CWE-78 · OS Command Injection (page 55)
Page 55 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-17499 | High | 8.8 | 2019-10-11 | The setter.xml component of the Common Gateway Interface on Compal CH7465LG 6.12.18.25-2p4 devices does not properly validate ping command arguments, which all… |
CVE-2019-11527 | High | 8.8 | 2019-10-10 | An issue was discovered in Softing uaGate SI 1.60.01. A CGI script is vulnerable to command injection with a maliciously crafted url parameter. |
CVE-2019-15014 | High | 8.8 | 2019-10-09 | A command injection vulnerability exists in the Zingbox Inspector versions 1.286 and earlier, that allows for an authenticated user to execute arbitrary system… |
CVE-2019-15715 | High | 7.2 | 2019-10-09 | MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution. |
CVE-2019-13051 | High | 8.8 | 2019-10-09 | Pi-Hole 4.3 allows Command Injection. |
CVE-2019-17107 | High | 8.8 | 2019-10-08 | minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parameter. NOTE: some sou… |
CVE-2019-12812 | Critical | 9.8 | 2019-10-07 | MyBuilder viewer before 6.2.2019.814 allow an attacker to execute arbitrary command via specifically crafted configuration file. This can be leveraged for code… |
CVE-2019-12811 | Critical | 9.8 | 2019-10-07 | ActiveX Control in MyBuilder before 6.2.2019.814 allow an attacker to execute arbitrary command via the ShellOpen method. This can be leveraged for code execut… |
CVE-2019-15746 | Critical | 9.8 | 2019-10-07 | SITOS six Build v6.2.1 allows an attacker to inject arbitrary PHP commands. As a result, an attacker can compromise the running server and execute system comma… |
CVE-2019-17269 | Critical | 9.8 | 2019-10-07 | Intellian Remote Access 3.18 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the Ping Test field. |
CVE-2019-15036 | High | 7.2 | 2019-10-02 | An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could execute any command on the server machine. The issue was fixed i… |
CVE-2019-12699 | High | 7.8 | 2019-10-02 | Multiple vulnerabilities in the CLI of Cisco FXOS Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to ex… |
CVE-2019-12690 | High | 7.2 | 2019-10-02 | A vulnerability in the web UI of the Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to inject arbitrary commands that ar… |
CVE-2019-13025 | Critical | 9.8 | 2019-10-02 | Compal CH7465LG CH7465LG-NCIP-6.12.18.24-5p8-NOSH devices have Incorrect Access Control because of Improper Input Validation. The attacker can send a malicious… |
CVE-2019-16920 | Critical | 9.8 | 2019-09-27 | Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an… |
CVE-2019-12091 | High | 7.8 | 2019-09-26 | The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts network connections from localhost. The… |
CVE-2019-12717 | High | 7.8 | 2019-09-25 | A vulnerability in a CLI command related to the virtualization manager (VMAN) in Cisco NX-OS Software could allow an authenticated, local attacker to execute a… |
CVE-2019-12709 | Medium | 6.7 | 2019-09-25 | A vulnerability in a CLI command related to the virtualization manager (VMAN) in Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers c… |
CVE-2019-12661 | Medium | 6.7 | 2019-09-25 | A vulnerability in a Virtualization Manager (VMAN) related CLI command of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitra… |
CVE-2019-12651 | High | 8.8 | 2019-09-25 | Multiple vulnerabilities in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands wi… |
CVE-2019-12650 | High | 8.8 | 2019-09-25 | Multiple vulnerabilities in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands wi… |
CVE-2019-16701 | High | 8.8 | 2019-09-25 | pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters… |
CVE-2019-16718 | High | 7.8 | 2019-09-23 | In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to ex… |
CVE-2019-15000 | Critical | 9.8 | 2019-09-19 | The commit diff rest endpoint in Bitbucket Server and Data Center before 5.16.10 (the fixed version for 5.16.x ), from 6.0.0 before 6.0.10 (the fixed version f… |
CVE-2019-16057 | Critical | 9.8 | 2019-09-16 | The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection. |
CVE-2019-5485 | Critical | 10.0 | 2019-09-13 | NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be injected through the repository name. |
CVE-2019-5315 | High | 7.2 | 2019-09-13 | A command injection vulnerability is present in the web management interface of ArubaOS that permits an authenticated user to execute arbitrary commands on the… |
CVE-2019-16293 | High | 8.8 | 2019-09-13 | The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field. |
CVE-2019-10392 | High | 8.8 | 2019-09-12 | Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting… |
CVE-2019-10669 | High | 7.2 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. There is a command injection vulnerability in html/includes/graphs/device/collectd.inc.php where user supplie… |
