CWE-78 · OS Command Injection (page 58)
Page 58 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-6842 | High | 7.2 | 2020-02-21 | D-Link DCH-M225 1.05b01 and earlier devices allow remote authenticated admins to execute arbitrary OS commands via shell metacharacters in the media renderer n… |
CVE-2020-6841 | Critical | 9.8 | 2020-02-21 | D-Link DCH-M225 1.05b01 and earlier devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the spotifyConnect.php userName… |
CVE-2020-5534 | High | 8.0 | 2020-02-21 | Aterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges… |
CVE-2020-5525 | High | 8.0 | 2020-02-21 | Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows a… |
CVE-2020-5524 | High | 8.8 | 2020-02-21 | Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows a… |
CVE-2014-2727 | Critical | 9.8 | 2020-02-19 | The STARTTLS implementation in MailMarshal before 7.2 allows plaintext command injection. |
CVE-2019-10791 | Critical | 9.8 | 2020-02-18 | promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be controlled by user… |
CVE-2014-4981 | Critical | 9.8 | 2020-02-17 | LPAR2RRD in 3.5 and earlier allows remote attackers to execute arbitrary commands due to insufficient input sanitization of the web GUI parameters. |
CVE-2020-7597 | High | 8.8 | 2020-02-17 | codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by… |
CVE-2020-9027 | Critical | 9.8 | 2020-02-17 | ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the TRACE field of the resource ping.cmd. The NTP-2 device is also affected. |
CVE-2020-9026 | Critical | 9.8 | 2020-02-17 | ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the PING field of the resource ping.cmd. The NTP-2 device is also affected. |
CVE-2020-9021 | Critical | 9.8 | 2020-02-17 | Post Oak AWAM Bluetooth Field Device 7400v2.08.21.2018, 7800SD.2015.1.16, 2011.3, 7400v2.02.01.2019, and 7800SD.2012.12.5 is vulnerable to injections of operat… |
CVE-2020-9020 | Critical | 9.8 | 2020-02-17 | Iteris Vantage Velocity Field Unit 2.3.1, 2.4.2, and 3.0 devices allow the injection of OS commands into cgi-bin/timeconfig.py via shell metacharacters in the… |
CVE-2020-8858 | High | 8.8 | 2020-02-14 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication i… |
CVE-2020-8963 | Critical | 9.8 | 2020-02-13 | TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003, and T550… |
CVE-2020-8949 | High | 8.8 | 2020-02-12 | Gocloud S2A_WL 4.2.7.16471, S2A 4.2.7.17278, S2A 4.3.0.15815, S2A 4.3.0.17193, S3A K2P MTK 4.2.7.16528, S3A 4.3.0.16572, and ISP3000 4.3.0.17190 devices allows… |
CVE-2020-8947 | High | 7.2 | 2020-02-12 | functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/ne… |
CVE-2020-8946 | High | 8.8 | 2020-02-12 | Netis WF2471 v1.2.30142 devices allow an authenticated attacker to execute arbitrary OS commands via shell metacharacters in the /cgi-bin-igd/sys_log_clean.cgi… |
CVE-2020-8429 | High | 8.8 | 2020-02-11 | The Admin web application in Kinetica 7.0.9.2.20191118151947 does not properly sanitise the input for the function getLogs. This lack of sanitisation could be… |
CVE-2013-0517 | High | 7.8 | 2020-02-11 | A Command Execution Vulnerability exists in IBM Sterling External Authentication Server 2.2.0, 2.3.01, 2.4.0, and 2.4.1 via an unspecified OS command, which co… |
CVE-2019-14514 | Critical | 9.8 | 2020-02-11 | An issue was discovered in Microvirt MEmu all versions prior to 7.0.2. A guest Android operating system inside the MEmu emulator contains a /system/bin/systemd… |
CVE-2013-4267 | Critical | 9.8 | 2020-02-11 | Ajaxeplorer before 5.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) archive_name parameter to the Power FS modul… |
CVE-2019-19356 | High | 7.5 | 2020-02-07 | Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been found in fir… |
CVE-2020-8126 | High | 7.8 | 2020-02-07 | A privilege escalation in the EdgeSwitch prior to version 1.7.1, an CGI script don't fully sanitize the user input resulting in local commands execution, allow… |
CVE-2020-8654 | High | 8.8 | 2020-02-07 | An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS com… |
CVE-2020-6760 | Critical | 9.8 | 2020-02-06 | Schmid ZI 620 V400 VPN 090 routers allow an attacker to execute OS commands as root via shell metacharacters to an entry on the SSH subcommand menu, as demonst… |
CVE-2019-10789 | Critical | 9.8 | 2020-02-06 | All versions of curling.js are vulnerable to Command Injection via the run function. The command argument can be controlled by users without any sanitization. |
CVE-2019-10788 | Critical | 9.8 | 2020-02-04 | im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument. It is possible to inject arbitrary commands as part of… |
CVE-2019-10787 | Critical | 9.8 | 2020-02-04 | im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js, can be controlled… |
CVE-2019-10786 | Critical | 9.8 | 2020-02-04 | network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync()" argument. |
