CWE-78 · OS Command Injection (page 57)
Page 57 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-4206 | High | 8.8 | 2020-03-31 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary commands on the system in the context of root user, caused b… |
CVE-2019-19606 | Critical | 9.8 | 2020-03-30 | X-Plane before 11.41 has multiple improper path validations that could allow reading and writing files from/to arbitrary paths (or a leak of OS credentials to… |
CVE-2020-10886 | Critical | 9.8 | 2020-03-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authen… |
CVE-2020-10882 | High | 8.8 | 2020-03-25 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 route… |
CVE-2020-5282 | High | 7.2 | 2020-03-25 | In Nick Chan Bot before version 1.0.0-beta there is a vulnerability in the `npm` command which is part of this software package. This allows arbitrary shell ex… |
CVE-2020-10789 | Critical | 9.8 | 2020-03-25 | openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are mishandled on an s… |
CVE-2020-5561 | Critical | 9.8 | 2020-03-25 | Keijiban Tsumiki v1.15 allows remote attackers to execute arbitrary OS commands via unspecified vectors. |
CVE-2020-5560 | Critical | 9.8 | 2020-03-25 | WL-Enq 1.11 and 1.12 allows remote attackers to execute arbitrary OS commands with the administrative privilege via unspecified vectors. |
CVE-2020-5556 | Critical | 9.8 | 2020-03-25 | Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to execute arbitrary OS commands via unspecified vectors. |
CVE-2020-10879 | Critical | 9.8 | 2020-03-23 | rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the… |
CVE-2019-19034 | High | 7.2 | 2020-03-23 | Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username when dynamically generating a command t… |
CVE-2016-11022 | High | 7.2 | 2020-03-23 | NETGEAR Prosafe WC9500 5.1.0.17, WC7600 5.1.0.17, and WC7520 2.5.0.35 devices allow a remote attacker to execute code with root privileges via shell metacharac… |
CVE-2020-10818 | High | 7.2 | 2020-03-22 | Artica Proxy 4.26 allows remote command execution for an authenticated user via shell metacharacters in the "Modify the hostname" field. |
CVE-2020-10808 | High | 8.8 | 2020-03-22 | Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a… |
CVE-2019-12767 | Critical | 9.8 | 2020-03-21 | An issue was discovered on D-Link DAP-1650 devices before 1.04B02_J65H Hot Fix. Attackers can execute arbitrary commands. |
CVE-2019-19148 | Critical | 9.8 | 2020-03-20 | Tellabs Optical Line Terminal (OLT) 1150 devices allow Remote Command Execution via the -l option to TELNET or SSH. Tellabs has addressed this issue in the SR3… |
CVE-2019-19487 | High | 8.8 | 2020-03-20 | Command Injection in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to achieve command injection via a plugin test. |
CVE-2018-20334 | Critical | 9.8 | 2020-03-20 | An issue was discovered in ASUSWRT 3.0.0.4.384.20308. When processing the /start_apply.htm POST data, there is a command injection issue via shell metacharacte… |
CVE-2019-16072 | Critical | 9.8 | 2020-03-20 | An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an attacker to execute arbitrary code… |
CVE-2020-3266 | High | 7.8 | 2020-03-19 | A vulnerability in the CLI of Cisco SD-WAN Solution software could allow an authenticated, local attacker to inject arbitrary commands that are executed with r… |
CVE-2020-10674 | Critical | 9.8 | 2020-03-18 | PerlSpeak through 2.01 allows attackers to execute arbitrary OS commands, as demonstrated by use of system and 2-argument open. |
CVE-2019-12132 | Critical | 9.8 | 2020-03-18 | An issue was discovered in ONAP SDNC before Dublin. By executing sla/dgUpload with a crafted filename parameter, an unauthenticated attacker can execute an arb… |
CVE-2019-12123 | High | 8.8 | 2020-03-18 | An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsXml with a crafted module parameter, an authenticated user can execute an arbitrary… |
CVE-2019-12113 | High | 8.8 | 2020-03-18 | An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsGv with a crafted module parameter, an authenticated user can execute an arbitrary… |
CVE-2019-12112 | Critical | 9.8 | 2020-03-18 | An issue was discovered in ONAP SDNC before Dublin. By executing sla/upload with a crafted filename parameter, an unauthenticated attacker can execute an arbit… |
CVE-2019-11689 | High | 8.1 | 2020-03-18 | An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl fail to properly validate server… |
CVE-2019-19940 | High | 7.2 | 2020-03-16 | Incorrect input sanitation in text-oriented user interfaces (telnet, ssh) in Swisscom Centro Grande before 6.16.12 allows remote authenticated users to execute… |
CVE-2019-15708 | Medium | 6.7 | 2020-03-15 | A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.0 under CLI admin c… |
CVE-2020-7607 | Critical | 9.8 | 2020-03-15 | gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in 'index.js' can be controlled by users w… |
CVE-2020-7606 | Critical | 9.8 | 2020-03-15 | docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within 'index.js' of the package, the function 'exec(serviceName, cmd, fnStdout… |
