CWE-78 · OS Command Injection (page 62)
Page 62 of 70 — CVEs classified under CWE-78, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-5424 | High | 8.8 | 2019-04-10 | In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, a privileged user can execute arbitrary shell commands over the SSH CLI interface. This allows to execute s… |
CVE-2019-10631 | High | 8.8 | 2019-04-09 | Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via m… |
CVE-2019-11001 | High | 7.2 | 2019-04-08 | On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and… |
CVE-2019-6552 | Critical | 9.8 | 2019-04-05 | Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple command injection vulnerabilities, caused by a lack of proper validation of user-supplied data, m… |
CVE-2019-9193 | High | 7.2 | 2019-04-01 | In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary c… |
CVE-2018-17990 | High | 8.8 | 2019-04-01 | An issue was discovered on D-Link DSL-3782 devices with firmware 1.01. An OS command injection vulnerability in Acl.asp allows a remote authenticated attacker… |
CVE-2018-17565 | Critical | 9.8 | 2019-04-01 | Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system comm… |
CVE-2018-5757 | High | 8.8 | 2019-04-01 | An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality, which uses a parameter in a re… |
CVE-2018-13285 | High | 7.5 | 2019-04-01 | Command injection vulnerability in ftpd in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to execute arbitrary OS commands… |
CVE-2018-13284 | High | 7.5 | 2019-04-01 | Command injection vulnerability in ftpd in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS comm… |
CVE-2019-10662 | High | 8.8 | 2019-03-30 | Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-ba… |
CVE-2019-10660 | High | 8.8 | 2019-03-30 | Grandstream GXV3611IR_HD before 1.0.3.23 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the /goform/systemlog?c… |
CVE-2019-10659 | High | 8.8 | 2019-03-30 | Grandstream GXV3370 before 1.0.1.41 and WP820 before 1.0.3.6 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in a /… |
CVE-2019-10658 | High | 8.8 | 2019-03-30 | Grandstream GWN7610 before 1.0.8.18 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/cont… |
CVE-2019-10657 | Medium | 6.5 | 2019-03-30 | Grandstream GWN7000 before 1.0.6.32 and GWN7610 before 1.0.8.18 devices allow remote authenticated users to discover passwords via a /ubus/uci.apply config req… |
CVE-2019-10656 | High | 8.8 | 2019-03-30 | Grandstream GWN7000 before 1.0.6.32 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/uci… |
CVE-2019-10655 | Critical | 9.8 | 2019-03-30 | Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0.3.219 Beta devices allow unauthenticate… |
CVE-2019-1745 | High | 7.8 | 2019-03-28 | A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with elevated privileges… |
CVE-2019-10061 | Critical | 9.8 | 2019-03-26 | utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowi… |
CVE-2018-3969 | High | 7.8 | 2019-03-21 | An exploitable vulnerability exists in the verified boot protection of the CUJO Smart Firewall. It is possible to add arbitrary shell commands into the dhcpd.c… |
CVE-2019-7385 | High | 7.8 | 2019-03-21 | An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware… |
CVE-2019-7384 | High | 7.8 | 2019-03-21 | An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware… |
CVE-2019-7383 | High | 7.8 | 2019-03-21 | An issue was discovered on Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W devices with firmware V1.1-R2.1_TRUNK-20181105.bin. A shell command injection occu… |
CVE-2019-5414 | High | 8.1 | 2019-03-21 | If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of the exec function in… |
CVE-2018-20323 | High | 8.8 | 2019-03-21 | www/soap/application/MCSoap/Logs.php in MailCleaner Community Edition 2018.08 allows remote attackers to execute arbitrary OS commands. |
CVE-2018-20218 | Critical | 9.8 | 2019-03-21 | An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input directly to a shell command without any kind… |
CVE-2018-20106 | Medium | 6.5 | 2019-03-15 | In yast2-printer up to and including version 4.0.2 the SMB printer settings don't escape characters in passwords properly. If a password with backticks or siml… |
CVE-2019-9785 | High | 7.8 | 2019-03-14 | gitnote 3.1.0 allows remote attackers to execute arbitrary code via a crafted Markdown file, as demonstrated by a javascript:window.parent.top.require('child_p… |
CVE-2018-1998 | High | 8.8 | 2019-03-11 | IBM WebSphere MQ 8.0.0.0 through 9.1.1 could allow a local user to inject code that could be executed with root privileges. This is due to an incomplete fix fo… |
CVE-2019-1614 | High | 8.8 | 2019-03-11 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges… |
CVE-2019-1612 | Medium | 4.2 | 2019-03-11 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-9121 | Critical | 9.8 | 2019-03-07 | An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to… |
