CWE-78 · OS Command Injection (page 55)

Page 55 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.

All CVEs classified under CWE-78 — newest first (page 55 of 70)
CVESeverityScorePublishedSummary
CVE-2020-15467High8.82020-08-04The administrative interface of Cohesive Networks vns3:vpn appliances before version 4.11.1 is vulnerable to authenticated remote code execution leading to ser…
CVE-2020-3377Medium6.32020-07-31A vulnerability in the Device Manager application of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to inject arbitrary…
CVE-2020-14162High7.82020-07-30An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to execute the pihole core script as root without a password, which…
CVE-2020-12620High7.82020-07-30Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection (shell metacharacters after an IP addr…
CVE-2020-5760High7.82020-07-29Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to an OS command injection vulnerability. Unauthenticated remote attackers can execu…
CVE-2020-7698High8.12020-07-29This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn’t being sanitized.
CVE-2020-15615Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15614Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15613Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15612Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15611Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15610Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15609Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15608Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15607Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15606Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15435Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15434Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15433Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15432Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15431Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15430Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15429Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15428Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15427Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15426Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15425Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15424Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15423Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15422Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15421Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15420Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-el7-0.9.8.891. Authentication is not req…
CVE-2020-15778High7.42020-07-24scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE…
CVE-2020-15922Critical9.82020-07-24There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges…
CVE-2020-15920Critical9.82020-07-24There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) pri…
CVE-2020-15631High8.02020-07-23This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 1.04B03_HOTFIX WiFi extenders. Alth…
CVE-2020-15477Critical9.82020-07-23The WebControl in RaspberryTortoise through 2012-10-28 is vulnerable to remote code execution via shell metacharacters in a URI. The file nodejs/raspberryTorto…
CVE-2020-15916Critical9.82020-07-23goform/AdvSetLanip endpoint on Tenda AC15 AC1900 15.03.05.19 devices allows remote attackers to execute arbitrary system commands via shell metacharacters in t…
CVE-2020-15893Critical9.82020-07-22An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can…
CVE-2020-12774High8.22020-07-22D-Link DSL-7740C does not properly validate user input, which allows an authenticated LAN user to inject arbitrary command.
CVE-2020-15123Critical9.32020-07-20In codecov (npm package) before version 3.7.1 the upload method has a command injection vulnerability. Clients of the codecov-node library are unlikely to be a…
CVE-2020-15121High7.42020-07-20In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's required to open the execut…
CVE-2020-7206Critical9.82020-07-17HP nagios plugin for iLO (nagios-plugins-hpilo v1.50 and earlier) has a php code injection vulnerability.
CVE-2020-5759Critical9.82020-07-17Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH. An authenticated remote attacker can execute com…
CVE-2020-5758High8.82020-07-17Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can execute co…
CVE-2020-5757Critical9.82020-07-17Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can bypass com…
CVE-2020-5756High8.82020-07-17Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab via undocumented API. An attacker can u…
CVE-2020-7825High8.82020-07-17A vulnerability exists that could allow the execution of operating system commands on systems running MiPlatform 2019.05.16 and earlier. An attacker could exec…
CVE-2020-11981Critical9.82020-07-17An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly…
CVE-2020-11978High8.82020-07-17An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shippe…
CVE-2020-3332High8.82020-07-16A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Series Routers could allow an authenticated, re…
CVE-2020-8958High7.22020-07-15Guangzhou 1GE ONU V2801RW 1.9.1-181203 through 2.9.0-181024 and V2804RGW 1.9.1-181203 through 2.9.0-181024 devices allow remote attackers to execute arbitrary…
CVE-2020-8178Critical9.82020-07-15Insufficient input validation in npm package `jison` <= 0.4.18 may lead to OS command injection attacks.
CVE-2020-11084Medium6.42020-07-14In iPear, the manual execution of the eval() function can lead to command injection. Only PCs where commands are manually executed via "For Developers" are aff…
CVE-2020-11953High8.82020-07-14An issue was discovered on Rittal PDU-3C002DEC through 5.15.40 and CMCIII-PU-9333E0FB through 3.15.70_4 devices. Attackers can execute code.
CVE-2020-4512High7.22020-07-14IBM QRadar SIEM 7.3 and 7.4 could allow a remote privileged user to execute commands.
