805 | Medium | 6.7 | 2019-12-12 | In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injec… |
CVE-2019-3989 | Critical | 9.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when retr… |
CVE-2019-3988 | High | 8.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when conf… |
CVE-2019-3987 | High | 8.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when conf… |
CVE-2019-3986 | High | 8.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when conf… |
CVE-2019-3985 | High | 8.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when conf… |
CVE-2014-0163 | High | 8.8 | 2019-12-11 | Openshift has shell command injection flaws due to unsanitized data being passed into shell commands. |
CVE-2019-4715 | High | 8.8 | 2019-12-11 | IBM Spectrum Scale 4.2 and 5.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request… |
CVE-2019-19604 | High | 7.8 | 2019-12-11 | Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 becaus… |
CVE-2019-14889 | High | 8.8 | 2019-12-10 | A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp… |
CVE-2019-17270 | Critical | 9.8 | 2019-12-10 | Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command={C… |
CVE-2019-19642 | High | 8.8 | 2019-12-08 | On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who… |
CVE-2019-19609 | High | 7.2 | 2019-12-05 | The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because i… |
CVE-2019-19469 | High | 8.8 | 2019-12-01 | In Zmanda Management Console 3.3.9, ZMC_Admin_Advanced?form=adminTasks&action=Apply&command= allows CSRF, as demonstrated by command injection with shell metac… |
CVE-2011-2523 | Critical | 9.8 | 2019-11-27 | vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp. |
CVE-2019-18184 | Critical | 9.8 | 2019-11-27 | Crestron DMC-STRO 1.0 devices allow remote command execution as root via shell metacharacters to the ping function. |
CVE-2017-12945 | High | 8.8 | 2019-11-27 | Insufficient validation of user-supplied input for the Solstice Pod before 2.8.4 networking configuration enables authenticated attackers to execute arbitrary… |
CVE-2019-15298 | High | 8.8 | 2019-11-27 | A problem was found in Centreon Web through 19.04.3. An authenticated command injection is present in the page include/configuration/configObject/traps-mibs/fo… |
CVE-2019-16242 | Medium | 6.8 | 2019-11-26 | On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an engineering application named omamock that is vulnerable to OS command injection. An attacker with… |
CVE-2019-12489 | Critical | 9.8 | 2019-11-26 | An issue was discovered on Fastweb Askey RTV1907VW 0.00.81_FW_200_Askey 2018-10-02 18:08:18 devices. By using the usb_remove service through an HTTP request, i… |
CVE-2019-15997 | Medium | 6.7 | 2019-11-26 | A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to perform a command injection attack and execute arbitrary command… |
CVE-2019-15996 | Medium | 6.7 | 2019-11-26 | A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underly… |
CVE-2019-15986 | Medium | 6.7 | 2019-11-26 | A vulnerability in the CLI of Cisco Unity Express could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privile… |
CVE-2019-18910 | Medium | 6.8 | 2019-11-22 | The Citrix Receiver wrapper function does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute wit… |
CVE-2019-18909 | High | 8.0 | 2019-11-22 | The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with… |
CVE-2019-5072 | High | 7.8 | 2019-11-21 | An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Router AC1200 Smart Dual-Band Gigabit WiFi… |
CVE-2019-5071 | High | 7.8 | 2019-11-21 | An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Router AC1200 Smart Dual-Band Gigabit WiFi… |
CVE-2019-17650 | High | 7.8 | 2019-11-21 | An Improper Neutralization of Special Elements used in a Command vulnerability in one of FortiClient for Mac OS root processes, may allow a local user of the s… |
CVE-2019-18934 | High | 7.3 | 2019-11-19 | Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiving a specially crafted answer. This is… |
CVE-2019-19117 | High | 8.8 | 2019-11-18 | /usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2(PSG1218) V22.5.9.163 devices allows remote authenticated users to execute any command via shel… |
CVE-2019-19041 | High | 7.2 | 2019-11-17 | An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41. They do not correctly verify the integrity of an upgrade packag… |
CVE-2019-15800 | Critical | 9.8 | 2019-11-14 | An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Due to lack of input validation in the cmd_sys_traceroute_exec(), cmd_sys_… |
CVE-2019-15351 | High | 7.8 | 2019-11-14 | The Tecno Camon Android device with a build fingerprint of TECNO/H622/TECNO-ID5b:8.1.0/O11019/G-180829V31:user/release-keys contains a pre-installed platform a… |
CVE-2019-15348 | High | 7.8 | 2019-11-14 | The Tecno Camon Android device with a build fingerprint of TECNO/H612/TECNO-ID5a:8.1.0/O11019/F-180828V106:user/release-keys contains a pre-installed platform… |
CVE-2019-15347 | High | 7.8 | 2019-11-14 | The Tecno Camon iClick 2 Android device with a build fingerprint of TECNO/H622/TECNO-ID6:8.1.0/O11019/F-180824V116:user/release-keys contains a pre-installed p… |