CVE-2019-9120 | Critical | 9.8 | 2019-03-07 | An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to… |
CVE-2019-9119 | Critical | 9.8 | 2019-03-07 | An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to… |
CVE-2019-9118 | Critical | 9.8 | 2019-03-07 | An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to… |
CVE-2019-9117 | Critical | 9.8 | 2019-03-07 | An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to… |
CVE-2019-1591 | High | 7.8 | 2019-03-06 | A vulnerability in a specific CLI command implementation of Cisco Nexus 9000 Series ACI Mode Switch Software could allow an authenticated, local attacker to es… |
CVE-2019-3920 | High | 8.8 | 2019-03-05 | The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to authenticated command injection via crafted HTTP request sent by a… |
CVE-2019-3919 | High | 8.8 | 2019-03-05 | The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to command injection via crafted HTTP request sent by a remote, authen… |
CVE-2018-19639 | Medium | 6.7 | 2019-03-05 | If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipulate the rpm listing (e.g. with CVE-2018-… |
CVE-2019-1674 | High | 7.8 | 2019-02-28 | A vulnerability in the update service of Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools for Windows could allow an authenticated, local at… |
CVE-2019-9194 | Critical | 9.8 | 2019-02-26 | elFinder before 2.1.48 has a command injection vulnerability in the PHP connector. |
CVE-2018-20122 | Critical | 9.8 | 2019-02-21 | The web interface on FASTGate Fastweb devices with firmware through 0.00.47_FW_200_Askey 2017-05-17 (software through 1.0.1b) exposed a CGI binary that is vuln… |
CVE-2018-15380 | High | 8.8 | 2019-02-20 | A vulnerability in the cluster service manager of Cisco HyperFlex Software could allow an unauthenticated, adjacent attacker to execute commands as the root us… |
CVE-2019-8427 | Critical | 9.8 | 2019-02-18 | daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters. |
CVE-2019-8319 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-8318 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-8317 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-8316 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-8315 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-8314 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-8313 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-8312 | High | 8.8 | 2019-02-13 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code… |
CVE-2019-5736 | High | 8.6 | 2019-02-11 | runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host roo… |
CVE-2019-7632 | High | 8.8 | 2019-02-08 | LifeSize Team, Room, Passport, and Networker 220 devices allow Authenticated Remote OS Command Injection, as demonstrated by shell metacharacters in the suppor… |
CVE-2019-3704 | High | 7.8 | 2019-02-07 | VNX Control Station in Dell EMC VNX2 OE for File versions prior to 8.1.9.236 contains OS command injection vulnerability. Due to inadequate restriction configu… |
CVE-2019-7301 | High | 7.2 | 2019-02-01 | Zen Load Balancer 3.10.1 allows remote authenticated admin users to execute arbitrary commands as root via shell metacharacters in the index.cgi?action=View_Ce… |
CVE-2019-7298 | High | 8.1 | 2019-02-01 | An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS co… |
CVE-2019-7297 | Critical | 9.8 | 2019-01-31 | An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS co… |
CVE-2019-3913 | Medium | 4.9 | 2019-01-30 | Command manipulation in LabKey Server Community Edition before 18.3.0-61806.763 allows an authenticated remote attacker to unmount any drive on the system lead… |
CVE-2018-19015 | High | 7.3 | 2019-01-28 | An attacker could inject commands to launch programs and create, write, and read files on CX-Supervisor (Versions 3.42 and prior) through a specially crafted p… |
CVE-2018-12237 | High | 7.2 | 2019-01-24 | The Symantec Reporter CLI 10.1 prior to 10.1.5.6 and 10.2 prior to 10.2.1.8 is susceptible to an OS command injection vulnerability. An authenticated malicious… |
CVE-2019-1652 | High | 7.2 | 2019-01-24 | A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote… |
CVE-2019-1650 | High | 8.8 | 2019-01-24 | A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to overwrite arbitrary files on the underlying operating system of a… |
CVE-2018-17707 | High | 8.8 | 2019-01-24 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Epic Games Launcher versions prior to 8.2.2. User interacti… |
CVE-2019-1636 | High | 7.8 | 2019-01-23 | A vulnerability in the Cisco Webex Teams client, formerly Cisco Spark, could allow an attacker to execute arbitrary commands on a targeted system. This vulnera… |
CVE-2018-6444 | Critical | 9.8 | 2019-01-22 | A Vulnerability in Brocade Network Advisor versions before 14.1.0 could allow a remote unauthenticated attacker to execute arbitray code. The vulnerability cou… |
