Loading...
Loading...
5,508 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that register custom protocol handlers can b…
OpenEMR version 5.0.0 contains a OS Command Injection vulnerability in fax_dispatch.php that can result in OS command injection by an authenticated attacker with any role. This vulnerability appears to have been fixed in 5.0.0 Patch 2 or h…
Security Onion Solutions Squert version 1.3.0 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in .inc/callback.php that can result in execution of OS C…
Security Onion Solutions Squert version 1.0.1 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in .inc/callback.php that can result in execution of OS C…
Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol h…
GIG Technology NV JumpScale Portal 7 version before commit 15443122ed2b1cbfd7bdefc048bf106f075becdb contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in method: noti…
PHKP version including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b contains a Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in function pgp_exec() phkp.php:98 that can result in It is…
A command injection remote command execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary code on vulnerable installations due to a flaw in the LauncherServer. Authentication …
D-Link DIR-615 2.5.17 devices allow Remote Code Execution via shell metacharacters in the Host field of the System / Traceroute screen.
An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the …
NetGain Enterprise Manager (EM) is affected by OS Command Injection vulnerabilities in versions before 10.0.57. These vulnerabilities could allow remote authenticated attackers to inject arbitrary code, resulting in remote code execution.
An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection.
An issue was discovered on Moxa AWK-3121 1.14 devices. The Moxa AWK 3121 provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. However, the same functionality allows an at…
An issue was discovered on Moxa AWK-3121 1.14 devices. The Moxa AWK 3121 provides certfile upload functionality so that an administrator can upload a certificate file used for connecting to the wireless network. However, the same functiona…
An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on t…
All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to OS command injection.
An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. An authenticated attacker may execute arbitrary code by injec…
Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, a…
CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged use…
On D-Link DIR-550A and DIR-604M devices through v2.10KR, a malicious user can forge an HTTP request to inject operating system commands that can be executed on the device with higher privileges, aka remote code execution.
An issue was discovered on Dongguan Diqee Diqee360 devices. The affected vacuum cleaner suffers from an authenticated remote code execution vulnerability. An authenticated attacker can send a specially crafted UDP packet, and execute comma…
'getlogs' utility in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1 and 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 is affected by an OS command injection …
DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local…
In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized with root privileges and only allows a set of commands to be executed. A command …
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.
The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to c…
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 1 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 2 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 3 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 4 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 5 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 6 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 7 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 8 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 9 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 10 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 11 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 12 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 13 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 14 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 15 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 16 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 17 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 18 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 19 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 20 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 21 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 22 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 23 of 46).
EchelonGraph correlates every CVE — across CWE-78 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Start Free Scan →