CWE-78 · OS Command Injection (page 58)
Page 58 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-0629 | High | 7.2 | 2019-01-09 | Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response. |
CVE-2018-0628 | High | 7.2 | 2019-01-09 | Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response. |
CVE-2018-0627 | High | 7.2 | 2019-01-09 | Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter. |
CVE-2018-0626 | High | 7.2 | 2019-01-09 | Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd in formWsc parameter. |
CVE-2018-0625 | High | 7.2 | 2019-01-09 | Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via formSysCmd parameter. |
CVE-2018-20114 | Critical | 9.8 | 2019-01-02 | On D-Link DIR-818LW Rev.A 2.05.B03 and DIR-860L Rev.B 2.03.B03 devices, unauthenticated remote OS command execution can occur in the soap.cgi service of the cg… |
CVE-2018-6342 | Critical | 9.8 | 2018-12-31 | react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor. The input to tha… |
CVE-2018-18600 | High | 8.1 | 2018-12-31 | The remote upgrade feature in Guardzilla GZ180 devices allow command injection via a crafted new firmware version parameter. |
CVE-2018-15007 | High | 7.8 | 2018-12-28 | The Sky Elite 6.0L+ Android device with a build fingerprint of SKY/x6069_trx_l601_sky/x6069_trx_l601_sky:6.0/MRA58K/1482897127:user/release-keys contains a pre… |
CVE-2018-14998 | Medium | 6.8 | 2018-12-28 | The Leagoo P1 Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a hidden root pri… |
CVE-2018-19239 | High | 7.2 | 2018-12-20 | TRENDnet TEW-673GRU v1.00b40 devices have an OS command injection vulnerability in the start_arpping function of the timer binary, which allows remote attacker… |
CVE-2018-15722 | High | 8.1 | 2018-12-20 | The Logitech Harmony Hub before version 4.15.206 is vulnerable to OS command injection via the time update request. A remote server or man in the middle can in… |
CVE-2018-1000885 | Critical | 9.8 | 2018-12-20 | PHKP version including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b contains a Improper Neutralization of Special Elements used in a Command ('Command Injec… |
CVE-2018-18555 | Critical | 9.9 | 2018-12-17 | A sandbox escape issue was discovered in VyOS 1.1.8. It provides a restricted management shell for operator users to administer the device. By issuing various… |
CVE-2018-19007 | Critical | 9.8 | 2018-12-14 | In Geutebrueck GmbH E2 Camera Series versions prior to 1.12.0.25 the DDNS configuration (in the Network Configuration panel) is vulnerable to an OS system comm… |
CVE-2018-20057 | High | 8.8 | 2018-12-11 | An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to e… |
CVE-2018-19660 | High | 8.8 | 2018-12-06 | An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Buil… |
CVE-2018-19659 | High | 8.8 | 2018-12-06 | An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Buil… |
CVE-2018-19908 | High | 8.8 | 2018-12-06 | An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped filename string is used to construct a shel… |
CVE-2018-19907 | High | 8.8 | 2018-12-06 | A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a… |
CVE-2018-12317 | High | 8.8 | 2018-12-04 | OS command injection in group.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root by modifying the "name" POST parameter. |
CVE-2018-12316 | High | 8.8 | 2018-12-04 | OS Command Injection in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands by modifying the filename POST parameter. |
CVE-2018-12313 | Critical | 9.8 | 2018-12-04 | OS command injection in snmp.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands without authentication via the "rocommunity" URL para… |
CVE-2018-12312 | High | 8.8 | 2018-12-04 | OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "secret_key" URL parameter. |
CVE-2018-12307 | High | 8.8 | 2018-12-04 | OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "name" POST parameter. |
CVE-2018-4021 | High | 7.2 | 2018-12-03 | An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The atta… |
CVE-2018-4020 | High | 7.2 | 2018-12-03 | An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The atta… |
CVE-2018-4019 | High | 7.2 | 2018-12-03 | An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The atta… |
CVE-2018-14706 | Critical | 9.8 | 2018-12-03 | System command injection in the /DroboPix/api/drobopix/demo endpoint on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute sys… |
CVE-2018-14701 | Critical | 9.8 | 2018-12-03 | System command injection in the /DroboAccess/delete_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system… |
CVE-2018-14699 | Critical | 9.8 | 2018-12-03 | System command injection in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system… |
CVE-2018-16863 | High | 7.3 | 2018-12-03 | It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass the -dSAFER protec… |
CVE-2018-15716 | High | 8.8 | 2018-11-30 | NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection. An attacker can send crafted requests to upgrade_handle.php to execute OS… |
CVE-2018-19290 | Critical | 9.8 | 2018-11-30 | In modules/HELPBOT_MODULE in Budabot 0.6 through 4.0, lax syntax validation allows remote attackers to perform a command injection attack against the PHP daemo… |