CVE-2019-6487 | High | 8.8 | 2019-01-18 | TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, beca… |
CVE-2018-20727 | High | 8.8 | 2019-01-17 | Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Tr… |
CVE-2018-16200 | High | 8.8 | 2019-01-09 | Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an attacker on the same network segment to execute ar… |
CVE-2018-16195 | High | 8.8 | 2019-01-09 | Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows an attacker on the same n… |
CVE-2018-16194 | High | 7.2 | 2019-01-09 | Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows authenticated attackers t… |
CVE-2018-16184 | Critical | 9.8 | 2019-01-09 | RICOH Interactive Whiteboard D2200 V1.6 to V2.2, D5500 V1.6 to V2.2, D5510 V1.6 to V2.2, and the display versions with RICOH Interactive Whiteboard Controller… |
CVE-2018-16167 | Critical | 9.8 | 2019-01-09 | LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors. |
CVE-2018-0677 | Medium | 6.8 | 2019-01-09 | BN-SDWBP3 firmware version 1.0.9 and earlier allows attacker with administrator rights on the same network segment to execute arbitrary OS commands via unspeci… |
CVE-2018-0639 | High | 7.2 | 2019-01-09 | Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via tools_firmware.cgi date parameter, time param… |
CVE-2018-0638 | High | 7.2 | 2019-01-09 | Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via import.cgi encKey parameter. |
CVE-2018-0637 | High | 7.2 | 2019-01-09 | Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via export.cgi encKey parameter. |
CVE-2018-0636 | High | 7.2 | 2019-01-09 | Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter of a certain URL, d… |
CVE-2018-0635 | High | 7.2 | 2019-01-09 | Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via filename parameter. |
CVE-2018-0634 | High | 7.2 | 2019-01-09 | Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter or bootmode paramet… |
CVE-2018-0631 | High | 7.2 | 2019-01-09 | Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter. |
CVE-2018-0630 | High | 7.2 | 2019-01-09 | Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd parameter. |
CVE-2018-0629 | High | 7.2 | 2019-01-09 | Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response. |
CVE-2018-0628 | High | 7.2 | 2019-01-09 | Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response. |
CVE-2018-0627 | High | 7.2 | 2019-01-09 | Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter. |
CVE-2018-0626 | High | 7.2 | 2019-01-09 | Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd in formWsc parameter. |
CVE-2018-0625 | High | 7.2 | 2019-01-09 | Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via formSysCmd parameter. |
CVE-2018-20114 | Critical | 9.8 | 2019-01-02 | On D-Link DIR-818LW Rev.A 2.05.B03 and DIR-860L Rev.B 2.03.B03 devices, unauthenticated remote OS command execution can occur in the soap.cgi service of the cg… |
CVE-2018-6342 | Critical | 9.8 | 2018-12-31 | react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor. The input to tha… |
CVE-2018-18600 | High | 8.1 | 2018-12-31 | The remote upgrade feature in Guardzilla GZ180 devices allow command injection via a crafted new firmware version parameter. |
CVE-2018-15007 | High | 7.8 | 2018-12-28 | The Sky Elite 6.0L+ Android device with a build fingerprint of SKY/x6069_trx_l601_sky/x6069_trx_l601_sky:6.0/MRA58K/1482897127:user/release-keys contains a pre… |
CVE-2018-14998 | Medium | 6.8 | 2018-12-28 | The Leagoo P1 Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a hidden root pri… |
CVE-2018-19239 | High | 7.2 | 2018-12-20 | TRENDnet TEW-673GRU v1.00b40 devices have an OS command injection vulnerability in the start_arpping function of the timer binary, which allows remote attacker… |
CVE-2018-15722 | High | 8.1 | 2018-12-20 | The Logitech Harmony Hub before version 4.15.206 is vulnerable to OS command injection via the time update request. A remote server or man in the middle can in… |
CVE-2018-1000885 | Critical | 9.8 | 2018-12-20 | PHKP version including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b contains a Improper Neutralization of Special Elements used in a Command ('Command Injec… |
CVE-2018-18555 | Critical | 9.9 | 2018-12-17 | A sandbox escape issue was discovered in VyOS 1.1.8. It provides a restricted management shell for operator users to administer the device. By issuing various… |
CVE-2018-19007 | Critical | 9.8 | 2018-12-14 | In Geutebrueck GmbH E2 Camera Series versions prior to 1.12.0.25 the DDNS configuration (in the Network Configuration panel) is vulnerable to an OS system comm… |
CVE-2018-20057 | High | 8.8 | 2018-12-11 | An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to e… |
CVE-2018-19660 | High | 8.8 | 2018-12-06 | An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Buil… |