CWE-78 · OS Command Injection (page 59)
Page 59 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10774 | Critical | 9.8 | 2019-12-30 | php-shellcommand versions before 1.6.1 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2019-6014 | High | 8.8 | 2019-12-26 | DBA-1510P firmware 1.70b009 and earlier allows an attacker to execute arbitrary OS commands via Web User Interface. |
CVE-2019-6013 | Medium | 6.6 | 2019-12-26 | DBA-1510P firmware 1.70b009 and earlier allows authenticated attackers to execute arbitrary OS commands via Command Line Interface (CLI). |
CVE-2019-19920 | High | 8.8 | 2019-12-22 | sa-exim 4.2.1 allows attackers to execute arbitrary code if they can write a .cf file or a rule. This occurs because Greylisting.pm relies on eval (rather than… |
CVE-2019-15598 | Critical | 9.8 | 2019-12-18 | A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command. |
CVE-2019-8513 | High | 7.8 | 2019-12-18 | This issue was addressed with improved checks. This issue is fixed in macOS Mojave 10.14.4. A local user may be able to execute arbitrary shell commands. |
CVE-2019-11399 | Critical | 9.8 | 2019-12-18 | An issue was discovered on TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices. OS command injection occurs through the get_set.ccp l… |
CVE-2019-18830 | Critical | 9.8 | 2019-12-16 | Barco ClickShare Button R9861500D01 devices before 1.9.0 allow OS Command Injection. The embedded 'dongle_bridge' program used to expose the functionalities of… |
CVE-2019-17364 | Critical | 9.8 | 2019-12-13 | The processCommandUploadLog() function of libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary… |
CVE-2019-16737 | Critical | 9.8 | 2019-12-13 | The processCommandSetMac() function of libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary sy… |
CVE-2019-16733 | Critical | 9.8 | 2019-12-13 | processCommandSetUid() in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands… |
CVE-2019-16730 | Critical | 9.8 | 2019-12-13 | processCommandUpgrade() in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system command… |
CVE-2018-11805 | Medium | 6.7 | 2019-12-12 | In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injec… |
CVE-2019-3989 | Critical | 9.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when retr… |
CVE-2019-3988 | High | 8.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when conf… |
CVE-2019-3987 | High | 8.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when conf… |
CVE-2019-3986 | High | 8.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when conf… |
CVE-2019-3985 | High | 8.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when conf… |
CVE-2014-0163 | High | 8.8 | 2019-12-11 | Openshift has shell command injection flaws due to unsanitized data being passed into shell commands. |
CVE-2019-4715 | High | 8.8 | 2019-12-11 | IBM Spectrum Scale 4.2 and 5.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request… |
CVE-2019-19604 | High | 7.8 | 2019-12-11 | Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 becaus… |
CVE-2019-14889 | High | 8.8 | 2019-12-10 | A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp… |
CVE-2019-17270 | Critical | 9.8 | 2019-12-10 | Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command={C… |
CVE-2019-19642 | High | 8.8 | 2019-12-08 | On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who… |
CVE-2019-19609 | High | 7.2 | 2019-12-05 | The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because i… |
CVE-2019-19469 | High | 8.8 | 2019-12-01 | In Zmanda Management Console 3.3.9, ZMC_Admin_Advanced?form=adminTasks&action=Apply&command= allows CSRF, as demonstrated by command injection with shell metac… |
CVE-2011-2523 | Critical | 9.8 | 2019-11-27 | vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp. |
CVE-2019-18184 | Critical | 9.8 | 2019-11-27 | Crestron DMC-STRO 1.0 devices allow remote command execution as root via shell metacharacters to the ping function. |
CVE-2017-12945 | High | 8.8 | 2019-11-27 | Insufficient validation of user-supplied input for the Solstice Pod before 2.8.4 networking configuration enables authenticated attackers to execute arbitrary… |
CVE-2019-15298 | High | 8.8 | 2019-11-27 | A problem was found in Centreon Web through 19.04.3. An authenticated command injection is present in the page include/configuration/configObject/traps-mibs/fo… |
CVE-2019-16242 | Medium | 6.8 | 2019-11-26 | On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an engineering application named omamock that is vulnerable to OS command injection. An attacker with… |
CVE-2019-12489 | Critical | 9.8 | 2019-11-26 | An issue was discovered on Fastweb Askey RTV1907VW 0.00.81_FW_200_Askey 2018-10-02 18:08:18 devices. By using the usb_remove service through an HTTP request, i… |
CVE-2019-15997 | Medium | 6.7 | 2019-11-26 | A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to perform a command injection attack and execute arbitrary command… |
CVE-2019-15996 | Medium | 6.7 | 2019-11-26 | A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underly… |
