CWE-78 · OS Command Injection (page 61)
Page 61 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-13128 | High | 8.8 | 2019-07-01 | An issue was discovered on D-Link DIR-823G devices with firmware 1.02B03. There is a command injection in HNAP1 (exploitable with Authentication) via shell met… |
CVE-2019-11829 | High | 7.3 | 2019-06-30 | OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote attackers to execute arbitrary commands… |
CVE-2019-12997 | High | 8.8 | 2019-06-28 | In Loopchain through 2.2.1.3, an attacker can escalate privileges from a low-privilege shell by changing the environment (aka injection in the DEFAULT_SCORE_HO… |
CVE-2019-3631 | High | 7.2 | 2019-06-27 | Command Injection vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary… |
CVE-2019-3630 | High | 7.2 | 2019-06-27 | Command Injection vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary… |
CVE-2019-5819 | High | 7.8 | 2019-06-27 | Insufficient data validation in developer tools in Google Chrome on OS X prior to 74.0.3729.108 allowed a local attacker to execute arbitrary code via a crafte… |
CVE-2019-12929 | Critical | 9.8 | 2019-06-24 | The QMP guest_exec command in QEMU 4.0.0 and earlier is prone to OS command injection, which allows the attacker to achieve code execution, denial of service… |
CVE-2019-12928 | Critical | 9.8 | 2019-06-24 | The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, de… |
CVE-2018-16118 | High | 8.1 | 2019-06-20 | A shell escape vulnerability in /webconsole/APIController in the API Configuration component of Sophos XG firewall 17.0.8 MR-8 allows remote attackers to execu… |
CVE-2018-16117 | High | 8.8 | 2019-06-20 | A shell escape vulnerability in /webconsole/Controller in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attackers to execute arbitr… |
CVE-2019-6962 | High | 7.5 | 2019-06-20 | A shell injection issue in cosa_wifi_apis.c in the RDK RDKB-20181217-1 CcspWifiAgent module allows attackers with login credentials to execute arbitrary shell… |
CVE-2019-1879 | Medium | 6.4 | 2019-06-20 | A vulnerability in the CLI of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker to inject arbitrary commands that are e… |
CVE-2019-1878 | High | 7.5 | 2019-06-20 | A vulnerability in the Cisco Discovery Protocol (CDP) implementation for the Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE) Software could allow… |
CVE-2019-1627 | Medium | 6.5 | 2019-06-20 | A vulnerability in the Server Utilities of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to gain unauthorized acce… |
CVE-2019-1623 | Medium | 6.7 | 2019-06-20 | A vulnerability in the CLI configuration shell of Cisco Meeting Server could allow an authenticated, local attacker to inject arbitrary commands as the root us… |
CVE-2018-16593 | High | 8.8 | 2019-06-19 | The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices allows Shell Metacharacter Injection. |
CVE-2018-16618 | Critical | 9.8 | 2019-06-19 | VTech Storio Max before 56.D3JM6 allows remote command execution via shell metacharacters in an Android activity name. It exposes the storeintenttranslate.x se… |
CVE-2018-18472 | Critical | 9.8 | 2019-06-19 | Western Digital WD My Book Live and WD My Book Live Duo (all versions) have a root Remote Command Execution bug via shell metacharacters in the /api/1.0/rest/l… |
CVE-2018-18852 | High | 8.8 | 2019-06-18 | Cerio DT-300N 1.1.6 through 1.1.12 devices allow OS command injection because of improper input validation of the web-interface PING feature's use of Save.cgi… |
CVE-2019-11410 | High | 7.2 | 2019-06-17 | app/backup/index.php in the Backup Module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation, which allows aut… |
CVE-2019-11409 | High | 8.8 | 2019-06-17 | app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation th… |
CVE-2019-12181 | High | 8.8 | 2019-06-17 | A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux. |
CVE-2019-12840 | High | 8.8 | 2019-06-15 | In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to upda… |