CVE-2018-19646 | Critical | 9.8 | 2018-11-28 | The Python CGI scripts in PWS in Imperva SecureSphere 13.0.10, 13.1.10, and 13.2.10 allow remote attackers to execute arbitrary OS commands because command-lin… |
CVE-2018-13418 | High | 8.8 | 2018-11-27 | System command injection in ajaxdata.php in TerraMaster TOS 3.1.03 allows attackers to execute system commands via the "newname" parameter. |
CVE-2018-13358 | High | 8.8 | 2018-11-27 | System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "checkName" parameter. |
CVE-2018-13354 | Critical | 9.8 | 2018-11-27 | System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" parameter. |
CVE-2018-13353 | High | 8.8 | 2018-11-27 | System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute commands via the "checkport" parameter. |
CVE-2018-13338 | Critical | 9.8 | 2018-11-27 | System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username" parameter during user… |
CVE-2018-13336 | Critical | 9.8 | 2018-11-27 | System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "pwd" parameter during user crea… |
CVE-2018-13330 | High | 7.2 | 2018-11-27 | System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands during group creation via the "groupname… |
CVE-2018-16130 | High | 8.8 | 2018-11-27 | System command injection in request_mitv in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary system commands via the "payload" URL para… |
CVE-2018-14893 | High | 8.8 | 2018-11-27 | A system command injection vulnerability in zyshclient in ZyXEL NSA325 V2 version 4.81 allows attackers to execute system commands via the web application API. |
CVE-2018-13316 | Critical | 9.8 | 2018-11-27 | System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "subnet" POST parameter. |
CVE-2018-13314 | Critical | 9.8 | 2018-11-27 | System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ipAddr" POST parameter. |
CVE-2018-13307 | Critical | 9.8 | 2018-11-27 | System command injection in fromNtp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ntpServerIp2" POST parameter. Certai… |
CVE-2018-13306 | Critical | 9.8 | 2018-11-27 | System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ftpUser" POST parameter. |
CVE-2018-13023 | High | 8.8 | 2018-11-27 | System command injection vulnerability in wifi_access in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute system commands via the "timeout" URL p… |
CVE-2018-16090 | High | 7.5 | 2018-11-27 | In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection. |
CVE-2018-16089 | High | 7.5 | 2018-11-27 | In System Management Module (SMM) versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authen… |
CVE-2018-13320 | High | 7.2 | 2018-11-26 | System Command Injection in network.set_auth_settings in Buffalo TS5600D1206 version 3.70-0.10 allows attackers to execute system commands via the adminUsernam… |
CVE-2018-13318 | High | 7.2 | 2018-11-26 | System command injection in User.create method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute system commands via the "name" parameter. |
CVE-2018-13311 | Critical | 9.8 | 2018-11-26 | System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "sambaUser" POST parameter. |
CVE-2018-11077 | Medium | 6.7 | 2018-11-26 | 'getlogs' utility in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1 and 18.1 and Dell EMC Integrated Data Protection Ap… |
CVE-2018-18859 | High | 7.8 | 2018-11-20 | Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS. An attacker can communicate with an un… |
CVE-2018-18858 | High | 7.8 | 2018-11-20 | Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS. An attacker can communicate with an un… |
CVE-2018-18857 | High | 7.8 | 2018-11-20 | Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS. An attacker can communicate with an un… |
CVE-2018-18856 | High | 7.8 | 2018-11-20 | Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS. An attacker can communicate with an un… |
CVE-2018-9086 | High | 7.2 | 2018-11-16 | In some Lenovo ThinkServer-branded servers, a command injection vulnerability exists in the BMC firmware download command. This allows a privileged user to dow… |
CVE-2018-0694 | Critical | 9.8 | 2018-11-15 | FileZen V3.0.0 to V4.2.1 allows remote attackers to execute arbitrary OS commands via unspecified vectors. |
CVE-2018-15711 | High | 8.8 | 2018-11-14 | Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. The attacker can then use the new API key t… |
CVE-2018-15710 | High | 7.8 | 2018-11-14 | Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php. |
CVE-2018-15709 | High | 8.8 | 2018-11-14 | Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request. |
CVE-2018-19168 | Critical | 9.8 | 2018-11-11 | Shell Metacharacter Injection in www/modules/save.php in FruityWifi (aka PatatasFritas/PatataWifi) through 2.4 allows remote attackers to execute arbitrary cod… |
CVE-2018-19081 | Critical | 9.8 | 2018-11-07 | An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetDNS method allo… |
CVE-2018-19073 | High | 7.2 | 2018-11-07 | An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5… |
CVE-2018-19070 | High | 7.2 | 2018-11-07 | An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5… |
