CWE-78 · OS Command Injection (page 59)

Page 59 of 65 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.

All CVEs classified under CWE-78 — newest first (page 59 of 65)
CVESeverityScorePublishedSummary
CVE-2018-16752High8.82018-09-20LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools…
CVE-2018-16282High8.82018-09-20A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands…
CVE-2018-17228Critical9.82018-09-19nmap4j 1.1.0 allows attackers to execute arbitrary commands via shell metacharacters in an includeHosts call.
CVE-2017-2873High7.22018-09-19An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52…
CVE-2018-17208High8.82018-09-19Linksys Velop 1.1.2.187020 devices allow unauthenticated command injection, providing an attacker with full root access, via cgi-bin/zbtest.cgi or cgi-bin/zbte…
CVE-2018-17068Critical9.82018-09-15An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction in the handler function of the…
CVE-2018-17066Critical9.82018-09-15An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction in the handler function of the…
CVE-2018-17064Critical9.82018-09-15An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of…
CVE-2018-17063Critical9.82018-09-15An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of…
CVE-2018-16744High7.82018-09-13An issue was discovered in mgetty before 1.2.1. In fax_notify_mail() in faxrec.c, the mail_to parameter is not sanitized. It could allow for command injection…
CVE-2018-16741High7.82018-09-13An issue was discovered in mgetty before 1.2.1. In fax/faxq-helper.c, the function do_activate() does not properly sanitize shell metacharacters to prevent com…
CVE-2018-15484Critical9.82018-09-07An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Unauthenticated Remote Code Execution is possible through the open HTTP interface…
CVE-2018-16460Critical9.82018-09-07A command Injection in ps package versions <1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID.
CVE-2018-4010High7.82018-09-07An exploitable code execution vulnerability exists in the connect functionality of ProtonVPN VPN client 1.5.1. A specially crafted configuration file can cause…
CVE-2018-3952High8.82018-09-07An exploitable code execution vulnerability exists in the connect functionality of NordVPN 6.14.28.0. A specially crafted configuration file can cause a privil…
CVE-2018-0643Medium6.62018-09-07Ubuntu14.04 ORCA (Online Receipt Computer Advantage) 4.8.0 (panda-server) 1:1.4.9+p41-u4jma1 and earlier allows attacker with administrator rights to execute a…
CVE-2018-15726Medium5.32018-09-06The Pulse Secure Desktop (macOS) 5.3RX before 5.3R5 and 9.0R1 has a Privilege Escalation Vulnerability.
CVE-2018-1000666Critical9.82018-09-06GIG Technology NV JumpScale Portal 7 version before commit 15443122ed2b1cbfd7bdefc048bf106f075becdb contains a CWE-78: Improper Neutralization of Special Eleme…
CVE-2018-16146High7.22018-09-05The web management console of Opsview Monitor 5.4.x before 5.4.2 provides functionality accessible by an authenticated administrator to test notifications that…
CVE-2018-16144Critical9.82018-09-05The test connection functionality in the NetAudit section of Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to command injection due to impr…
CVE-2018-16408High7.22018-09-03D-Link DIR-846 devices with firmware 100.26 allow remote attackers to execute arbitrary code as root via a SetNetworkTomographySettings request by leveraging a…
CVE-2018-16334High8.82018-09-02An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN and AC10 V15.03.06.23_CN devices. The mac parameter in a POST request is used directly in a doSystem…
CVE-2018-15477Critical9.82018-08-30myStrom WiFi Switch V1 devices before 2.66 did not sanitize a parameter received from the cloud that was used in an OS command. Malicious servers were able to…
CVE-2018-11616High8.82018-08-30This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail 7.2.9.115. User interaction is required to…
CVE-2018-14572High7.82018-08-28In conference-scheduler-cli, a pickle.load call on imported data allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated…
CVE-2018-15529High8.82018-08-28A command injection vulnerability in maintenance.cgi in Mutiny "Monitoring Appliance" before 6.1.0-5263 allows authenticated users, with access to the admin in…
CVE-2018-15887High8.82018-08-27Main_Analysis_Content.asp in ASUS DSL-N12E_C1 1.1.2.3_345 is prone to Authenticated Remote Command Execution, which allows a remote attacker to execute arbitra…
CVE-2018-15877High8.82018-08-26The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip parameter of a wp-…
CVE-2018-3786Critical9.82018-08-24A command injection vulnerability in egg-scripts <v2.8.1 allows arbitrary shell command execution through a maliciously crafted command line argument.
