CWE-88 · Argument Injection (page 4)
Page 4 of 5 — CVEs classified under CWE-88, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-21224 | Critical | 9.8 | 2021-02-22 | A Remote Code Execution vulnerability has been found in Inspur ClusterEngine V4.0. A remote attacker can send a malicious login packet to the control server |
CVE-2021-26937 | Critical | 9.8 | 2021-02-09 | encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspe… |
CVE-2021-3401 | Critical | 9.8 | 2021-02-04 | Bitcoin Core before 0.19.0 might allow remote attackers to execute arbitrary code when another application unsafely passes the -platformpluginpath argument to… |
CVE-2020-35136 | High | 7.2 | 2020-12-23 | Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by… |
CVE-2020-7769 | High | 8.6 | 2020-11-12 | This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transpor… |
CVE-2020-25268 | High | 8.8 | 2020-11-10 | Remote Code Execution can occur via the external news feed in ILIAS 6.4 because of incorrect parameter sanitization for Magpie RSS data. |
CVE-2020-27129 | Medium | 6.7 | 2020-11-06 | A vulnerability in the remote management feature of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to inject arbitrary commands and… |
CVE-2020-5648 | Critical | 9.8 | 2020-11-06 | Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of GT14 Model of G… |
CVE-2020-5657 | Medium | 6.5 | 2020-11-02 | Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R ser… |
CVE-2020-15238 | High | 7.1 | 2020-10-27 | Blueman is a GTK+ Bluetooth Manager. In Blueman before 2.1.4, the DhcpClient method of the D-Bus interface to blueman-mechanism is prone to an argument injecti… |
CVE-2020-5792 | High | 7.2 | 2020-10-20 | Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultima… |
CVE-2020-14027 | Medium | 5.3 | 2020-09-22 | An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings accept custom unsafe arguments, such as ENABLE_LOCAL_INFILE, th… |
CVE-2020-4492 | Medium | 5.5 | 2020-08-31 | IBM Spectrum Scale V5.0.0.0 through V5.0.4.3 and V4.2.0.0 through V4.2.3.21 could allow a local attacker to cause a denial of service crashing the kernel by se… |
CVE-2020-15692 | Critical | 9.8 | 2020-08-14 | In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be ope… |
CVE-2020-17367 | High | 7.8 | 2020-08-11 | Firejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option, which may lead to command injection. |
CVE-2020-13699 | High | 8.8 | 2020-07-29 | TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. A malicious website could launch TeamViewer with arbitrary parame… |
CVE-2020-3380 | High | 7.8 | 2020-07-16 | A vulnerability in the CLI of Cisco Data Center Network Manager (DCNM) could allow an authenticated, local attacker to elevate privileges to root and execute a… |
CVE-2020-5599 | Critical | 9.8 | 2020-07-07 | TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT2… |
CVE-2020-14049 | High | 7.5 | 2020-06-22 | Viber for Windows up to 13.2.0.39 does not properly quote its custom URI handler. A malicious website could launch Viber with arbitrary parameters, forcing a v… |
CVE-2020-14421 | High | 7.2 | 2020-06-18 | aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via the Script Content box on the Add Cron Job screen. |
CVE-2020-7496 | High | 7.8 | 2020-06-16 | A CWE-88: Argument Injection or Modification vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo… |
CVE-2020-7808 | High | 8.7 | 2020-05-21 | In RAONWIZ K Upload v2018.0.2.51 and prior, automatic update processing without integrity check on update module(web.js) allows an attacker to modify arguments… |
CVE-2020-1738 | Low | 3.9 | 2020-03-16 | A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a m… |
CVE-2020-5546 | High | 8.8 | 2020-03-16 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in TCP function included in the firmware of Mitsubishi Electri… |
CVE-2020-6799 | High | 8.8 | 2020-03-02 | Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types. This required Firefox to be co… |
CVE-2019-18888 | High | 7.5 | 2019-11-21 | An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalida… |
CVE-2019-5013 | High | 7.8 | 2019-10-24 | An exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3, update helper service in the start/stopLaunchDProcess command… |
CVE-2019-5012 | High | 7.8 | 2019-10-24 | An exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3, update helper service in the startProcess command. The command… |
CVE-2019-12148 | Critical | 9.8 | 2019-10-22 | The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to an authentication bypass via an argument injection vulnerability invol… |
CVE-2019-12147 | Critical | 9.8 | 2019-10-22 | The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to Argument Injection via special characters in the username field. Upon… |
