CWE-78 · OS Command Injection (page 60)
Page 60 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-12709 | Medium | 6.7 | 2019-09-25 | A vulnerability in a CLI command related to the virtualization manager (VMAN) in Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers c… |
CVE-2019-12661 | Medium | 6.7 | 2019-09-25 | A vulnerability in a Virtualization Manager (VMAN) related CLI command of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitra… |
CVE-2019-12651 | High | 8.8 | 2019-09-25 | Multiple vulnerabilities in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands wi… |
CVE-2019-12650 | High | 8.8 | 2019-09-25 | Multiple vulnerabilities in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands wi… |
CVE-2019-16701 | High | 8.8 | 2019-09-25 | pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters… |
CVE-2019-16718 | High | 7.8 | 2019-09-23 | In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to ex… |
CVE-2019-15000 | Critical | 9.8 | 2019-09-19 | The commit diff rest endpoint in Bitbucket Server and Data Center before 5.16.10 (the fixed version for 5.16.x ), from 6.0.0 before 6.0.10 (the fixed version f… |
CVE-2019-16057 | Critical | 9.8 | 2019-09-16 | The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection. |
CVE-2019-5485 | Critical | 10.0 | 2019-09-13 | NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be injected through the repository name. |
CVE-2019-5315 | High | 7.2 | 2019-09-13 | A command injection vulnerability is present in the web management interface of ArubaOS that permits an authenticated user to execute arbitrary commands on the… |
CVE-2019-16293 | High | 8.8 | 2019-09-13 | The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field. |
CVE-2019-10392 | High | 8.8 | 2019-09-12 | Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting… |
CVE-2019-10669 | High | 7.2 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. There is a command injection vulnerability in html/includes/graphs/device/collectd.inc.php where user supplie… |
CVE-2019-10891 | Critical | 9.8 | 2019-09-06 | An issue was discovered in D-Link DIR-806 devices. There is a command injection in function hnap_main, which calls system() without checking the parameter that… |
CVE-2019-15029 | High | 8.8 | 2019-09-05 | FusionPBX 4.4.8 allows an attacker to execute arbitrary system commands by submitting a malicious command to the service_edit.php file (which will insert the m… |
CVE-2019-15949 | High | 8.8 | 2019-09-05 | Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via t… |
CVE-2019-5475 | High | 8.8 | 2019-09-03 | The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such a… |
CVE-2019-11364 | High | 7.2 | 2019-08-29 | An OS Command Injection vulnerability in Snare Central before 7.4.5 allows remote authenticated attackers to inject arbitrary OS commands via the ServerConf/Da… |
CVE-2019-15701 | High | 8.8 | 2019-08-27 | components/Modals/HelpModal.jsx in BloodHound 2.2.0 allows remote attackers to execute arbitrary OS commands (by spawning a child process as the current user o… |
CVE-2019-15503 | Critical | 9.8 | 2019-08-26 | cgi-cpn/xcoding/prontus_videocut.cgi in AltaVoz Prontus (aka ProntusCMS) through 12.0.3.0 has "Improper Neutralization of Special Elements used in an OS Comman… |
CVE-2019-1581 | Critical | 9.8 | 2019-08-23 | A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SS… |
CVE-2019-15530 | High | 8.8 | 2019-08-23 | An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell m… |
CVE-2019-15529 | High | 8.8 | 2019-08-23 | An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell m… |
CVE-2019-15528 | High | 8.8 | 2019-08-23 | An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell m… |
CVE-2019-15527 | High | 8.8 | 2019-08-23 | An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell m… |
CVE-2019-15526 | High | 8.8 | 2019-08-23 | An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell m… |
CVE-2019-15490 | Critical | 9.8 | 2019-08-23 | openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21. |
CVE-2019-13139 | High | 8.4 | 2019-08-22 | In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command e… |
CVE-2019-15060 | High | 8.8 | 2019-08-22 | The traceroute function on the TP-Link TL-WR840N v4 router with firmware through 0.9.1 3.16 is vulnerable to remote code execution via a crafted payload in an… |
CVE-2019-1896 | High | 7.2 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject a… |
CVE-2019-1885 | High | 7.2 | 2019-08-21 | A vulnerability in the Redfish protocol of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject and execute arb… |
CVE-2019-1883 | High | 7.8 | 2019-08-21 | A vulnerability in the command-line interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker with read-only crede… |
CVE-2019-1865 | High | 8.8 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to… |
CVE-2019-1864 | High | 8.8 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to… |