CVE-2019-15986 | Medium | 6.7 | 2019-11-26 | A vulnerability in the CLI of Cisco Unity Express could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privile… |
CVE-2019-18910 | Medium | 6.8 | 2019-11-22 | The Citrix Receiver wrapper function does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute wit… |
CVE-2019-18909 | High | 8.0 | 2019-11-22 | The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with… |
CVE-2019-5072 | High | 7.8 | 2019-11-21 | An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Router AC1200 Smart Dual-Band Gigabit WiFi… |
CVE-2019-5071 | High | 7.8 | 2019-11-21 | An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Router AC1200 Smart Dual-Band Gigabit WiFi… |
CVE-2019-17650 | High | 7.8 | 2019-11-21 | An Improper Neutralization of Special Elements used in a Command vulnerability in one of FortiClient for Mac OS root processes, may allow a local user of the s… |
CVE-2019-18934 | High | 7.3 | 2019-11-19 | Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiving a specially crafted answer. This is… |
CVE-2019-19117 | High | 8.8 | 2019-11-18 | /usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2(PSG1218) V22.5.9.163 devices allows remote authenticated users to execute any command via shel… |
CVE-2019-19041 | High | 7.2 | 2019-11-17 | An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41. They do not correctly verify the integrity of an upgrade packag… |
CVE-2019-15800 | Critical | 9.8 | 2019-11-14 | An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Due to lack of input validation in the cmd_sys_traceroute_exec(), cmd_sys_… |
CVE-2019-15351 | High | 7.8 | 2019-11-14 | The Tecno Camon Android device with a build fingerprint of TECNO/H622/TECNO-ID5b:8.1.0/O11019/G-180829V31:user/release-keys contains a pre-installed platform a… |
CVE-2019-15348 | High | 7.8 | 2019-11-14 | The Tecno Camon Android device with a build fingerprint of TECNO/H612/TECNO-ID5a:8.1.0/O11019/F-180828V106:user/release-keys contains a pre-installed platform… |
CVE-2019-15347 | High | 7.8 | 2019-11-14 | The Tecno Camon iClick 2 Android device with a build fingerprint of TECNO/H622/TECNO-ID6:8.1.0/O11019/F-180824V116:user/release-keys contains a pre-installed p… |
CVE-2019-15343 | High | 7.8 | 2019-11-14 | The Tecno Camon iClick Android device with a build fingerprint of TECNO/H633/TECNO-IN6:8.1.0/O11019/A-180409V96:user/release-keys contains a pre-installed plat… |
CVE-2019-15342 | High | 7.8 | 2019-11-14 | The Tecno Camon iAir 2 Plus Android device with a build fingerprint of TECNO/H622/TECNO-ID3k:8.1.0/O11019/E-180914V83:user/release-keys contains a pre-installe… |
CVE-2019-5029 | Critical | 9.8 | 2019-11-13 | An exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.7.1. Arbitrary shell commands surrounded… |
CVE-2019-18839 | Critical | 9.0 | 2019-11-13 | FUDForum 3.0.9 is vulnerable to Stored XSS via the nlogin parameter. This may result in remote code execution. An attacker can use a user account to fully comp… |
CVE-2019-18873 | Critical | 9.0 | 2019-11-12 | FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to full… |
CVE-2019-8159 | High | 8.8 | 2019-11-06 | A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with system data man… |
CVE-2019-15588 | High | 7.2 | 2019-11-01 | There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All… |
CVE-2019-18396 | High | 7.2 | 2019-10-31 | An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Command Injection in the Ping module in the… |
CVE-2019-15710 | High | 7.2 | 2019-10-31 | An OS command injection vulnerability in FortiExtender 4.1.0 to 4.1.1, 4.0.0 and below under CLI admin console may allow unauthorized administrators to run arb… |
CVE-2013-2024 | High | 8.8 | 2019-10-31 | OS command injection vulnerability in the "qs" procedure from the "utils" module in Chicken before 4.9.0. |
CVE-2019-18424 | Medium | 6.8 | 2019-10-31 | An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a ph… |
CVE-2019-14931 | Critical | 9.8 | 2019-10-28 | An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote OS Comman… |
CVE-2019-16663 | High | 8.8 | 2019-10-28 | An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand p… |
CVE-2019-16662 | Critical | 9.8 | 2019-10-28 | An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the ro… |
CVE-2019-5129 | Critical | 9.8 | 2019-10-25 | A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated co… |
CVE-2019-5128 | Critical | 9.8 | 2019-10-25 | A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated co… |
CVE-2019-5127 | Critical | 9.8 | 2019-10-25 | A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated co… |
CVE-2019-13653 | Critical | 9.8 | 2019-10-24 | TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow triggerPort OS Command Injection (issue 5 of 5). |
CVE-2019-13652 | Critical | 9.8 | 2019-10-24 | TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow serviceName OS Command Injection (issue 4 of 5). |
CVE-2019-13651 | Critical | 9.8 | 2019-10-24 | TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow portMappingProtocol OS Command Injection (issue 3 of 5). |
CVE-2019-13650 | Critical | 9.8 | 2019-10-24 | TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow internalPort OS Command Injection (issue 2 of 5). |