CVE-2019-11751 | High | 8.8 | 2019-09-27 | Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as when a user clicks on malicious links i… |
CVE-2019-15541 | High | 7.5 | 2019-08-26 | rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service (loop of conn_event and ready) by arr… |
CVE-2019-10746 | Critical | 9.8 | 2019-08-23 | mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying p… |
CVE-2019-15498 | High | 8.8 | 2019-08-23 | cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injectio… |
CVE-2019-12264 | High | 7.1 | 2019-08-05 | Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Control in IPv4 assignment by the ipdhcpc DHCP client component. |
CVE-2019-12578 | High | 7.8 | 2019-07-11 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary… |
CVE-2019-13475 | High | 8.8 | 2019-07-09 | In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commands when the user… |
CVE-2017-15694 | Medium | 6.5 | 2019-06-21 | When an Apache Geode server versions 1.0.0 to 1.8.0 is operating in secure mode, a user with write permissions for specific data regions can modify internal cl… |
CVE-2019-8321 | High | 7.5 | 2019-06-17 | An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is po… |
CVE-2019-11582 | High | 8.8 | 2019-06-14 | An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers, in all versions prior to 3.1.3, allows remote attackers to gain remote… |
CVE-2019-5804 | Medium | 5.5 | 2019-05-23 | Incorrect command line processing in Chrome in Google Chrome prior to 73.0.3683.75 allowed a local attacker to perform domain spoofing via a crafted domain nam… |
CVE-2019-1780 | Medium | 6.7 | 2019-05-16 | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execu… |
CVE-2019-1795 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the un… |
CVE-2019-1791 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands wi… |
CVE-2019-1790 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with valid administrator credentials to execute arbitrary comma… |
CVE-2019-1784 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating… |
CVE-2019-1783 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands on… |
CVE-2019-1782 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the un… |
CVE-2019-1781 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the un… |
CVE-2019-1779 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the un… |
CVE-2019-1735 | High | 7.8 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges on the u… |
CVE-2019-3931 | High | 8.8 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to argumention injection to the curl binary via crafted HTTP requests to… |
CVE-2019-9794 | Critical | 9.8 | 2019-04-26 | A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This cou… |
CVE-2019-0764 | Medium | 6.5 | 2019-04-09 | A tampering vulnerability exists when Microsoft browsers do not properly validate input under specific conditions, aka 'Microsoft Browsers Tampering Vulnerabil… |
CVE-2019-1613 | Medium | 6.7 | 2019-03-11 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1611 | Medium | 6.7 | 2019-03-11 | A vulnerability in the CLI of Cisco NX-OS Software and Cisco FXOS Software could allow an authenticated, local attacker to execute arbitrary commands on the un… |
CVE-2019-1610 | Medium | 6.7 | 2019-03-11 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1609 | Medium | 6.7 | 2019-03-08 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1608 | Medium | 6.7 | 2019-03-08 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1607 | Medium | 6.7 | 2019-03-08 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1606 | High | 7.8 | 2019-03-08 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2018-20234 | High | 8.8 | 2019-03-08 | There was an argument injection vulnerability in Atlassian Sourcetree for macOS from version 1.2 before version 3.1.1 via filenames in Mercurial repositories… |
CVE-2019-6453 | High | 8.1 | 2019-02-18 | mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers. The attacker can specify an irc:// URI that… |
CVE-2019-3463 | Critical | 9.8 | 2019-02-06 | Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform on… |
CVE-2018-19518 | High | 7.5 | 2018-11-25 | University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap func… |
CVE-2018-11025 | High | 7.5 | 2018-10-16 | kernel/omap/drivers/mfd/twl6030-gpadc.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument via… |
CVE-2018-11024 | High | 7.5 | 2018-10-16 | kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD (3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argumen… |
CVE-2018-11023 | High | 7.5 | 2018-10-16 | kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD (3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argumen… |
CVE-2018-11022 | High | 7.5 | 2018-10-16 | kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument… |
