CWE-88 · Argument Injection (page 4)
Page 4 of 5 — CVEs classified under CWE-88, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-37027 | High | 7.2 | 2022-09-21 | Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM options. Administrators that can modify the Runtime Options in the web… |
CVE-2022-36069 | High | 7.3 | 2022-09-07 | Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such… |
CVE-2022-36804 | High | 8.8 | 2022-08-25 | Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18… |
CVE-2022-1399 | Critical | 9.1 | 2022-08-17 | An Argument Injection or Modification vulnerability in the "Change Secret" username field as used in the Discovery component of Device42 CMDB allows a local at… |
CVE-2022-37005 | High | 7.5 | 2022-08-10 | The Settings application has an argument injection vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-25973 | High | 7.8 | 2022-08-10 | All versions of package mc-kill-port are vulnerable to Arbitrary Command Execution via the kill function, due to missing sanitization of the port argument. |
CVE-2022-36322 | Medium | 5.4 | 2022-07-20 | In JetBrains TeamCity before 2022.04.2 build parameter injection was possible |
CVE-2019-10800 | Medium | 6.5 | 2022-07-13 | This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method. |
CVE-2022-25900 | High | 8.1 | 2022-07-01 | All versions of package git-clone are vulnerable to Command Injection due to insecure usage of the --upload-pack feature of git. |
CVE-2022-31084 | High | 8.1 | 2022-06-27 | LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 Ther… |
CVE-2022-31246 | Medium | 5.5 | 2022-06-17 | paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request (e.g., within QR code data). On Windows, this can lead… |
CVE-2022-24376 | High | 7.2 | 2022-06-10 | All versions of package git-promise are vulnerable to Command Injection due to an inappropriate fix of a prior [vulnerability](https://security.snyk.io/vuln/SN… |
CVE-2021-33473 | Critical | 9.1 | 2022-06-02 | An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. Thi… |
CVE-2022-26532 | High | 7.8 | 2022-05-24 | A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware v… |
CVE-2022-29215 | High | 7.5 | 2022-05-21 | RegionProtect is a plugin that allows users to manage certain events in certain regions of the world. Versions prior to 1.1.0 contain a YAML injection vulnerab… |
CVE-2022-29184 | High | 8.8 | 2022-05-20 | GoCD is a continuous delivery server. In GoCD versions prior to 22.1.0, it is possible for existing authenticated users who have permissions to edit or create… |
CVE-2022-25865 | High | 8.1 | 2022-05-13 | The package workspace-tools before 0.18.4 are vulnerable to Command Injection via git argument injection. When calling the fetchRemoteBranch(remote: string, re… |
CVE-2022-30240 | High | 7.8 | 2022-05-09 | An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift JDBC Driver 1.2.40 through 1.2.55 may… |
CVE-2022-30239 | High | 7.8 | 2022-05-09 | An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena JDBC Driver 2.0.25 through 2.0.28 may al… |
CVE-2022-29972 | High | 7.8 | 2022-05-09 | An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift ODBC Driver (1.4.14 through 1.4.21.100… |
CVE-2022-29971 | High | 7.8 | 2022-05-09 | An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena ODBC Driver 1.1.1 through 1.1.x before 1… |
CVE-2022-30284 | Critical | 9.0 | 2022-05-04 | In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not validate arguments)… |
CVE-2022-24437 | Critical | 9.8 | 2022-05-01 | The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for g… |
CVE-2022-25866 | High | 8.1 | 2022-04-25 | The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadable($url, array $re… |
CVE-2022-25648 | High | 8.1 | 2022-04-19 | The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, th… |
CVE-2022-24828 | High | 8.3 | 2022-04-13 | Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injectio… |
CVE-2022-28391 | High | 8.8 | 2022-04-03 | BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alte… |
CVE-2022-24066 | High | 8.1 | 2022-04-01 | The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMP… |
CVE-2022-24440 | High | 8.1 | 2022-04-01 | The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod… |
CVE-2022-21223 | High | 8.1 | 2022-04-01 | The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function (when using hg)… |
CVE-2022-21235 | High | 8.1 | 2022-04-01 | The package github.com/masterminds/vcs before 1.13.3 are vulnerable to Command Injection via argument injection. When hg is executed, argument strings are pass… |
CVE-2021-43736 | Critical | 9.8 | 2022-03-23 | CmsWing CMS 1.3.7 is affected by a Remote Code Execution (RCE) vulnerability via parameter: log rule |
CVE-2022-25766 | High | 8.8 | 2022-03-21 | The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /api/fetch endpoint. Us… |
CVE-2022-21187 | High | 8.1 | 2022-03-14 | The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url par… |
CVE-2022-24433 | High | 8.1 | 2022-03-11 | The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, bo… |