CVE-2019-12839 | High | 8.8 | 2019-06-15 | In OrangeHRM 4.3.1 and before, there is an input validation error within admin/listMailConfiguration (txtSendmailPath parameter) that allows authenticated atta… |
CVE-2018-20841 | Critical | 9.8 | 2019-06-11 | HooToo TripMate Titan HT-TM05 and HT-05 routers with firmware 2.000.022 and 2.000.082 allow remote command execution via shell metacharacters in the mac parame… |
CVE-2019-3412 | Critical | 9.8 | 2019-06-11 | All versions up to BD_R218V2.4 of ZTE MF920 product are impacted by command execution vulnerability. Due to some interfaces do not adequately verify parameters… |
CVE-2019-3409 | Critical | 9.0 | 2019-06-11 | All versions up to UKBB_WF820+_1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by command injection vulnerability. Due to inadequate parameter veri… |
CVE-2019-12787 | High | 8.8 | 2019-06-10 | An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a command injection in HNAP1 SetWanSettings via an XML injection of… |
CVE-2019-12780 | Critical | 9.8 | 2019-06-10 | The Belkin Wemo Enabled Crock-Pot allows command injection in the Wemo UPnP API via the SmartDevURL argument to the SetSmartDevInfo action. A simple POST reque… |
CVE-2018-10702 | High | 8.8 | 2019-06-07 | An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any iss… |
CVE-2018-10699 | High | 8.8 | 2019-06-07 | An issue was discovered on Moxa AWK-3121 1.14 devices. The Moxa AWK 3121 provides certfile upload functionality so that an administrator can upload a certifica… |
CVE-2018-10697 | High | 8.8 | 2019-06-07 | An issue was discovered on Moxa AWK-3121 1.14 devices. The Moxa AWK 3121 provides ping functionality so that an administrator can execute ICMP calls to check i… |
CVE-2018-5265 | High | 7.2 | 2019-06-07 | Ubiquiti EdgeOS 1.9.1 on EdgeRouter Lite devices allows remote attackers to execute arbitrary code with admin credentials, because /opt/vyatta/share/vyatta-cfg… |
CVE-2019-12771 | Critical | 9.8 | 2019-06-07 | Command injection is possible in ThinStation through 6.1.1 via shell metacharacters after the cgi-bin/CdControl.cgi action= substring, or after the cgi-bin/Vol… |
CVE-2019-9156 | High | 8.0 | 2019-06-05 | Gemalto DS3 Authentication Server 2.6.1-SP01 allows OS Command Injection. |
CVE-2019-12739 | Critical | 9.0 | 2019-06-05 | lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution via shell metacharacters in a RAR filenam… |
CVE-2019-12735 | High | 8.6 | 2019-06-05 | getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as de… |
CVE-2019-10149 | Critical | 9.8 | 2019-06-05 | A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead t… |
CVE-2019-10883 | Critical | 9.8 | 2019-06-03 | Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow Command Injection. |
CVE-2019-6739 | High | 8.8 | 2019-06-03 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Malwarebytes Antimalware 3.6.1.2711. User interaction is re… |
CVE-2019-6738 | High | 8.8 | 2019-06-03 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is require… |
CVE-2019-6736 | High | 8.8 | 2019-06-03 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is require… |
CVE-2019-12585 | Critical | 9.8 | 2019-06-03 | Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status.php. |
CVE-2019-9653 | Critical | 9.8 | 2019-05-31 | NUUO Network Video Recorder Firmware 1.7.x through 3.3.x allows unauthenticated attackers to execute arbitrary commands via shell metacharacters to handle_load… |
CVE-2019-10048 | High | 7.2 | 2019-05-31 | The ImageMagick plugin that is installed by default in Pydio through 8.2.2 does not perform the appropriate validation and sanitization of user supplied input… |
CVE-2018-19977 | High | 8.0 | 2019-05-29 | A command injection (missing input validation, escaping) in the ftp upgrade configuration interface on the Auerswald COMfort 1200 IP phone 3.4.4.1-10589 allows… |
CVE-2018-16217 | High | 8.8 | 2019-05-29 | The network diagnostic function (ping) in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0.35) allows a remote authenticated attacker to trigger… |
CVE-2019-12272 | Critical | 9.8 | 2019-05-23 | In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affecte… |