CVE-2019-1850 | High | 7.2 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to… |
CVE-2019-1839 | Medium | 6.7 | 2019-08-21 | A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affect… |
CVE-2019-1634 | High | 7.2 | 2019-08-21 | A vulnerability in the Intelligent Platform Management Interface (IPMI) of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote at… |
CVE-2019-4294 | High | 7.8 | 2019-08-20 | IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0.12, 9.1.0.0 through 9.1.0.2, and 9.1.1… |
CVE-2019-3968 | High | 8.8 | 2019-08-20 | In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new f… |
CVE-2019-5477 | Critical | 9.8 | 2019-08-16 | A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are… |
CVE-2019-14923 | High | 8.8 | 2019-08-16 | EyesOfNetwork 5.1 allows Remote Command Execution via shell metacharacters in the module/tool_all/ host field. |
CVE-2018-20969 | High | 7.8 | 2019-08-16 | do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the same commit as for CVE-2019-13638, but… |
CVE-2019-15107 | Critical | 9.8 | 2019-08-16 | An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability. |
CVE-2019-12792 | High | 8.8 | 2019-08-15 | A command injection vulnerability in UploadHandler.php in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users to roo… |
CVE-2019-3417 | High | 8.8 | 2019-08-15 | All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by command injection vulnerability. Due to insufficient parameter validation check, an au… |
CVE-2019-14527 | Critical | 9.8 | 2019-08-14 | An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. System commands can be executed, via the web interface, after authentication. |
CVE-2019-12103 | Critical | 9.8 | 2019-08-14 | The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by a pre-authentication command injection vulnerability. |
CVE-2019-15027 | Critical | 9.8 | 2019-08-14 | The MediaTek Embedded Multimedia Card (eMMC) subsystem for Android on MT65xx, MT66xx, and MT8163 SoC devices allows attackers to execute arbitrary commands as… |
CVE-2019-1971 | Critical | 9.8 | 2019-08-08 | A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to perform a command… |
CVE-2019-1960 | Medium | 4.4 | 2019-08-08 | Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to read arbitrary files on the un… |
CVE-2019-1959 | Medium | 4.4 | 2019-08-08 | Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to read arbitrary files on the un… |
CVE-2019-14744 | High | 7.8 | 2019-08-07 | In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to… |
CVE-2019-14699 | Critical | 9.8 | 2019-08-06 | An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker can exploit OS Command Injection in the filename paramet… |
CVE-2019-14260 | High | 8.0 | 2019-08-01 | On the Alcatel-Lucent Enterprise (ALE) 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injection (missing input validation) issue in t… |
CVE-2019-14259 | High | 8.0 | 2019-08-01 | On the Polycom Obihai Obi1022 VoIP phone with firmware 5.1.11, a command injection (missing input validation) issue in the NTP server IP address field for the… |
CVE-2019-14337 | Medium | 5.5 | 2019-08-01 | An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is an ability to escape to a shell in the restricted command lin… |
CVE-2019-1020004 | High | 7.5 | 2019-07-29 | Tridactyl before 1.16.0 allows fake key events. |
CVE-2019-13638 | High | 7.8 | 2019-07-26 | GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payloa… |
CVE-2019-3595 | Medium | 6.5 | 2019-07-24 | Improper Neutralization of Special Elements used in a Command ('Command Injection') in ePO extension in McAfee Data Loss Prevention (DLP) 11.x prior to 11.3.0… |
CVE-2019-1010179 | Critical | 9.8 | 2019-07-24 | PHKP including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b is affected by: Improper Neutralization of Special Elements used in a Command ('Command Injectio… |
CVE-2019-1010200 | Critical | 9.8 | 2019-07-23 | Voice Builder Prior to commit c145d4604df67e6fc625992412eef0bf9a85e26b and f6660e6d8f0d1d931359d591dbdec580fef36d36 is affected by: CWE-78: Improper Neutraliza… |
CVE-2019-12328 | Critical | 9.0 | 2019-07-22 | A command injection (missing input validation) issue in the remote phonebook configuration URI in the web interface of the Atcom A10W VoIP phone with firmware… |
CVE-2019-12324 | High | 7.2 | 2019-07-22 | A command injection (missing input validation) issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP… |
CVE-2019-12725 | Critical | 9.8 | 2019-07-19 | Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP paramet… |
CVE-2019-1010245 | Critical | 9.8 | 2019-07-19 | The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation. The impact is: A remote attacker can execute arbi… |
CVE-2019-13640 | Critical | 9.8 | 2019-07-17 | In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows command injection via shell metacharacters in… |