CVE-2022-23915 | High | 7.2 | 2022-03-04 | The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Aut… |
CVE-2022-24953 | Medium | 5.3 | 2022-02-17 | The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions. |
CVE-2022-23221 | Critical | 9.8 | 2022-01-19 | H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREAT… |
CVE-2021-43809 | Medium | 6.7 | 2021-12-08 | `Bundler` is a package for managing application dependencies in Ruby. In `bundler` versions before 2.2.33, when working with untrusted and apparently harmless… |
CVE-2021-37040 | Critical | 9.8 | 2021-12-08 | There is a Parameter injection vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause privilege escalation of files after C… |
CVE-2021-41146 | High | 8.8 | 2021-10-21 | qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers a… |
CVE-2021-38112 | High | 8.8 | 2021-09-22 | In the Amazon AWS WorkSpaces client 3.0.10 through 3.1.8 on Windows, argument injection in the workspaces:// URI handler can lead to remote code execution beca… |
CVE-2021-41316 | High | 8.1 | 2021-09-17 | The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery utility. An attacker (with permissions to add or edit jobs run b… |
CVE-2021-34718 | High | 8.1 | 2021-09-09 | A vulnerability in the SSH Server process of Cisco IOS XR Software could allow an authenticated, remote attacker to overwrite and read arbitrary files on the l… |
CVE-2021-21814 | High | 7.8 | 2021-08-13 | Within the function HandleFileArg the argument filepattern is under control of the user who passes it in from the command line. filepattern is passed directly… |
CVE-2021-3045 | Medium | 4.9 | 2021-08-11 | An OS command argument injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file… |
CVE-2021-3540 | Medium | 6.5 | 2021-07-22 | By abusing the 'install rpm info detail' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue… |
CVE-2021-34816 | High | 7.2 | 2021-07-21 | An Argument Injection issue in the plugin management of Etherpad 1.8.13 allows privileged users to execute arbitrary code on the server by installing plugins f… |
CVE-2021-36122 | High | 8.8 | 2021-07-13 | An issue was discovered in Echo ShareCare 8.15.5. The UnzipFile feature in Access/EligFeedParse_Sup/UnzipFile_Upd.cfm is susceptible to a command argument inje… |
CVE-2021-3256 | Medium | 6.5 | 2021-06-11 | KuaiFanCMS V5.x contains an arbitrary file read vulnerability in the html_url parameter of the chakanhtml.module.php file. |
CVE-2021-33564 | Critical | 9.8 | 2021-05-29 | An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL w… |
CVE-2021-1531 | High | 8.8 | 2021-05-22 | A vulnerability in the web UI of Cisco Modeling Labs could allow an authenticated, remote attacker to execute arbitrary commands with the privileges of the web… |
CVE-2021-31909 | Critical | 9.8 | 2021-05-11 | In JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was possible. |
CVE-2021-29472 | High | 8.8 | 2021-04-27 | Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctl… |
CVE-2021-29461 | High | 8.1 | 2021-04-20 | Discord Recon Server is a bot that allows one to do one's reconnaissance process from one's Discord. A vulnerability in Discord Recon Server prior to 0.0.3 cou… |
CVE-2020-7851 | High | 7.8 | 2021-04-19 | Innorix Web-Based File Transfer Solution versuibs prior to and including 9.2.18.385 contains a vulnerability that could allow remote files to be downloaded and… |
CVE-2021-1485 | Medium | 6.6 | 2021-04-08 | A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privi… |
CVE-2020-7850 | High | 7.8 | 2021-03-29 | NBBDownloader.ocx ActiveX Control in Groupware contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to… |
CVE-2021-21386 | Critical | 9.3 | 2021-03-24 | APKLeaks is an open-source project for scanning APK file for URIs, endpoints & secrets. APKLeaks prior to v2.0.3 allows remote attackers to execute arbitrary O… |
CVE-2021-1454 | Medium | 6.0 | 2021-03-24 | Multiple vulnerabilities in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system with… |
CVE-2021-1383 | Medium | 6.0 | 2021-03-24 | Multiple vulnerabilities in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system with… |
CVE-2021-21384 | Medium | 6.3 | 2021-03-19 | shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still… |
CVE-2021-24030 | Critical | 9.8 | 2021-03-10 | The fbgames protocol handler registered as part of Facebook Gameroom does not properly quote arguments passed to the executable. That allows a malicious URL to… |
CVE-2020-21224 | Critical | 9.8 | 2021-02-22 | A Remote Code Execution vulnerability has been found in Inspur ClusterEngine V4.0. A remote attacker can send a malicious login packet to the control server |
CVE-2021-26937 | Critical | 9.8 | 2021-02-09 | encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspe… |
CVE-2021-3401 | Critical | 9.8 | 2021-02-04 | Bitcoin Core before 0.19.0 might allow remote attackers to execute arbitrary code when another application unsafely passes the -platformpluginpath argument to… |