CVE-2018-3890 | Medium | 6.8 | 2018-11-02 | An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted file can cause a l… |
CVE-2018-10587 | High | 7.2 | 2018-11-01 | NetGain Enterprise Manager (EM) is affected by OS Command Injection vulnerabilities in versions before 10.0.57. These vulnerabilities could allow remote authen… |
CVE-2018-3910 | High | 8.0 | 2018-11-01 | An exploitable code execution vulnerability exists in the cloud OTA setup functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted SSID can cause a c… |
CVE-2018-16462 | Critical | 10.0 | 2018-10-30 | A command injection vulnerability in the apex-publish-static-files npm module version <2.0.1 which allows arbitrary shell command execution through a malicious… |
CVE-2018-16461 | Critical | 9.8 | 2018-10-30 | A command injection vulnerability in libnmapp package for versions <0.4.16 allows arbitrary commands to be executed via arguments to the range options. |
CVE-2018-14558 | Critical | 9.8 | 2018-10-30 | An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10… |
CVE-2018-18728 | Critical | 9.8 | 2018-10-29 | An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. They allow remote code execution via… |
CVE-2018-18638 | High | 8.1 | 2018-10-24 | A command injection vulnerability in the setup API in the Neato Botvac Connected 2.2.0 allows network attackers to execute arbitrary commands via shell metacha… |
CVE-2018-15442 | High | 7.8 | 2018-10-24 | A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to execute arbitrary command… |
CVE-2018-12670 | Critical | 9.8 | 2018-10-19 | SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B devices allow OS Command Injection. |
CVE-2018-16232 | High | 8.8 | 2018-10-17 | An authenticated command injection vulnerability exists in IPFire Firewall before 2.21 Core Update 124 in backup.cgi. This allows an authenticated user with pr… |
CVE-2018-10823 | High | 8.8 | 2018-10-17 | An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 thr… |
CVE-2018-3955 | High | 7.2 | 2018-10-17 | An exploitable operating system command injection exists in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmwa… |
CVE-2018-3954 | High | 7.2 | 2018-10-17 | Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04) are susceptible to OS command… |
CVE-2018-3953 | High | 7.2 | 2018-10-17 | Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04) are susceptible to OS command… |
CVE-2018-14772 | High | 7.2 | 2018-10-16 | Pydio 4.2.1 through 8.2.1 has an authenticated remote code execution vulnerability in which an attacker with administrator access to the web application can ex… |
CVE-2018-17532 | Critical | 9.8 | 2018-10-15 | Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspot… |
CVE-2018-18322 | Critical | 9.8 | 2018-10-15 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php service_start, service_restart… |
CVE-2018-15368 | Medium | 6.7 | 2018-10-05 | A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Linux shell of an affe… |
CVE-2018-0481 | Medium | 6.7 | 2018-10-05 | A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an… |
CVE-2018-0477 | Medium | 6.7 | 2018-10-05 | A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an… |
CVE-2018-0453 | High | 8.2 | 2018-10-05 | A vulnerability in the Sourcefire tunnel control channel protocol in Cisco Firepower System Software running on Cisco Firepower Threat Defense (FTD) sensors co… |
CVE-2018-0433 | High | 7.8 | 2018-10-05 | A vulnerability in the command-line interface (CLI) in the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary commands that… |
CVE-2018-0432 | High | 8.8 | 2018-10-05 | A vulnerability in the error reporting feature of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to gain elevated privileges on an aff… |
CVE-2018-0424 | High | 8.8 | 2018-10-05 | A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco… |
CVE-2018-17787 | Critical | 9.8 | 2018-10-02 | On D-Link DIR-823G devices, the GoAhead configuration allows /HNAP1 Command Injection via shell metacharacters in the POST data, because this data is sent dire… |
CVE-2018-17867 | High | 7.2 | 2018-10-01 | The Port Forwarding functionality on DASAN H660GW devices allows remote attackers to execute arbitrary code via shell metacharacters in the cgi-bin/adv_nat_vir… |
CVE-2018-9077 | High | 8.1 | 2018-09-28 | For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when changing the name of a share, an attacker can craft a command injection… |
CVE-2018-9076 | High | 8.1 | 2018-09-28 | For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when changing the name of a share, an attacker can craft a command injection… |
CVE-2018-9075 | High | 8.1 | 2018-09-28 | For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when joining a PersonalCloud setup, an attacker can craft a command injectio… |
CVE-2018-16055 | High | 8.8 | 2018-09-26 | An authenticated command injection vulnerability exists in status_interfaces.php via dhcp_relinquish_lease() in pfSense before 2.4.4 due to its passing user in… |
CVE-2018-17317 | Critical | 9.8 | 2018-09-21 | FruityWifi (aka PatatasFritas/PatataWifi) 2.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the io_mode, ap_mode, io_action… |