CVE-2018-11021 | High | 7.5 | 2018-10-16 | kernel/omap/drivers/video/omap2/dsscomp/device.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted arg… |
CVE-2018-11020 | Medium | 4.4 | 2018-10-16 | kernel/omap/drivers/rpmsg/rpmsg_omx.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument via t… |
CVE-2018-11019 | High | 7.5 | 2018-10-16 | kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument… |
CVE-2018-17456 | Critical | 9.8 | 2018-10-06 | Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code executio… |
CVE-2018-3856 | Critical | 9.9 | 2018-08-23 | An exploitable vulnerability exists in the smart cameras RTSP configuration of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The device i… |
CVE-2018-13386 | High | 8.1 | 2018-07-24 | There was an argument injection vulnerability in Sourcetree for Windows via filenames in Mercurial repositories. An attacker with permission to commit to a Mer… |
CVE-2018-13385 | Critical | 9.8 | 2018-07-24 | There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. An attacker with permission to commit to a Mercu… |
CVE-2018-0345 | High | 8.8 | 2018-07-18 | A vulnerability in the configuration and management database of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to execute arbitrary co… |
CVE-2018-10992 | Critical | 9.8 | 2018-05-11 | lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows r… |
CVE-2017-14591 | Critical | 9.0 | 2017-11-29 | Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, all… |
CVE-2017-1001003 | Critical | 9.8 | 2017-11-27 | math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object. |
CVE-2016-1000222 | High | 7.5 | 2017-06-16 | Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data. |
CVE-2016-10033 | Critical | 9.8 | 2016-12-30 | The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and conseque… |
CVE-2007-0882 | | 2007-02-12 | Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "-f" sequences as va… | |
CVE-2006-6597 | | 2006-12-15 | Argument injection vulnerability in HyperAccess 8.4 allows user-assisted remote attackers to execute arbitrary vbscript and commands via the /r option in a tel… | |
CVE-2006-4692 | | 2006-10-10 | Argument injection vulnerability in the Windows Object Packager (packager.exe) in Microsoft Windows XP SP1 and SP2 and Server 2003 SP1 and earlier allows remot… | |
CVE-2006-3015 | | 2006-06-14 | Argument injection vulnerability in WinSCP 3.8.1 build 328 allows remote attackers to upload or download arbitrary files via encoded spaces and double-quote ch… | |
CVE-2006-2312 | | 2006-05-19 | Argument injection vulnerability in the URI handler in Skype 2.0.*.104 and 2.5.*.0 through 2.5.*.78 for Windows allows remote authorized attackers to download… | |
CVE-2006-2058 | | 2006-04-26 | Argument injection vulnerability in Avant Browser 10.1 Build 17 allows user-assisted remote attackers to modify command line arguments to an invoked mail clien… | |
CVE-2006-2057 | | 2006-04-26 | Argument injection vulnerability in Mozilla Firefox 1.0.6 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via… | |
CVE-2006-2056 | | 2006-04-26 | Argument injection vulnerability in Internet Explorer 6 for Windows XP SP2 allows user-assisted remote attackers to modify command line arguments to an invoked… | |
CVE-2006-2055 | | 2006-04-26 | Argument injection vulnerability in Microsoft Outlook 2003 SP1 allows user-assisted remote attackers to modify command line arguments to an invoked mail client… | |
CVE-2006-1865 | | 2006-04-21 | Argument injection vulnerability in Beagle before 0.2.5 allows attackers to execute arbitrary commands via crafted filenames that inject command line arguments… | |
CVE-2005-4699 | | 2005-12-31 | Argument injection vulnerability in TellMe 1.2 and earlier allows remote attackers to modify command line arguments for the Whois program and obtain sensitive… | |
CVE-2004-0480 | | 2004-12-06 | Argument injection vulnerability in IBM Lotus Notes 6.0.3 and 6.5 allows remote attackers to execute arbitrary code via a notes: URI that uses a UNC network sh… | |
CVE-2004-0489 | | 2004-07-07 | Argument injection vulnerability in the SSH URI handler for Safari on Mac OS 10.3.3 and earlier allows remote attackers to (1) execute arbitrary code via the P… | |
CVE-2004-0473 | | 2004-07-07 | Argument injection vulnerability in Opera before 7.50 does not properly filter "-" characters that begin a hostname in a telnet URI, which allows remote attack… | |
CVE-2004-0411 | | 2004-07-07 | The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4… | |
CVE-2003-0907 | | 2004-06-01 | Help and Support Center in Microsoft Windows XP SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code via quotation… | |
CVE-2004-0121 | | 2004-04-15 | Argument injection vulnerability in Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OU… | |
CVE-2002-0985 | | 2002-09-24 | Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line argumen… |