CVE-2019-1768 | Medium | 6.7 | 2019-05-16 | A vulnerability in the implementation of a specific CLI command for Cisco NX-OS Software could allow an authenticated, local attacker with administrator creden… |
CVE-2019-1778 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating… |
CVE-2019-1776 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating… |
CVE-2019-1775 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1774 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1770 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands on… |
CVE-2019-1769 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands on… |
CVE-2019-1767 | Medium | 6.7 | 2019-05-15 | A vulnerability in the implementation of a specific CLI command for Cisco NX-OS Software could allow an authenticated, local attacker with administrator creden… |
CVE-2019-11224 | High | 8.8 | 2019-05-15 | HARMAN AMX MVP5150 v2.87.13 devices allow remote OS Command Injection. |
CVE-2019-1732 | Medium | 6.4 | 2019-05-15 | A vulnerability in the Remote Package Manager (RPM) subsystem of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentia… |
CVE-2019-1727 | Medium | 6.7 | 2019-05-15 | A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated, local attacker to escape the Python parser and issue ar… |
CVE-2019-1726 | High | 7.8 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to access internal services that should be restricted on an aff… |
CVE-2013-7285 | Critical | 9.8 | 2019-05-15 | Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell com… |
CVE-2019-3727 | Medium | 6.4 | 2019-05-15 | Dell EMC RecoverPoint versions prior to 5.1.3 and RecoverPoint for VMs versions prior to 5.2.0.2 contain an OS command injection vulnerability in the installat… |
CVE-2019-3725 | Critical | 9.8 | 2019-05-15 | RSA Netwitness Platform versions prior to 11.2.1.1 and RSA Security Analytics versions prior to 10.6.6.1 are vulnerable to a Command Injection vulnerability du… |
CVE-2018-14839 | Critical | 9.8 | 2019-05-14 | LG N1A1 NAS 3718.510 is affected by: Remote Command Execution. The impact is: execute arbitrary code (remote). The attack vector is: HTTP POST with parameters. |
CVE-2019-3702 | High | 8.8 | 2019-05-13 | A Remote Code Execution issue in the DNS Query Web UI in Lifesize Icon LS_RM3_3.7.0 (2421) allows remote authenticated attackers to execute arbitrary commands… |
CVE-2018-19990 | Critical | 9.8 | 2019-05-13 | In the /HNAP1/SetWiFiVerifyAlpha message, the WPSPIN parameter is vulnerable, and the vulnerability affects D-Link DIR-822 B1 202KRb06 devices. In the SetWiFiV… |
CVE-2018-19989 | Critical | 9.8 | 2019-05-13 | In the /HNAP1/SetQoSSettings message, the uplink parameter is vulnerable, and the vulnerability affects D-Link DIR-822 Rev.B 202KRb06 and DIR-822 Rev.C 3.10B06… |
CVE-2018-19988 | Critical | 9.8 | 2019-05-13 | In the /HNAP1/SetClientInfoDemo message, the AudioMute and AudioEnable parameters are vulnerable, and the vulnerabilities affect D-Link DIR-868L Rev.B 2.05B02… |
CVE-2018-19987 | Critical | 9.8 | 2019-05-13 | D-Link DIR-822 Rev.B 202KRb06, DIR-822 Rev.C 3.10B06, DIR-860L Rev.B 2.03.B03, DIR-868L Rev.B 2.05B02, DIR-880L Rev.A 1.20B01_01_i3se_BETA, and DIR-890L Rev.A… |
CVE-2018-19986 | Critical | 9.8 | 2019-05-13 | In the /HNAP1/SetRouterSettings message, the RemotePort parameter is vulnerable, and the vulnerability affects D-Link DIR-818LW Rev.A 2.05.B03 and DIR-822 B1 2… |
CVE-2018-7084 | Critical | 9.8 | 2019-05-10 | A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web interface to execute arbitrary system co… |
CVE-2018-7082 | High | 7.2 | 2019-05-10 | A command injection vulnerability is present in Aruba Instant that permits an authenticated administrative user to execute arbitrary commands on the underlying… |
CVE-2019-11353 | Critical | 9.8 | 2019-05-09 | The EnGenius EWS660AP router with firmware 2.0.284 allows an attacker to execute arbitrary commands using the built-in ping and traceroute utilities by using d… |
CVE-2018-4061 | High | 8.8 | 2019-05-06 | An exploitable command injection vulnerability exists in the ACEManager iplogging.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially craf… |