CVE-2019-12992 | High | 8.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 6 of 6). |
CVE-2019-12991 | High | 8.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6). |
CVE-2019-12988 | Critical | 9.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 4 of 6). |
CVE-2019-12987 | Critical | 9.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6). |
CVE-2019-12986 | Critical | 9.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 2 of 6). |
CVE-2019-12985 | Critical | 9.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 1 of 6). |
CVE-2019-1576 | High | 8.8 | 2019-07-16 | Command injection in PAN-0S 9.0.2 and earlier may allow an authenticated attacker to gain access to a remote shell in PAN-OS, and potentially run with the esca… |
CVE-2019-13598 | Critical | 9.8 | 2019-07-14 | LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port_3480/data_re… |
CVE-2019-13597 | Critical | 9.8 | 2019-07-14 | _s_/sprm/_s_/dyn/Player_setScriptFile in Sahi Pro 8.0.0 allows command execution. It allows one to run ".sah" scripts via Sahi Launcher. Also, one can create a… |
CVE-2019-13567 | High | 8.8 | 2019-07-12 | The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon (aka the h… |
CVE-2019-13574 | High | 7.8 | 2019-07-12 | In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is direct… |
CVE-2019-12579 | High | 7.8 | 2019-07-11 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to run… |
CVE-2019-11062 | Critical | 9.8 | 2019-07-11 | The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via "/teach/course/doajaxfileupload.php". The target server can be exploited witho… |
CVE-2019-13561 | Critical | 9.8 | 2019-07-11 | D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metacharacters in the online_firmware_check.cgi c… |
CVE-2019-13482 | High | 8.8 | 2019-07-10 | An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shel… |
CVE-2019-13481 | High | 8.8 | 2019-07-10 | An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shel… |
CVE-2019-0328 | High | 7.2 | 2019-07-10 | ABAP Tests Modules (SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5) of SAP NetWeaver Process Integration enables an attacker the execution of OS commands wi… |
CVE-2019-13278 | Critical | 9.8 | 2019-07-10 | TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains multiple command injections when processing user input for the setup wizard, allowing an… |
CVE-2018-14495 | Critical | 9.8 | 2019-07-10 | Vivotek FD8136 devices allow Remote Command Injection, aka "another command injection vulnerability in our target device," a different issue than CVE-2018-1449… |
CVE-2018-14494 | Critical | 9.8 | 2019-07-10 | Vivotek FD8136 devices allow Remote Command Injection, related to BusyBox and wget. NOTE: the vendor sent a clarification on 2019-09-17 explaining that, althou… |
CVE-2019-13398 | High | 7.2 | 2019-07-08 | Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed inject… |
CVE-2019-1893 | High | 7.8 | 2019-07-06 | A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to execute arbitrary commands on the under… |
CVE-2018-14860 | Critical | 9.1 | 2019-07-03 | Improper sanitization of dynamic user expressions in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated privileged users… |
CVE-2018-11215 | Critical | 9.8 | 2019-07-03 | Remote code execution is possible in Cloudera Data Science Workbench version 1.3.0 and prior releases via unspecified attack vectors. |
CVE-2019-6621 | High | 7.2 | 2019-07-02 | On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, 11.6.1-11.6.3.4, and 11.5.2-11.5.8 and BIG-IQ 7.0.0-7.1.0.2, 6.0.0-6.1.0, and 5.1… |
CVE-2019-6620 | High | 7.2 | 2019-07-02 | On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.5, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4 and BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, an undisclosed iControl… |
CVE-2019-7256 | Critical | 9.8 | 2019-07-02 | Linear eMerge E3-Series devices allow Command Injections. |
CVE-2019-7269 | Critical | 9.8 | 2019-07-02 | Linear eMerge 50P/5000P devices allow Authenticated Command Injection with root Code Execution. |
CVE-2019-13155 | High | 8.8 | 2019-07-02 | An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the IP… |
CVE-2019-13154 | High | 8.8 | 2019-07-02 | An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the TCP… |
CVE-2019-13153 | High | 8.8 | 2019-07-02 | An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the Pri… |
CVE-2019-13151 | High | 8.8 | 2019-07-02 | An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the act… |
CVE-2019-13149 | High | 8.8 | 2019-07-02 | An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the key… |
CVE-2019-7670 | High | 7.2 | 2019-07-01 | Prima Systems FlexAir, Versions 2.3.38 and prior. The application incorrectly neutralizes special elements that could modify the intended OS command when it is… |