CVE-2019-15343 | High | 7.8 | 2019-11-14 | The Tecno Camon iClick Android device with a build fingerprint of TECNO/H633/TECNO-IN6:8.1.0/O11019/A-180409V96:user/release-keys contains a pre-installed plat… |
CVE-2019-15342 | High | 7.8 | 2019-11-14 | The Tecno Camon iAir 2 Plus Android device with a build fingerprint of TECNO/H622/TECNO-ID3k:8.1.0/O11019/E-180914V83:user/release-keys contains a pre-installe… |
CVE-2019-5029 | Critical | 9.8 | 2019-11-13 | An exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.7.1. Arbitrary shell commands surrounded… |
CVE-2019-18839 | Critical | 9.0 | 2019-11-13 | FUDForum 3.0.9 is vulnerable to Stored XSS via the nlogin parameter. This may result in remote code execution. An attacker can use a user account to fully comp… |
CVE-2019-18873 | Critical | 9.0 | 2019-11-12 | FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to full… |
CVE-2019-8159 | High | 8.8 | 2019-11-06 | A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with system data man… |
CVE-2019-15588 | High | 7.2 | 2019-11-01 | There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All… |
CVE-2019-18396 | High | 7.2 | 2019-10-31 | An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Command Injection in the Ping module in the… |
CVE-2019-15710 | High | 7.2 | 2019-10-31 | An OS command injection vulnerability in FortiExtender 4.1.0 to 4.1.1, 4.0.0 and below under CLI admin console may allow unauthorized administrators to run arb… |
CVE-2013-2024 | High | 8.8 | 2019-10-31 | OS command injection vulnerability in the "qs" procedure from the "utils" module in Chicken before 4.9.0. |
CVE-2019-18424 | Medium | 6.8 | 2019-10-31 | An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a ph… |
CVE-2019-14931 | Critical | 9.8 | 2019-10-28 | An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote OS Comman… |
CVE-2019-16663 | High | 8.8 | 2019-10-28 | An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand p… |
CVE-2019-16662 | Critical | 9.8 | 2019-10-28 | An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the ro… |
CVE-2019-5129 | Critical | 9.8 | 2019-10-25 | A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated co… |
CVE-2019-5128 | Critical | 9.8 | 2019-10-25 | A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated co… |
CVE-2019-5127 | Critical | 9.8 | 2019-10-25 | A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated co… |
CVE-2019-13653 | Critical | 9.8 | 2019-10-24 | TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow triggerPort OS Command Injection (issue 5 of 5). |
CVE-2019-13652 | Critical | 9.8 | 2019-10-24 | TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow serviceName OS Command Injection (issue 4 of 5). |
CVE-2019-13651 | Critical | 9.8 | 2019-10-24 | TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow portMappingProtocol OS Command Injection (issue 3 of 5). |
CVE-2019-13650 | Critical | 9.8 | 2019-10-24 | TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow internalPort OS Command Injection (issue 2 of 5). |
CVE-2019-13649 | Critical | 9.8 | 2019-10-24 | TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow externalPort OS Command Injection (issue 1 of 5). |
CVE-2019-18370 | Critical | 9.8 | 2019-10-23 | An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. The backup file is in tar.gz format. After uploading, the application uses the tar… |
CVE-2019-16965 | High | 7.2 | 2019-10-21 | resources/cmd.php in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated adminis… |
CVE-2019-16964 | High | 8.8 | 2019-10-21 | app/call_centers/cmd.php in the Call Center Queue Module in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validat… |
CVE-2019-17526 | Critical | 9.8 | 2019-10-18 | An issue was discovered in SageMath Sage Cell Server through 2019-10-05. Python Code Injection can occur in the context of an internet facing web application… |
CVE-2019-14423 | High | 8.8 | 2019-10-17 | A Remote Code Execution (RCE) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers… |
CVE-2019-15277 | Medium | 6.7 | 2019-10-16 | A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to execute code with root pr… |
CVE-2019-15275 | Medium | 6.7 | 2019-10-16 | A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to execute arbitrary command… |
CVE-2019-15274 | Medium | 6.7 | 2019-10-16 | A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to perform command injection… |
CVE-2019-17625 | Critical | 9.0 | 2019-10-16 | There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to i… |
CVE-2019-17501 | High | 8.8 | 2019-10-14 | Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > Disc… |
CVE-2019-17510 | Critical | 9.8 | 2019-10-11 | D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ re… |
CVE-2019-17509 | Critical | 9.8 | 2019-10-11 | D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ re… |
CVE-2019-17508 | Critical | 9.8 | 2019-10-11 | On D-Link DIR-859 A3-1.06 and DIR-850 A1.13 devices, /etc/services/DEVICE.TIME.php allows command injection via the $SERVER variable. |
CVE-2019-17059 | Critical | 9.8 | 2019-10-11 | A shell injection vulnerability on the Sophos Cyberoam firewall appliance with CyberoamOS before 10.6.6 MR-6 allows remote attackers to execute arbitrary comma… |