CVE-2019-10891 | Critical | 9.8 | 2019-09-06 | An issue was discovered in D-Link DIR-806 devices. There is a command injection in function hnap_main, which calls system() without checking the parameter that… |
CVE-2019-15029 | High | 8.8 | 2019-09-05 | FusionPBX 4.4.8 allows an attacker to execute arbitrary system commands by submitting a malicious command to the service_edit.php file (which will insert the m… |
CVE-2019-15949 | High | 8.8 | 2019-09-05 | Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via t… |
CVE-2019-5475 | High | 8.8 | 2019-09-03 | The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such a… |
CVE-2019-11364 | High | 7.2 | 2019-08-29 | An OS Command Injection vulnerability in Snare Central before 7.4.5 allows remote authenticated attackers to inject arbitrary OS commands via the ServerConf/Da… |
CVE-2019-15701 | High | 8.8 | 2019-08-27 | components/Modals/HelpModal.jsx in BloodHound 2.2.0 allows remote attackers to execute arbitrary OS commands (by spawning a child process as the current user o… |
CVE-2019-15503 | Critical | 9.8 | 2019-08-26 | cgi-cpn/xcoding/prontus_videocut.cgi in AltaVoz Prontus (aka ProntusCMS) through 12.0.3.0 has "Improper Neutralization of Special Elements used in an OS Comman… |
CVE-2019-1581 | Critical | 9.8 | 2019-08-23 | A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SS… |
CVE-2019-15530 | High | 8.8 | 2019-08-23 | An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell m… |
CVE-2019-15529 | High | 8.8 | 2019-08-23 | An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell m… |
CVE-2019-15528 | High | 8.8 | 2019-08-23 | An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell m… |
CVE-2019-15527 | High | 8.8 | 2019-08-23 | An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell m… |
CVE-2019-15526 | High | 8.8 | 2019-08-23 | An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell m… |
CVE-2019-15490 | Critical | 9.8 | 2019-08-23 | openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21. |
CVE-2019-13139 | High | 8.4 | 2019-08-22 | In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command e… |
CVE-2019-15060 | High | 8.8 | 2019-08-22 | The traceroute function on the TP-Link TL-WR840N v4 router with firmware through 0.9.1 3.16 is vulnerable to remote code execution via a crafted payload in an… |
CVE-2019-1896 | High | 7.2 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject a… |
CVE-2019-1885 | High | 7.2 | 2019-08-21 | A vulnerability in the Redfish protocol of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject and execute arb… |
CVE-2019-1883 | High | 7.8 | 2019-08-21 | A vulnerability in the command-line interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker with read-only crede… |
CVE-2019-1865 | High | 8.8 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to… |
CVE-2019-1864 | High | 8.8 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to… |
CVE-2019-1850 | High | 7.2 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to… |
CVE-2019-1839 | Medium | 6.7 | 2019-08-21 | A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affect… |
CVE-2019-1634 | High | 7.2 | 2019-08-21 | A vulnerability in the Intelligent Platform Management Interface (IPMI) of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote at… |
CVE-2019-4294 | High | 7.8 | 2019-08-20 | IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0.12, 9.1.0.0 through 9.1.0.2, and 9.1.1… |
CVE-2019-3968 | High | 8.8 | 2019-08-20 | In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new f… |
CVE-2019-5477 | Critical | 9.8 | 2019-08-16 | A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are… |
CVE-2019-14923 | High | 8.8 | 2019-08-16 | EyesOfNetwork 5.1 allows Remote Command Execution via shell metacharacters in the module/tool_all/ host field. |
CVE-2018-20969 | High | 7.8 | 2019-08-16 | do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the same commit as for CVE-2019-13638, but… |
CVE-2019-15107 | Critical | 9.8 | 2019-08-16 | An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability. |
CVE-2019-12792 | High | 8.8 | 2019-08-15 | A command injection vulnerability in UploadHandler.php in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users to roo… |
CVE-2019-3417 | High | 8.8 | 2019-08-15 | All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by command injection vulnerability. Due to insufficient parameter validation check, an au… |
CVE-2019-14527 | Critical | 9.8 | 2019-08-14 | An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. System commands can be executed, via the web interface, after authentication. |
CVE-2019-12103 | Critical | 9.8 | 2019-08-14 | The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by a pre-authentication command injection vulnerability. |
CVE-2019-15027 | Critical | 9.8 | 2019-08-14 | The MediaTek Embedded Multimedia Card (eMMC) subsystem for Android on MT65xx, MT66xx, and MT8163 SoC devices allows attackers to execute arbitrary commands as… |
CVE-2019-1971 | Critical | 9.8 | 2019-08-08 | A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to perform a command… |