CVE-2015-3611 | High | 8.8 | 2020-02-04 | A Command Injection vulnerability exists in FortiManager 5.2.1 and earlier and FortiManager 5.0.10 and earlier via unspecified vectors, which could let a malic… |
CVE-2020-8515 | Critical | 9.8 | 2020-02-01 | DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without… |
CVE-2013-3322 | High | 7.2 | 2020-01-31 | NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to inject arbitrary commands in the Halt/Reboot interface. |
CVE-2020-1931 | High | 8.1 | 2020-01-30 | A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run syste… |
CVE-2020-1930 | High | 8.1 | 2020-01-30 | A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configured to run… |
CVE-2019-20050 | Medium | 6.8 | 2020-01-30 | Pandora FMS ≤ 7.42 suffers from a remote code execution vulnerability. To exploit the vulnerability, an authenticated user should create a new folder with a "t… |
CVE-2020-8438 | High | 7.2 | 2020-01-29 | Ruckus ZoneFlex R500 104.0.0.0.1347 devices allow an authenticated attacker to execute arbitrary OS commands via the hidden /forms/nslookupHandler form, as dem… |
CVE-2019-10783 | Critical | 9.8 | 2020-01-29 | All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse… |
CVE-2013-2573 | Critical | 9.8 | 2020-01-29 | A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless_mft.cgi file in TP-Link IP Cameras TL-SC 3130, TL-SC 3130G, 3171G. an… |
CVE-2013-2570 | Critical | 9.8 | 2020-01-29 | A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to the sub_C8C8 function of the binary /opt… |
CVE-2013-2568 | Critical | 9.8 | 2020-01-29 | A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireless_mft.cgi, which could let a remote mali… |
CVE-2020-7247 | Critical | 9.8 | 2020-01-29 | smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via… |
CVE-2019-20217 | Critical | 9.8 | 2020-01-29 | D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htd… |
CVE-2019-20216 | Critical | 9.8 | 2020-01-29 | D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htd… |
CVE-2019-20215 | Critical | 9.8 | 2020-01-29 | D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in /htdoc… |
CVE-2013-1599 | Critical | 9.8 | 2020-01-28 | A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100… |
CVE-2012-6610 | High | 8.8 | 2020-01-28 | Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote authenticated users to execute arbitrary commands as demonstrated by a ; (sem… |
CVE-2013-2060 | Critical | 9.8 | 2020-01-28 | The download_from_url function in OpenShift Origin allows remote attackers to execute arbitrary commands via shell metacharacters in the URL of a request to do… |
CVE-2013-2612 | Critical | 9.8 | 2020-01-27 | Command-injection vulnerability in Huawei E587 3G Mobile Hotspot 11.203.27 allows remote attackers to execute arbitrary shell commands with root privileges due… |
CVE-2014-8563 | Critical | 9.8 | 2020-01-27 | Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS. |
CVE-2019-19824 | High | 8.8 | 2020-01-27 | On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd UR… |
CVE-2019-17095 | High | 8.1 | 2020-01-27 | A command injection vulnerability has been discovered in the bootstrap stage of Bitdefender BOX 2, versions 2.1.47.42 and 2.1.53.45. The API method `/api/downl… |
CVE-2019-17096 | Critical | 9.0 | 2020-01-27 | A OS Command Injection vulnerability in the bootstrap stage of Bitdefender BOX 2 allows the manipulation of the `get_image_url()` function in special circumsta… |
CVE-2019-12629 | High | 7.2 | 2020-01-26 | A vulnerability in the WebUI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject and execute arbitrary commands with vmanage u… |
CVE-2020-7980 | Critical | 9.8 | 2020-01-25 | Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a val… |
CVE-2020-7596 | High | 8.8 | 2020-01-25 | Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument. |
CVE-2013-1598 | High | 8.8 | 2020-01-24 | A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to the farseer.out binary file, which cold l… |
CVE-2019-19897 | Critical | 9.8 | 2020-01-23 | In IXP EasyInstall 6.2.13723, there is Remote Code Execution via the Agent Service. An unauthenticated attacker can communicate with the Agent Service over TCP… |
CVE-2019-19839 | Critical | 9.8 | 2020-01-23 | emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=import-cate… |
CVE-2019-19838 | Critical | 9.8 | 2020-01-23 | emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=get-platfor… |
CVE-2012-4981 | High | 8.8 | 2020-01-23 | Toshiba ConfigFree 8.0.38 has a CF7 File Remote Command Execution Vulnerability |
CVE-2019-19842 | Critical | 9.8 | 2020-01-22 | emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=spectra-ana… |
CVE-2019-19841 | Critical | 9.8 | 2020-01-22 | emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=packet-capt… |