CVE-2018-15481High8.82018-08-21Improper input sanitization within the restricted administration shell on UCOPIA Wireless Appliance devices using firmware version 5.1.x before 5.1.13 allows a…
CVE-2018-15553High8.82018-08-20fileshare.cmd on Telus Actiontec T2200H T2200H-31.128L.03 devices allows OS Command Injection via shell metacharacters in the smbdUserid or smbdPasswd field.
CVE-2018-3785Critical9.82018-08-17A command injection in git-dummy-commit v1.3.0 allows os level commands to be executed due to an unescaped parameter.
CVE-2018-0427High8.82018-08-15A vulnerability in the CronJob scheduler API of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to perform a comm…
CVE-2018-15156High8.82018-08-15OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted r…
CVE-2018-15155High8.82018-08-15OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted r…
CVE-2018-15154High8.82018-08-15OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted r…
CVE-2018-15153High8.82018-08-15OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted r…
CVE-2018-3937Critical9.12018-08-14An exploitable command injection vulnerability exists in the measurementBitrateExec functionality of Sony IPELA E Series Network Camera G5 firmware 1.87.00. A…
CVE-2018-14933Critical9.82018-08-04upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.
CVE-2018-14417Critical9.82018-08-04A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. In particular, the snserv script did not sanitize…
CVE-2018-12483High8.82018-08-04OCS Inventory 2.4.1 is prone to a remote command-execution vulnerability. Specifically, this issue occurs because the content of the ipdiscover_analyser rzo GE…
CVE-2018-10900High7.82018-07-26Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to…
CVE-2018-10905High7.82018-07-24CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivile…
CVE-2018-0349Critical9.82018-07-18A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to overwrite arbitrary files on the underlying operating system of a…
CVE-2018-0348High7.22018-07-18A vulnerability in the CLI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root…
CVE-2018-14357Critical9.82018-07-17An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote charact…
CVE-2018-14354Critical9.82018-07-17An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote charact…
CVE-2018-0710High8.82018-07-17Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary command…
CVE-2018-0709High8.82018-07-17Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary comman…
CVE-2018-0708High8.82018-07-17Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary…
CVE-2018-0707High7.22018-07-17Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbit…
CVE-2018-0341High8.82018-07-16A vulnerability in the web-based UI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware before 11.2(1) could allow an authenticated, remo…
CVE-2018-14060Critical9.82018-07-15OS command injection in the AP mode settings feature in /cgi-bin/luci /api/misystem/set_router_wifiap on Xiaomi R3D before 2.26.4 devices allows an attacker to…
CVE-2018-14010Critical9.82018-07-15OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2…
CVE-2018-5553Critical9.82018-07-10The Crestron Console service running on DGE-100, DM-DGE-200-C, and TS-1542-C devices with default configuration and running firmware versions 1.3384.00049.001…
CVE-2018-13797Critical9.82018-07-10The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an exec (rather than execF…
CVE-2018-6831High7.22018-07-09The setSystemTime function in Foscam Cameras C1 Lite V3, and C1 V3 with firmware 2.82.2.33 and earlier, FI9800P V3, FI9803P V4, FI9851P V3, and FI9853EP V2 2.8…
CVE-2018-10987High7.52018-07-05An issue was discovered on Dongguan Diqee Diqee360 devices. The affected vacuum cleaner suffers from an authenticated remote code execution vulnerability. An a…
CVE-2018-9276High7.22018-07-02An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative pri…
CVE-2018-12577High8.82018-07-02The Ping and Traceroute features on TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices allow authenticated blind Command Injecti…
CVE-2018-12465Critical9.12018-06-29An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated…
CVE-2018-12972Critical9.82018-06-29An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON i…
CVE-2018-11510Critical9.82018-06-28The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding…
CVE-2018-4860High7.22018-06-26A vulnerability has been identified in SCALANCE M875 (All versions). An authenticated remote attacker with access to the web interface (443/tcp), could execute…
CVE-2018-4859High7.22018-06-26A vulnerability has been identified in SCALANCE M875 (All versions). An authenticated remote attacker with access to the web interface (443/tcp), could execute…
CVE-2018-10660Critical9.82018-06-26An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection.