CVE-2019-1960 | Medium | 4.4 | 2019-08-08 | Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to read arbitrary files on the un… |
CVE-2019-1959 | Medium | 4.4 | 2019-08-08 | Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to read arbitrary files on the un… |
CVE-2019-14744 | High | 7.8 | 2019-08-07 | In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to… |
CVE-2019-14699 | Critical | 9.8 | 2019-08-06 | An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker can exploit OS Command Injection in the filename paramet… |
CVE-2019-14260 | High | 8.0 | 2019-08-01 | On the Alcatel-Lucent Enterprise (ALE) 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injection (missing input validation) issue in t… |
CVE-2019-14259 | High | 8.0 | 2019-08-01 | On the Polycom Obihai Obi1022 VoIP phone with firmware 5.1.11, a command injection (missing input validation) issue in the NTP server IP address field for the… |
CVE-2019-14337 | Medium | 5.5 | 2019-08-01 | An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is an ability to escape to a shell in the restricted command lin… |
CVE-2019-1020004 | High | 7.5 | 2019-07-29 | Tridactyl before 1.16.0 allows fake key events. |
CVE-2019-13638 | High | 7.8 | 2019-07-26 | GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payloa… |
CVE-2019-3595 | Medium | 6.5 | 2019-07-24 | Improper Neutralization of Special Elements used in a Command ('Command Injection') in ePO extension in McAfee Data Loss Prevention (DLP) 11.x prior to 11.3.0… |
CVE-2019-1010179 | Critical | 9.8 | 2019-07-24 | PHKP including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b is affected by: Improper Neutralization of Special Elements used in a Command ('Command Injectio… |
CVE-2019-1010200 | Critical | 9.8 | 2019-07-23 | Voice Builder Prior to commit c145d4604df67e6fc625992412eef0bf9a85e26b and f6660e6d8f0d1d931359d591dbdec580fef36d36 is affected by: CWE-78: Improper Neutraliza… |
CVE-2019-12328 | Critical | 9.0 | 2019-07-22 | A command injection (missing input validation) issue in the remote phonebook configuration URI in the web interface of the Atcom A10W VoIP phone with firmware… |
CVE-2019-12324 | High | 7.2 | 2019-07-22 | A command injection (missing input validation) issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP… |
CVE-2019-12725 | Critical | 9.8 | 2019-07-19 | Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP paramet… |
CVE-2019-1010245 | Critical | 9.8 | 2019-07-19 | The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation. The impact is: A remote attacker can execute arbi… |
CVE-2019-13640 | Critical | 9.8 | 2019-07-17 | In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows command injection via shell metacharacters in… |
CVE-2019-12992 | High | 8.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 6 of 6). |
CVE-2019-12991 | High | 8.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6). |
CVE-2019-12988 | Critical | 9.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 4 of 6). |
CVE-2019-12987 | Critical | 9.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6). |
CVE-2019-12986 | Critical | 9.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 2 of 6). |
CVE-2019-12985 | Critical | 9.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 1 of 6). |
CVE-2019-1576 | High | 8.8 | 2019-07-16 | Command injection in PAN-0S 9.0.2 and earlier may allow an authenticated attacker to gain access to a remote shell in PAN-OS, and potentially run with the esca… |
CVE-2019-13598 | Critical | 9.8 | 2019-07-14 | LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port_3480/data_re… |
CVE-2019-13597 | Critical | 9.8 | 2019-07-14 | _s_/sprm/_s_/dyn/Player_setScriptFile in Sahi Pro 8.0.0 allows command execution. It allows one to run ".sah" scripts via Sahi Launcher. Also, one can create a… |
CVE-2019-13567 | High | 8.8 | 2019-07-12 | The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon (aka the h… |
CVE-2019-13574 | High | 7.8 | 2019-07-12 | In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is direct… |
CVE-2019-12579 | High | 7.8 | 2019-07-11 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to run… |
CVE-2019-11062 | Critical | 9.8 | 2019-07-11 | The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via "/teach/course/doajaxfileupload.php". The target server can be exploited witho… |
CVE-2019-13561 | Critical | 9.8 | 2019-07-11 | D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metacharacters in the online_firmware_check.cgi c… |
CVE-2019-13482 | High | 8.8 | 2019-07-10 | An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shel… |
CVE-2019-13481 | High | 8.8 | 2019-07-10 | An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shel… |
CVE-2019-0328 | High | 7.2 | 2019-07-10 | ABAP Tests Modules (SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5) of SAP NetWeaver Process Integration enables an attacker the execution of OS commands wi… |