CVE-2019-10780 | Critical | 9.8 | 2020-01-22 | BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open method through Bib… |
CVE-2020-7594 | High | 7.2 | 2020-01-21 | MultiTech Conduit MTCDT-LVW2-24XX 1.4.17-ocea-13592 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Deb… |
CVE-2020-7244 | High | 7.2 | 2020-01-20 | Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by navigating to the Poll Routes page and ent… |
CVE-2020-7243 | High | 7.2 | 2020-01-20 | Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by navigating to the Fetch URL page and enter… |
CVE-2020-7242 | High | 7.2 | 2020-01-20 | Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by navigating to the Diagnostics Trace Route… |
CVE-2020-7240 | High | 8.8 | 2020-01-20 | Meinberg Lantime M300 and M1000 devices allow attackers (with privileges to configure a device) to execute arbitrary OS commands by editing the /config/netconf… |
CVE-2020-7237 | High | 8.8 | 2020-01-20 | Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS c… |
CVE-2019-10958 | High | 7.2 | 2020-01-17 | Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote authenticated attacke… |
CVE-2019-10956 | High | 7.2 | 2020-01-17 | Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote authenticated user, u… |
CVE-2020-1609 | High | 8.8 | 2020-01-15 | When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay… |
CVE-2020-1605 | High | 8.8 | 2020-01-15 | When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay… |
CVE-2020-1602 | High | 7.1 | 2020-01-15 | When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay… |
CVE-2020-5505 | Critical | 9.8 | 2020-01-14 | Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring (in conjunction with "type":"application/x-php"} to th… |
CVE-2020-6948 | Critical | 9.8 | 2020-01-13 | A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.exec call that mish… |
CVE-2019-18894 | High | 7.8 | 2020-01-13 | In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Ban… |
CVE-2020-6757 | High | 8.8 | 2020-01-09 | contentHostProperties.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows authenticated attackers to remotely execute code via the name pa… |
CVE-2020-6756 | Critical | 9.8 | 2020-01-09 | languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows unauthenticated attackers to remotely execute code via the lang parame… |
CVE-2019-20224 | High | 8.8 | 2020-01-09 | netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in… |
CVE-2014-2650 | Critical | 9.8 | 2020-01-09 | Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection vulnerability in the web based management interface |
CVE-2019-10777 | Critical | 9.8 | 2020-01-08 | In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitizat… |
CVE-2019-10778 | Critical | 9.8 | 2020-01-08 | devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable `commonName`… |
CVE-2019-17148 | High | 7.8 | 2020-01-07 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop version 14.1.3 (45485). An at… |
CVE-2019-10776 | Critical | 9.8 | 2020-01-07 | In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all version… |
CVE-2019-20348 | Medium | 6.8 | 2020-01-06 | OKER G232V1 v1.03.02.20161129 devices provide a root terminal on a UART serial interface without proper access control. This allows attackers with physical acc… |
CVE-2019-19509 | High | 8.8 | 2020-01-06 | An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php bec… |
CVE-2016-11017 | Critical | 9.8 | 2020-01-06 | The application login page in AKIPS Network Monitor 15.37 through 16.5 allows a remote unauthenticated attacker to execute arbitrary OS commands via shell meta… |
CVE-2019-15979 | High | 7.2 | 2020-01-06 | Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with admi… |
CVE-2019-15978 | High | 7.2 | 2020-01-06 | Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with admi… |
CVE-2019-5987 | High | 8.8 | 2020-01-06 | Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote authenticated attackers to execute arbitrary OS commands via the Management… |
CVE-2012-5878 | Critical | 9.8 | 2020-01-03 | Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the host… |
CVE-2012-5693 | High | 8.8 | 2020-01-03 | Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddressTB… |
CVE-2020-5179 | High | 7.2 | 2020-01-02 | Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Diagnostics Ping page an… |
CVE-2019-20197 | High | 8.8 | 2019-12-31 | In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the c… |
CVE-2019-3984 | Critical | 9.8 | 2019-12-31 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when the… |
CVE-2019-9197 | High | 8.8 | 2019-12-31 | The com.unity3d.kharma protocol handler in Unity Editor 2018.3 allows remote attackers to execute arbitrary code. |
CVE-2019-16790 | Medium | 6.5 | 2019-12-30 | In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are impacted. |
CVE-2019-17621 | Critical | 9.8 | 2019-12-30 | The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands… |