CVE-2018-0569High8.82018-06-26baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to execute arbitrary OS commands v…
CVE-2018-12692High8.82018-06-23TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the…
CVE-2018-0306High7.82018-06-21A vulnerability in the CLI parser of Cisco NX-OS Software could allow an authenticated, local attacker to perform a command-injection attack on an affected dev…
CVE-2018-0330High8.82018-06-20A vulnerability in the NX-API management application programming interface (API) in devices running, or based on, Cisco NX-OS Software could allow an authentic…
CVE-2018-0307High7.82018-06-20A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to perform a command-injection attack on an affected device. Th…
CVE-2018-0293High8.82018-06-20A vulnerability in role-based access control (RBAC) for Cisco NX-OS Software could allow an authenticated, remote attacker to execute CLI commands that should…
CVE-2018-6211High7.22018-06-20On D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, OS command injection is…
CVE-2018-12591High7.22018-06-20Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an improperly neutralized element in an OS command due to lack of protection on the admin CLI…
CVE-2017-3936Medium6.22018-06-13OS Command Injection vulnerability in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows attackers to run arbitrary O…
CVE-2018-12268Critical9.82018-06-13acccheck.pl in acccheck 0.2.1 allows Command Injection via shell metacharacters in a username or password file, as demonstrated by injection into an smbclient…
CVE-2018-6961High8.12018-06-11VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled…
CVE-2014-0593High7.82018-06-08The set_version script as shipped with obs-service-set_version is a source validator for the Open Build Service (OBS). In versions prior to 0.5.3-1.1 this scri…
CVE-2018-11229Critical9.82018-06-08Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via comm…
CVE-2018-0274High8.82018-06-07A vulnerability in the CLI parser of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to execute arbitrary shell command…
CVE-2017-7637Critical9.82018-06-05QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to run arbitrary OS commands against the system with root privileges.
CVE-2018-6662High7.82018-06-05Privilege Escalation vulnerability in McAfee Management of Native Encryption (MNE) before 4.1.4 allows local users to gain elevated privileges via a crafted us…
CVE-2017-16042Critical9.82018-06-04Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command…
CVE-2018-11189High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 1 of 6).
CVE-2018-11188High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 46 of 46).
CVE-2018-11187High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 45 of 46).
CVE-2018-11186High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 44 of 46).
CVE-2018-11185High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 43 of 46).
CVE-2018-11184High7.22018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 42 of 46).
CVE-2018-11183High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 41 of 46).
CVE-2018-11182High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 40 of 46).
CVE-2018-11181High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 39 of 46).
CVE-2018-11180High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 38 of 46).
CVE-2018-11179High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 37 of 46).
CVE-2018-11178High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 36 of 46).
CVE-2018-11177High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 35 of 46).
CVE-2018-11176High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 34 of 46).
CVE-2018-11175High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 33 of 46).
CVE-2018-11174High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 32 of 46).
CVE-2018-11173High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 31 of 46).