CWE-78 · OS Command Injection (page 57)
Page 57 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-3925 | Critical | 9.8 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to command injection via SNMP OID iso.3.6.1.4.1.3212.100.3.2.9.3. A remot… |
CVE-2019-9804 | Critical | 9.8 | 2019-04-26 | In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause the execution of unint… |
CVE-2019-11539 | High | 7.2 | 2019-04-26 | In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secu… |
CVE-2018-16660 | High | 8.8 | 2019-04-25 | A command injection vulnerability in PWS in Imperva SecureSphere 13.0.0.10 and 13.1.0.10 Gateway allows an attacker with authenticated access to execute arbitr… |
CVE-2018-16216 | High | 8.0 | 2019-04-25 | A command injection (missing input validation, escaping) in the monitoring or memory status web interface in AudioCodes 405HD (firmware 2.2.12) VoIP phone allo… |
CVE-2018-20434 | Critical | 9.8 | 2019-04-24 | LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to html/pages/addhost.inc.php during creation… |
CVE-2019-11444 | High | 7.2 | 2019-04-22 | An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. Commands can be executed vi… |
CVE-2019-9161 | Critical | 9.8 | 2019-04-18 | WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a Remote Code Execution issue allowing remote attackers to achieve full access to th… |
CVE-2019-11322 | Critical | 9.8 | 2019-04-18 | An issue was discovered in Motorola CX2 1.01 and M2 1.01. There is a command injection in the function startRmtAssist in hnap, which leads to remote code execu… |
CVE-2019-11319 | Critical | 9.8 | 2019-04-18 | An issue was discovered in Motorola CX2 1.01 and M2 1.01. There is a command injection in the function downloadFirmware in hnap, which leads to remote code exe… |
CVE-2019-1829 | Medium | 6.7 | 2019-04-18 | A vulnerability in the CLI of Cisco Aironet Series Access Points (APs) could allow an authenticated, local attacker to gain access to the underlying Linux oper… |
CVE-2019-1725 | Medium | 5.5 | 2019-04-18 | A vulnerability in the local management CLI implementation for specific commands on the Cisco UCS B-Series Blade Servers could allow an authenticated, local at… |
CVE-2019-4202 | Critical | 10.0 | 2019-04-15 | IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can run arbitrary code on… |
CVE-2019-0232 | High | 8.1 | 2019-04-15 | When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulner… |
CVE-2019-10880 | Critical | 9.8 | 2019-04-12 | Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "HTTP" request (OS C… |
CVE-2019-3914 | High | 7.2 | 2019-04-11 | Remote command injection vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows a remote, authenticated attacker to execute… |
CVE-2019-5425 | High | 8.8 | 2019-04-10 | In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an authenticated user can execute arbitrary shell commands over the SSH interface bypassing the CLI interfa… |
CVE-2019-5424 | High | 8.8 | 2019-04-10 | In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, a privileged user can execute arbitrary shell commands over the SSH CLI interface. This allows to execute s… |
CVE-2019-10631 | High | 8.8 | 2019-04-09 | Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via m… |
CVE-2019-11001 | High | 7.2 | 2019-04-08 | On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and… |
CVE-2019-6552 | Critical | 9.8 | 2019-04-05 | Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple command injection vulnerabilities, caused by a lack of proper validation of user-supplied data, m… |
CVE-2019-9193 | High | 7.2 | 2019-04-01 | In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary c… |
CVE-2018-17990 | High | 8.8 | 2019-04-01 | An issue was discovered on D-Link DSL-3782 devices with firmware 1.01. An OS command injection vulnerability in Acl.asp allows a remote authenticated attacker… |
CVE-2018-17565 | Critical | 9.8 | 2019-04-01 | Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system comm… |
CVE-2018-5757 | High | 8.8 | 2019-04-01 | An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality, which uses a parameter in a re… |
CVE-2018-13285 | High | 7.5 | 2019-04-01 | Command injection vulnerability in ftpd in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to execute arbitrary OS commands… |
CVE-2018-13284 | High | 7.5 | 2019-04-01 | Command injection vulnerability in ftpd in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS comm… |
CVE-2019-10662 | High | 8.8 | 2019-03-30 | Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-ba… |
CVE-2019-10660 | High | 8.8 | 2019-03-30 | Grandstream GXV3611IR_HD before 1.0.3.23 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the /goform/systemlog?c… |
CVE-2019-10659 | High | 8.8 | 2019-03-30 | Grandstream GXV3370 before 1.0.1.41 and WP820 before 1.0.3.6 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in a /… |