CVE-2019-1709 | Medium | 6.0 | 2019-05-03 | A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to perform a command injection attack… |
CVE-2019-1699 | Medium | 6.7 | 2019-05-03 | A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to perform a command injection attack… |
CVE-2017-18372 | High | 8.8 | 2019-05-02 | The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Setting function, which… |
CVE-2017-18370 | High | 8.8 | 2019-05-02 | The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding functio… |
CVE-2017-18369 | Critical | 9.8 | 2019-05-02 | The Billion 5200W-T 1.02b.rc5.dt49 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which i… |
CVE-2017-18368 | Critical | 9.8 | 2019-05-02 | The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System… |
CVE-2019-11627 | Critical | 9.8 | 2019-04-30 | gpg-key2ps in signing-party 1.1.x and 2.x before 2.10-1 contains an unsafe shell call enabling shell injection via a User ID. |
CVE-2019-3929 | Critical | 9.8 | 2019-04-30 | The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmwar… |
CVE-2019-3926 | Critical | 9.8 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to command injection via SNMP OID iso.3.6.1.4.1.3212.100.3.2.14.1. A remo… |
CVE-2019-3925 | Critical | 9.8 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to command injection via SNMP OID iso.3.6.1.4.1.3212.100.3.2.9.3. A remot… |
CVE-2019-9804 | Critical | 9.8 | 2019-04-26 | In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause the execution of unint… |
CVE-2019-11539 | High | 7.2 | 2019-04-26 | In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secu… |
CVE-2018-16660 | High | 8.8 | 2019-04-25 | A command injection vulnerability in PWS in Imperva SecureSphere 13.0.0.10 and 13.1.0.10 Gateway allows an attacker with authenticated access to execute arbitr… |
CVE-2018-16216 | High | 8.0 | 2019-04-25 | A command injection (missing input validation, escaping) in the monitoring or memory status web interface in AudioCodes 405HD (firmware 2.2.12) VoIP phone allo… |
CVE-2018-20434 | Critical | 9.8 | 2019-04-24 | LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to html/pages/addhost.inc.php during creation… |
CVE-2019-11444 | High | 7.2 | 2019-04-22 | An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. Commands can be executed vi… |
CVE-2019-9161 | Critical | 9.8 | 2019-04-18 | WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a Remote Code Execution issue allowing remote attackers to achieve full access to th… |
CVE-2019-11322 | Critical | 9.8 | 2019-04-18 | An issue was discovered in Motorola CX2 1.01 and M2 1.01. There is a command injection in the function startRmtAssist in hnap, which leads to remote code execu… |
CVE-2019-11319 | Critical | 9.8 | 2019-04-18 | An issue was discovered in Motorola CX2 1.01 and M2 1.01. There is a command injection in the function downloadFirmware in hnap, which leads to remote code exe… |
CVE-2019-1829 | Medium | 6.7 | 2019-04-18 | A vulnerability in the CLI of Cisco Aironet Series Access Points (APs) could allow an authenticated, local attacker to gain access to the underlying Linux oper… |
CVE-2019-1725 | Medium | 5.5 | 2019-04-18 | A vulnerability in the local management CLI implementation for specific commands on the Cisco UCS B-Series Blade Servers could allow an authenticated, local at… |
CVE-2019-4202 | Critical | 10.0 | 2019-04-15 | IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can run arbitrary code on… |
CVE-2019-0232 | High | 8.1 | 2019-04-15 | When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulner… |
CVE-2019-10880 | Critical | 9.8 | 2019-04-12 | Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "HTTP" request (OS C… |
CVE-2019-3914 | High | 7.2 | 2019-04-11 | Remote command injection vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows a remote, authenticated attacker to execute… |
CVE-2019-5425 | High | 8.8 | 2019-04-10 | In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an authenticated user can execute arbitrary shell commands over the SSH interface bypassing the CLI interfa… |