CVE-2020-35136 | High | 7.2 | 2020-12-23 | Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by… |
CVE-2020-7769 | High | 8.6 | 2020-11-12 | This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transpor… |
CVE-2020-25268 | High | 8.8 | 2020-11-10 | Remote Code Execution can occur via the external news feed in ILIAS 6.4 because of incorrect parameter sanitization for Magpie RSS data. |
CVE-2020-27129 | Medium | 6.7 | 2020-11-06 | A vulnerability in the remote management feature of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to inject arbitrary commands and… |
CVE-2020-5648 | Critical | 9.8 | 2020-11-06 | Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of GT14 Model of G… |
CVE-2020-5657 | Medium | 6.5 | 2020-11-02 | Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R ser… |
CVE-2020-15238 | High | 7.1 | 2020-10-27 | Blueman is a GTK+ Bluetooth Manager. In Blueman before 2.1.4, the DhcpClient method of the D-Bus interface to blueman-mechanism is prone to an argument injecti… |
CVE-2020-5792 | High | 7.2 | 2020-10-20 | Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultima… |
CVE-2020-14027 | Medium | 5.3 | 2020-09-22 | An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings accept custom unsafe arguments, such as ENABLE_LOCAL_INFILE, th… |
CVE-2020-4492 | Medium | 5.5 | 2020-08-31 | IBM Spectrum Scale V5.0.0.0 through V5.0.4.3 and V4.2.0.0 through V4.2.3.21 could allow a local attacker to cause a denial of service crashing the kernel by se… |
CVE-2020-15692 | Critical | 9.8 | 2020-08-14 | In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be ope… |
CVE-2020-17367 | High | 7.8 | 2020-08-11 | Firejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option, which may lead to command injection. |
CVE-2020-13699 | High | 8.8 | 2020-07-29 | TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. A malicious website could launch TeamViewer with arbitrary parame… |
CVE-2020-3380 | High | 7.8 | 2020-07-16 | A vulnerability in the CLI of Cisco Data Center Network Manager (DCNM) could allow an authenticated, local attacker to elevate privileges to root and execute a… |
CVE-2020-5599 | Critical | 9.8 | 2020-07-07 | TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT2… |
CVE-2020-14049 | High | 7.5 | 2020-06-22 | Viber for Windows up to 13.2.0.39 does not properly quote its custom URI handler. A malicious website could launch Viber with arbitrary parameters, forcing a v… |
CVE-2020-14421 | High | 7.2 | 2020-06-18 | aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via the Script Content box on the Add Cron Job screen. |
CVE-2020-7496 | High | 7.8 | 2020-06-16 | A CWE-88: Argument Injection or Modification vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo… |
CVE-2020-7808 | High | 8.7 | 2020-05-21 | In RAONWIZ K Upload v2018.0.2.51 and prior, automatic update processing without integrity check on update module(web.js) allows an attacker to modify arguments… |
CVE-2020-1738 | Low | 3.9 | 2020-03-16 | A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a m… |
CVE-2020-5546 | High | 8.8 | 2020-03-16 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in TCP function included in the firmware of Mitsubishi Electri… |
CVE-2020-6799 | High | 8.8 | 2020-03-02 | Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types. This required Firefox to be co… |
CVE-2019-18888 | High | 7.5 | 2019-11-21 | An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalida… |
CVE-2019-5013 | High | 7.8 | 2019-10-24 | An exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3, update helper service in the start/stopLaunchDProcess command… |
CVE-2019-5012 | High | 7.8 | 2019-10-24 | An exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3, update helper service in the startProcess command. The command… |
CVE-2019-12148 | Critical | 9.8 | 2019-10-22 | The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to an authentication bypass via an argument injection vulnerability invol… |
CVE-2019-12147 | Critical | 9.8 | 2019-10-22 | The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to Argument Injection via special characters in the username field. Upon… |
CVE-2019-11751 | High | 8.8 | 2019-09-27 | Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as when a user clicks on malicious links i… |
CVE-2019-15541 | High | 7.5 | 2019-08-26 | rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service (loop of conn_event and ready) by arr… |
CVE-2019-10746 | Critical | 9.8 | 2019-08-23 | mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying p… |
CVE-2019-15498 | High | 8.8 | 2019-08-23 | cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injectio… |
CVE-2019-12264 | High | 7.1 | 2019-08-05 | Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Control in IPv4 assignment by the ipdhcpc DHCP client component. |
CVE-2019-12578 | High | 7.8 | 2019-07-11 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary… |
CVE-2019-13475 | High | 8.8 | 2019-07-09 | In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commands when the user… |