CVE-2020-7605 | Critical | 9.8 | 2020-03-15 | gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options. |
CVE-2020-7604 | Critical | 9.8 | 2020-03-15 | pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attacker. This function u… |
CVE-2020-7603 | Critical | 9.8 | 2020-03-15 | closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled b… |
CVE-2020-7602 | Critical | 9.8 | 2020-03-15 | node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand()" is called by "getDevices()" function in file "linux/manager.js", whic… |
CVE-2020-7601 | Critical | 9.8 | 2020-03-15 | gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command… |
CVE-2019-11355 | High | 7.2 | 2020-03-12 | An issue was discovered in Poly (formerly Polycom) HDX 3.1.13. A feature exists that allows the creation of a server / client certificate, or the upload of the… |
CVE-2020-9436 | High | 8.8 | 2020-03-12 | PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.0… |
CVE-2020-10390 | High | 7.2 | 2020-03-12 | OS Command Injection in export.php (vulnerable function called from include/functions-article.php) in Chadha PHPKB Standard Multi-Language 9 allows remote atta… |
CVE-2019-5171 | High | 7.8 | 2020-03-12 | An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). An attack… |
CVE-2019-5170 | High | 7.8 | 2020-03-12 | An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). A special… |
CVE-2019-5169 | High | 7.8 | 2020-03-12 | An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). A special… |
CVE-2019-5175 | High | 7.8 | 2020-03-11 | An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). A special… |
CVE-2019-5174 | High | 7.8 | 2020-03-11 | An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). A specially crafte… |
CVE-2019-5173 | High | 7.8 | 2020-03-11 | An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). A special… |
CVE-2019-5172 | High | 7.8 | 2020-03-11 | An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). An attack… |
CVE-2019-5168 | High | 7.8 | 2020-03-11 | An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). An attacker can se… |
CVE-2019-5167 | High | 7.8 | 2020-03-11 | An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). At 0x1e3f0 the ext… |
CVE-2019-5157 | High | 7.2 | 2020-03-11 | An exploitable command injection vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02.02(14), 03.01.07(13), and… |
CVE-2019-5156 | High | 7.2 | 2020-03-11 | An exploitable command injection vulnerability exists in the cloud connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.01.07(13), and 03.00.39(… |
CVE-2019-5155 | High | 7.2 | 2020-03-11 | An exploitable command injection vulnerability exists in the cloud connectivity feature of WAGO PFC200. An attacker can inject operating system commands into a… |
CVE-2019-10807 | Critical | 9.8 | 2020-03-11 | Blamer versions prior to 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of the arguments provided to blamer. |
CVE-2020-1980 | High | 7.8 | 2020-03-11 | A shell command injection vulnerability in the PAN-OS CLI allows a local authenticated user to escape the restricted shell and escalate privileges. This issue… |
CVE-2019-9859 | High | 8.8 | 2020-03-10 | Vesta Control Panel (VestaCP) 0.9.7 through 0.9.8-23 is vulnerable to an authenticated command execution that can result in remote root access on the server. T… |
CVE-2020-10250 | Critical | 9.8 | 2020-03-09 | BWA DiREX-Pro 1.2181 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the PKG parameter to uninstall.php3. |
CVE-2020-2159 | High | 8.8 | 2020-03-09 | Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins master as the OS user a… |
CVE-2020-10235 | High | 8.8 | 2020-03-09 | An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database… |
CVE-2019-20504 | Critical | 9.8 | 2020-03-09 | service/krashrpt.php in Quest KACE K1000 Systems Management Appliance before 6.4 SP3 (6.4.120822) allows a remote attacker to execute code via shell metacharac… |
CVE-2016-11021 | High | 7.2 | 2020-03-09 | setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter. |
CVE-2020-10221 | High | 8.8 | 2020-03-08 | lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName… |
CVE-2020-10216 | High | 8.8 | 2020-03-07 | An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the date parameter in a system_time… |
CVE-2020-10215 | High | 8.8 | 2020-03-07 | An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the dns_query_name parameter in a d… |
CVE-2020-10213 | High | 8.8 | 2020-03-07 | An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the wps_sta_enrollee_pin parameter… |
CVE-2019-17642 | High | 8.8 | 2020-03-05 | An issue was discovered in Centreon before 18.10.8, 19.10.1, and 19.04.2. It allows CSRF with resultant remote command execution via shell metacharacters in a… |
CVE-2020-10173 | High | 8.8 | 2020-03-05 | Comtrend VR-3033 DE11-416SSG-C01_R02.A2pvI042j1.d26m devices have Multiple Authenticated Command Injection vulnerabilities via the ping and traceroute diagnost… |
CVE-2019-20501 | High | 7.8 | 2020-03-05 | D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Upgrade Firmware functionality in the Web interface… |
CVE-2019-20500 | High | 7.8 | 2020-03-05 | D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface… |