CVE-2019-13649 | Critical | 9.8 | 2019-10-24 | TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow externalPort OS Command Injection (issue 1 of 5). |
CVE-2019-18370 | Critical | 9.8 | 2019-10-23 | An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. The backup file is in tar.gz format. After uploading, the application uses the tar… |
CVE-2019-16965 | High | 7.2 | 2019-10-21 | resources/cmd.php in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated adminis… |
CVE-2019-16964 | High | 8.8 | 2019-10-21 | app/call_centers/cmd.php in the Call Center Queue Module in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validat… |
CVE-2019-17526 | Critical | 9.8 | 2019-10-18 | An issue was discovered in SageMath Sage Cell Server through 2019-10-05. Python Code Injection can occur in the context of an internet facing web application… |
CVE-2019-14423 | High | 8.8 | 2019-10-17 | A Remote Code Execution (RCE) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers… |
CVE-2019-15277 | Medium | 6.7 | 2019-10-16 | A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to execute code with root pr… |
CVE-2019-15275 | Medium | 6.7 | 2019-10-16 | A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to execute arbitrary command… |
CVE-2019-15274 | Medium | 6.7 | 2019-10-16 | A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to perform command injection… |
CVE-2019-17625 | Critical | 9.0 | 2019-10-16 | There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to i… |
CVE-2019-17501 | High | 8.8 | 2019-10-14 | Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > Disc… |
CVE-2019-17510 | Critical | 9.8 | 2019-10-11 | D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ re… |
CVE-2019-17509 | Critical | 9.8 | 2019-10-11 | D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ re… |
CVE-2019-17508 | Critical | 9.8 | 2019-10-11 | On D-Link DIR-859 A3-1.06 and DIR-850 A1.13 devices, /etc/services/DEVICE.TIME.php allows command injection via the $SERVER variable. |
CVE-2019-17059 | Critical | 9.8 | 2019-10-11 | A shell injection vulnerability on the Sophos Cyberoam firewall appliance with CyberoamOS before 10.6.6 MR-6 allows remote attackers to execute arbitrary comma… |
CVE-2019-17499 | High | 8.8 | 2019-10-11 | The setter.xml component of the Common Gateway Interface on Compal CH7465LG 6.12.18.25-2p4 devices does not properly validate ping command arguments, which all… |
CVE-2019-11527 | High | 8.8 | 2019-10-10 | An issue was discovered in Softing uaGate SI 1.60.01. A CGI script is vulnerable to command injection with a maliciously crafted url parameter. |
CVE-2019-15014 | High | 8.8 | 2019-10-09 | A command injection vulnerability exists in the Zingbox Inspector versions 1.286 and earlier, that allows for an authenticated user to execute arbitrary system… |
CVE-2019-15715 | High | 7.2 | 2019-10-09 | MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution. |
CVE-2019-13051 | High | 8.8 | 2019-10-09 | Pi-Hole 4.3 allows Command Injection. |
CVE-2019-17107 | High | 8.8 | 2019-10-08 | minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parameter. NOTE: some sou… |
CVE-2019-12812 | Critical | 9.8 | 2019-10-07 | MyBuilder viewer before 6.2.2019.814 allow an attacker to execute arbitrary command via specifically crafted configuration file. This can be leveraged for code… |
CVE-2019-12811 | Critical | 9.8 | 2019-10-07 | ActiveX Control in MyBuilder before 6.2.2019.814 allow an attacker to execute arbitrary command via the ShellOpen method. This can be leveraged for code execut… |
CVE-2019-15746 | Critical | 9.8 | 2019-10-07 | SITOS six Build v6.2.1 allows an attacker to inject arbitrary PHP commands. As a result, an attacker can compromise the running server and execute system comma… |
CVE-2019-17269 | Critical | 9.8 | 2019-10-07 | Intellian Remote Access 3.18 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the Ping Test field. |
CVE-2019-15036 | High | 7.2 | 2019-10-02 | An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could execute any command on the server machine. The issue was fixed i… |
CVE-2019-12699 | High | 7.8 | 2019-10-02 | Multiple vulnerabilities in the CLI of Cisco FXOS Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to ex… |
CVE-2019-12690 | High | 7.2 | 2019-10-02 | A vulnerability in the web UI of the Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to inject arbitrary commands that ar… |
CVE-2019-13025 | Critical | 9.8 | 2019-10-02 | Compal CH7465LG CH7465LG-NCIP-6.12.18.24-5p8-NOSH devices have Incorrect Access Control because of Improper Input Validation. The attacker can send a malicious… |
CVE-2019-16920 | Critical | 9.8 | 2019-09-27 | Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an… |
CVE-2019-12091 | High | 7.8 | 2019-09-26 | The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts network connections from localhost. The… |
CVE-2019-12717 | High | 7.8 | 2019-09-25 | A vulnerability in a CLI command related to the virtualization manager (VMAN) in Cisco NX-OS Software could allow an authenticated, local attacker to execute a… |