CVE-2019-10658 | High | 8.8 | 2019-03-30 | Grandstream GWN7610 before 1.0.8.18 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/cont… |
CVE-2019-10657 | Medium | 6.5 | 2019-03-30 | Grandstream GWN7000 before 1.0.6.32 and GWN7610 before 1.0.8.18 devices allow remote authenticated users to discover passwords via a /ubus/uci.apply config req… |
CVE-2019-10656 | High | 8.8 | 2019-03-30 | Grandstream GWN7000 before 1.0.6.32 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/uci… |
CVE-2019-10655 | Critical | 9.8 | 2019-03-30 | Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0.3.219 Beta devices allow unauthenticate… |
CVE-2019-1745 | High | 7.8 | 2019-03-28 | A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with elevated privileges… |
CVE-2019-10061 | Critical | 9.8 | 2019-03-26 | utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowi… |
CVE-2018-3969 | High | 7.8 | 2019-03-21 | An exploitable vulnerability exists in the verified boot protection of the CUJO Smart Firewall. It is possible to add arbitrary shell commands into the dhcpd.c… |
CVE-2019-7385 | High | 7.8 | 2019-03-21 | An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware… |
CVE-2019-7384 | High | 7.8 | 2019-03-21 | An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware… |
CVE-2019-7383 | High | 7.8 | 2019-03-21 | An issue was discovered on Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W devices with firmware V1.1-R2.1_TRUNK-20181105.bin. A shell command injection occu… |
CVE-2019-5414 | High | 8.1 | 2019-03-21 | If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of the exec function in… |
CVE-2018-20323 | High | 8.8 | 2019-03-21 | www/soap/application/MCSoap/Logs.php in MailCleaner Community Edition 2018.08 allows remote attackers to execute arbitrary OS commands. |
CVE-2018-20218 | Critical | 9.8 | 2019-03-21 | An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input directly to a shell command without any kind… |
CVE-2018-20106 | Medium | 6.5 | 2019-03-15 | In yast2-printer up to and including version 4.0.2 the SMB printer settings don't escape characters in passwords properly. If a password with backticks or siml… |
CVE-2019-9785 | High | 7.8 | 2019-03-14 | gitnote 3.1.0 allows remote attackers to execute arbitrary code via a crafted Markdown file, as demonstrated by a javascript:window.parent.top.require('child_p… |
CVE-2018-1998 | High | 8.8 | 2019-03-11 | IBM WebSphere MQ 8.0.0.0 through 9.1.1 could allow a local user to inject code that could be executed with root privileges. This is due to an incomplete fix fo… |
CVE-2019-1614 | High | 8.8 | 2019-03-11 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges… |
CVE-2019-1612 | Medium | 4.2 | 2019-03-11 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-9121 | Critical | 9.8 | 2019-03-07 | An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to… |
CVE-2019-9120 | Critical | 9.8 | 2019-03-07 | An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to… |
CVE-2019-9119 | Critical | 9.8 | 2019-03-07 | An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to… |
CVE-2019-9118 | Critical | 9.8 | 2019-03-07 | An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to… |
CVE-2019-9117 | Critical | 9.8 | 2019-03-07 | An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to… |
CVE-2019-1591 | High | 7.8 | 2019-03-06 | A vulnerability in a specific CLI command implementation of Cisco Nexus 9000 Series ACI Mode Switch Software could allow an authenticated, local attacker to es… |
CVE-2019-3920 | High | 8.8 | 2019-03-05 | The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to authenticated command injection via crafted HTTP request sent by a… |
CVE-2019-3919 | High | 8.8 | 2019-03-05 | The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to command injection via crafted HTTP request sent by a remote, authen… |
CVE-2018-19639 | Medium | 6.7 | 2019-03-05 | If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipulate the rpm listing (e.g. with CVE-2018-… |
CVE-2019-1674 | High | 7.8 | 2019-02-28 | A vulnerability in the update service of Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools for Windows could allow an authenticated, local at… |
CVE-2019-9194 | Critical | 9.8 | 2019-02-26 | elFinder before 2.1.48 has a command injection vulnerability in the PHP connector. |
CVE-2018-20122 | Critical | 9.8 | 2019-02-21 | The web interface on FASTGate Fastweb devices with firmware through 0.00.47_FW_200_Askey 2017-05-17 (software through 1.0.1b) exposed a CGI binary that is vuln… |
CVE-2018-15380 | High | 8.8 | 2019-02-20 | A vulnerability in the cluster service manager of Cisco HyperFlex Software could allow an unauthenticated, adjacent attacker to execute commands as the root us… |
CVE-2019-8427 | Critical | 9.8 | 2019-02-18 | daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters. |