CVE-2019-20499 | High | 7.8 | 2020-03-05 | D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Configuration functionality in the Web interf… |
CVE-2020-9054 | Critical | 9.8 | 2020-03-04 | Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may all… |
CVE-2020-3176 | Medium | 6.7 | 2020-03-04 | A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affect… |
CVE-2020-5535 | High | 8.8 | 2020-03-04 | OpenBlocks IoT VX2 prior to Ver.4.0.0 (Ver.3 Series) allows an attacker on the same network segment to execute arbitrary OS commands with root privileges via u… |
CVE-2020-1734 | High | 7.4 | 2020-03-03 | A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by o… |
CVE-2019-20488 | Critical | 9.8 | 2020-03-02 | An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the web management interface (setup.cgi) are vulnerable to command injec… |
CVE-2019-10804 | Critical | 9.8 | 2020-02-28 | serial-number through 1.3.0 allows execution of arbritary commands. The "cmdPrefix" argument in serialNumber function is used by the "exec" function without an… |
CVE-2019-10803 | Critical | 9.8 | 2020-02-28 | push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable "opt.branch" is not validated before being provided t… |
CVE-2019-10802 | Critical | 9.8 | 2020-02-28 | giting version prior to 0.0.8 allows execution of arbritary commands. The first argument "repo" of function "pull()" is executed by the package without any val… |
CVE-2019-10801 | Critical | 9.8 | 2020-02-28 | enpeem through 2.2.0 allows execution of arbitrary commands. The "options.dir" argument is provided to the "exec" function without any sanitization. |
CVE-2019-15609 | Critical | 9.8 | 2020-02-28 | The kill-port-process package version < 2.2.0 is vulnerable to a Command Injection vulnerability. |
CVE-2020-9463 | High | 8.8 | 2020-02-28 | Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the server_ip field in JSON data in an api/intern… |
CVE-2020-3173 | High | 7.8 | 2020-02-26 | A vulnerability in the local management (local-mgmt) CLI of Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary comman… |
CVE-2020-3171 | High | 7.8 | 2020-02-26 | A vulnerability in the local management (local-mgmt) CLI of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker to… |
CVE-2020-3169 | Medium | 6.7 | 2020-02-26 | A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating… |
CVE-2020-3167 | High | 7.8 | 2020-02-26 | A vulnerability in the CLI of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on… |
CVE-2019-19994 | Critical | 9.8 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows blind Command Injection. An attacker without authentication is ab… |
CVE-2019-3999 | High | 7.8 | 2020-02-25 | Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, unauthenticated attacker to execute arbi… |
CVE-2019-5142 | High | 7.2 | 2020-02-25 | An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted entry to n… |
CVE-2019-5141 | High | 8.8 | 2020-02-25 | An exploitable command injection vulnerability exists in the iw_webs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted iw_serverip… |
CVE-2019-5140 | High | 8.8 | 2020-02-25 | An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted diagnostic s… |
CVE-2019-5138 | Critical | 9.9 | 2020-02-25 | An exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131A firmware version 1.13. A specially cra… |
CVE-2020-9374 | Critical | 9.8 | 2020-02-24 | On TP-Link TL-WR849N 0.9.1 4.16 devices, a remote command execution vulnerability in the diagnostics area can be exploited when an attacker sends specific shel… |
CVE-2019-12511 | Critical | 9.8 | 2020-02-24 | In NETGEAR Nighthawk X10-R9000 prior to 1.0.4.26, an attacker may execute arbitrary system commands as root by sending a specially-crafted MAC address to the "… |
CVE-2019-10799 | High | 8.2 | 2020-02-24 | compile-sass prior to 1.0.5 allows execution of arbritary commands. The function "setupCleanupOnExit(cssPath)" within "dist/index.js" is executed as part of th… |
CVE-2019-10796 | Critical | 9.8 | 2020-02-24 | rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of e… |
CVE-2020-4222 | Critical | 9.8 | 2020-02-24 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, a… |
CVE-2020-4213 | Critical | 9.8 | 2020-02-24 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, a… |
CVE-2020-4211 | Critical | 9.8 | 2020-02-24 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, a… |
CVE-2020-4210 | Critical | 9.8 | 2020-02-24 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, a… |
CVE-2020-8130 | Medium | 6.4 | 2020-02-24 | There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`. |
CVE-2019-18183 | Critical | 9.8 | 2020-02-24 | pacman before 5.2 is vulnerable to arbitrary command injection in lib/libalpm/sync.c in the apply_deltas() function. This can be exploited when unsigned databa… |
CVE-2019-18182 | Critical | 9.8 | 2020-02-24 | pacman before 5.2 is vulnerable to arbitrary command injection in conf.c in the download_with_xfercommand() function. This can be exploited when unsigned datab… |
CVE-2020-8813 | High | 8.8 | 2020-02-22 | graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph… |