CVE-2020-13925Critical9.82020-07-14Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the rep…
CVE-2020-10987Critical9.82020-07-13The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST…
CVE-2020-8186Critical9.82020-07-10A command injection vulnerability in the `devcert` module may lead to remote code execution when users of the module pass untrusted input to the `certificateFo…
CVE-2020-9377High8.82020-07-09D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer s…
CVE-2020-2034High8.12020-07-08An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with…
CVE-2020-2030High7.22020-07-08An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root pr…
CVE-2020-5352High8.82020-07-06Dell EMC Data Protection Advisor 6.4, 6.5 and 18.1 contain an OS command injection vulnerability. A remote authenticated malicious user may exploit this vulner…
CVE-2020-8188High8.82020-07-02We have recently released new version of UniFi Protect firmware v1.13.3 and v1.14.10 for Unifi Cloud Key Gen2 Plus and UniFi Dream Machine Pro/UNVR respectivel…
CVE-2020-15489Critical9.82020-07-01An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. Multiple shell metacharacter injection vulnerabilities exist in CGI scripts, leadin…
CVE-2019-15311Critical9.82020-07-01An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is Zolo Halo LAN remote code execution. The Zolo Halo Bluetooth speaker had a GoA…
CVE-2019-15310Critical9.82020-07-01An issue was discovered on various devices via the Linkplay firmware. There is WAN remote code execution without user interaction. An attacker could retrieve t…
CVE-2020-7688High8.42020-07-01The issue occurs because tagName user input is formatted inside the exec function is executed without any checks.
CVE-2020-13619Critical9.82020-07-01php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution.
CVE-2020-14947High8.82020-06-30OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php because mib_file in plugins/main_sections/…
CVE-2020-15415Critical9.82020-06-30On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharac…
CVE-2020-15362Critical9.82020-06-29wifiscanner.js in thingsSDK WiFi Scanner 1.0.1 allows Code Injection because it can be used with options to overwrite the default executable/binary path and it…
CVE-2020-14414High8.82020-06-29NeDi 1.9C is vulnerable to Remote Command Execution. pwsec.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by cra…
CVE-2020-14412High8.82020-06-29NeDi 1.9C is vulnerable to Remote Command Execution. System-Snapshot.php improperly escapes shell metacharacters from a POST request. An attacker can exploit t…
CVE-2020-14072Critical9.82020-06-29An issue was discovered in MK-AUTH 19.01. It allows command execution as root via shell metacharacters to /auth admin scripts.
CVE-2019-16213High8.82020-06-25Tenda PA6 Wi-Fi Powerline extender 1.0.1.21 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially cra…
CVE-2020-13159Critical9.82020-06-22Artica Proxy before 4.30.000000 Community Edition allows OS command injection via the Netbios name, Server domain name, dhclient_mac, Hostname, or Alias field…
CVE-2019-14894High8.02020-06-22A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS sch…
CVE-2020-4066Low3.82020-06-22In Limdu before 0.95, the trainBatch function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this, so they mig…
CVE-2020-14950High8.82020-06-21aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a modified /system?action=ServiceAdmin reques…
CVE-2020-3336High7.22020-06-18A vulnerability in the software upgrade process of Cisco TelePresence Collaboration Endpoint Software and Cisco RoomOS Software could allow an authenticated, r…
CVE-2020-3279High7.22020-06-18Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an…
CVE-2020-3278High7.22020-06-18Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an…
CVE-2020-3277High7.22020-06-18Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an…
CVE-2020-3276High7.22020-06-18Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an…
CVE-2020-3275High7.22020-06-18Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an…
CVE-2020-3274High7.22020-06-18Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an…
CVE-2020-4469Critical9.82020-06-15IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP comman…
CVE-2020-14081High8.82020-06-15TRENDnet TEW-827DRU devices through 2.06B04 contain multiple command injections in apply.cgi via the action send_log_email with the key auth_acname (or auth_pa…
CVE-2020-14075High8.82020-06-15TRENDnet TEW-827DRU devices through 2.06B04 contain multiple command injections in apply.cgi via the action pppoe_connect, ru_pppoe_connect, or dhcp_connect wi…
CVE-2020-13851High8.82020-06-11Artica Pandora FMS 7.44 allows remote command execution via the events feature.
CVE-2020-2029High7.22020-06-10An OS Command Injection vulnerability in the PAN-OS web management interface allows authenticated administrators to execute arbitrary OS commands with root pri…
CVE-2020-2028High7.22020-06-10An OS Command Injection vulnerability in PAN-OS management server allows authenticated administrators to execute arbitrary OS commands with root privileges whe…
CVE-2020-13978High7.22020-06-09Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS comman…
CVE-2020-13976High8.82020-06-09An issue was discovered in DD-WRT through 16214. The Diagnostic page allows remote attackers to execute arbitrary commands via shell metacharacters in the host…
CVE-2020-3224High8.82020-06-03A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to in…
CVE-2020-3212High7.22020-06-03A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the…
CVE-2020-3211High7.22020-06-03A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the…
CVE-2020-3210Medium6.72020-06-03A vulnerability in the CLI parsers of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series C…
CVE-2020-3207Medium6.72020-06-03A vulnerability in the processing of boot options of specific Cisco IOS XE Software switches could allow an authenticated, local attacker with root shell acces…