CVE-2019-8319 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-8318 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-8317 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-8316 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-8315 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-8314 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-8313 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-8312 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-5736 | High | 8.6 | 2019-02-11 | runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host roo… |
CVE-2019-7632 | High | 8.8 | 2019-02-08 | LifeSize Team, Room, Passport, and Networker 220 devices allow Authenticated Remote OS Command Injection, as demonstrated by shell metacharacters in the suppor… |
CVE-2019-3704 | High | 7.8 | 2019-02-07 | VNX Control Station in Dell EMC VNX2 OE for File versions prior to 8.1.9.236 contains OS command injection vulnerability. Due to inadequate restriction configu… |
CVE-2019-7301 | High | 7.2 | 2019-02-01 | Zen Load Balancer 3.10.1 allows remote authenticated admin users to execute arbitrary commands as root via shell metacharacters in the index.cgi?action=View_Ce… |
CVE-2019-7298 | High | 8.1 | 2019-02-01 | An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS co… |
CVE-2019-7297 | Critical | 9.8 | 2019-01-31 | An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS co… |
CVE-2019-3913 | Medium | 4.9 | 2019-01-30 | Command manipulation in LabKey Server Community Edition before 18.3.0-61806.763 allows an authenticated remote attacker to unmount any drive on the system lead… |
CVE-2018-19015 | High | 7.3 | 2019-01-28 | An attacker could inject commands to launch programs and create, write, and read files on CX-Supervisor (Versions 3.42 and prior) through a specially crafted p… |
CVE-2018-12237 | High | 7.2 | 2019-01-24 | The Symantec Reporter CLI 10.1 prior to 10.1.5.6 and 10.2 prior to 10.2.1.8 is susceptible to an OS command injection vulnerability. An authenticated malicious… |
CVE-2019-1652 | High | 7.2 | 2019-01-24 | A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote… |
CVE-2019-1650 | High | 8.8 | 2019-01-24 | A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to overwrite arbitrary files on the underlying operating system of a… |
CVE-2018-17707 | High | 8.8 | 2019-01-24 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Epic Games Launcher versions prior to 8.2.2. User interacti… |
CVE-2019-1636 | High | 7.8 | 2019-01-23 | A vulnerability in the Cisco Webex Teams client, formerly Cisco Spark, could allow an attacker to execute arbitrary commands on a targeted system. This vulnera… |
CVE-2018-6444 | Critical | 9.8 | 2019-01-22 | A Vulnerability in Brocade Network Advisor versions before 14.1.0 could allow a remote unauthenticated attacker to execute arbitray code. The vulnerability cou… |
CVE-2019-6487 | High | 8.8 | 2019-01-18 | TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, beca… |
CVE-2018-20727 | High | 8.8 | 2019-01-17 | Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Tr… |
CVE-2018-16200 | High | 8.8 | 2019-01-09 | Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an attacker on the same network segment to execute ar… |
CVE-2018-16195 | High | 8.8 | 2019-01-09 | Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows an attacker on the same n… |
CVE-2018-16194 | High | 7.2 | 2019-01-09 | Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows authenticated attackers t… |
CVE-2018-16184 | Critical | 9.8 | 2019-01-09 | RICOH Interactive Whiteboard D2200 V1.6 to V2.2, D5500 V1.6 to V2.2, D5510 V1.6 to V2.2, and the display versions with RICOH Interactive Whiteboard Controller… |
CVE-2018-16167 | Critical | 9.8 | 2019-01-09 | LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors. |
CVE-2018-0677 | Medium | 6.8 | 2019-01-09 | BN-SDWBP3 firmware version 1.0.9 and earlier allows attacker with administrator rights on the same network segment to execute arbitrary OS commands via unspeci… |
CVE-2018-0639 | High | 7.2 | 2019-01-09 | Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via tools_firmware.cgi date parameter, time param… |
CVE-2018-0638 | High | 7.2 | 2019-01-09 | Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via import.cgi encKey parameter. |
CVE-2018-0637 | High | 7.2 | 2019-01-09 | Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via export.cgi encKey parameter. |
CVE-2018-0636 | High | 7.2 | 2019-01-09 | Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter of a certain URL, d… |
CVE-2018-0635 | High | 7.2 | 2019-01-09 | Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via filename parameter. |
CVE-2018-0634 | High | 7.2 | 2019-01-09 | Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter or bootmode paramet… |
CVE-2018-0631 | High | 7.2 | 2019-01-09 | Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter. |
CVE-2018-0630 | High | 7.2 | 2019-01-09 | Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd parameter. |