CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- nvidia cuda toolkitNVIDIA Nsight Systems for Linux contains a vulnerability in the .run installer, where an attacker...7.3 High
- nvidia cuda toolkitNVIDIA Nsight Systems contains a vulnerability in the gfx_hotspot recipe, where an attacker could...7.3 High
- zoom communications inc. nodeZoom Node Deployments - Command Injection9.9 Critical
- thecus n4800eco nas server control panelThecus N4800Eco Nas Server Control Panel - Command Injection5.3 Medium
- toa corporation multiple network cameras trifora 3 seriesOS Command Injection vulnerability exists in multiple Network Cameras TRIFORA 3 series provided...8.7 High
- zesle zeslecpZesleCP 3.1.9 - Remote Code Execution (RCE) (Authenticated)8.7 High
- arcaneArcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE9.1 Critical
- national oceanic and atmospheric administration (noaa) live access server (las)NOAA PMEL Live Access Server (LAS) PyFerret command injection9.3 Critical
- roxy-wiRoxy-WI has a Command Injection via grep parameter in logs.py allows authenticated RCE7.5 High
- nvidia nsight graphicsNVIDIA NSIGHT Graphics for Linux contains a vulnerability where an attacker could cause command...7.8 High
- anysphere cursorCursor has a Terminal Tool Allowlist Bypass via Environment Variables7.2 High
- spring cli vscode extensionCommand injection vulnerability6.8 Medium
- jokkedk webgrindWebgrind 1.1 - Remote Command Execution (RCE) via dataFile Parameter9.3 Critical
- tdarrTdarr 2.00.15 - Command Injection9.3 Critical
- algo solutions 8028Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated)8.6 High
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 moreAuthenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface7.2 High
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 moreAuthenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface7.2 High
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 moreAuthenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface7.2 High
- mend renovate-ce, renovatebot renovate, mend renovate-ee-server +1 more +3 moreRenovate before 42.68.5 Remote Code Execution via Gradle Wrapper8.4 High
- adobe dreamweaver desktop, dreamweaver +1 moreDreamweaver Desktop | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)8.6 High
- fortinet fortisiemAn improper neutralization of special elements used in an os command ('os command injection')...9.4 Critical
- progress loadmaster, connection manager for objectscale*, ecs connection manager +2 more +4 moreOS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster8.4 High
- progress loadmaster, connection manager for objectscale, ecs connection manager +3 more +5 moreOS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster8.4 High
- sap se application server for abap and sap netweaver rfcsdkOS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK8.4 High
- maximmasiutin tinywebTinyWeb CGI Command Injection10.0 Critical
- merit lilin ipd, ipr, ld +6 more +8 moreMerit LILIN｜IP Camera - OS Command Injection8.7 High
- merit lilin dh032, dvr708, dvr716 +17 more +19 moreMerit LILIN｜NVR - OS Command Injection8.7 High
- broadcom dx netops spectrumSpectrum command injection in NCM service7.1 High
- sangfor operation and maintenance management system, operation and maintenance security management system +1 moreSangfor Operation and Maintenance Management System session SessionController os command injection6.9 Medium
- sangfor operation and maintenance management system, operation and maintenance security management system +1 moreSangfor Operation and Maintenance Management System getCmd WriterHandle.getCmd os command injection9.3 Critical
- sangfor operation and maintenance management systemSangfor Operation and Maintenance Management System HTTP POST Request getHis os command injection9.3 Critical
- sangfor operation and maintenance management systemSangfor Operation and Maintenance Management System VersionController.java uploadCN os command injection8.7 High
- amazon kiro ideCommand Injection in Kiro GitLab Merge Request Helper8.4 High
- dell data domain operating system, powerprotect data domain with data domain operating system (dd os) feature release, powerprotect data domain with data domain operating system (dd os) lts 2024 +2 more +4 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...6.5 Medium
- dell data domain operating system, powerprotect data domain with data domain operating system (dd os) feature release, powerprotect data domain with data domain operating system (dd os) lts 2025 +2 more +4 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...6.0 Medium
- vivotek ip7137, ip7137 firmware +1 moreCommand injection in Vivotek IP7137 cameras8.6 High
- zenitel tcis-3+, tcis-3 firmware +1 moreAuthenticated Remote Code Execution in the NTP-configuration8.6 High
- getgreenshot greenshotGreenshot Vulnerable to OS Command Injection via ExternalCommand Plugin7.8 High
- inim electronics s.r.l. smartliving smartlan/g/siINIM Electronics SmartLiving SmartLAN/G/SI <=6.x Remote Command Execution8.7 High
- flir systems, inc. thermal camera pt-seriesFLIR Thermal Camera PT-Series firmware version 8.0.0.64 Unauthenticated Remote Command Injection9.3 Critical
- flir systems, inc. thermal camera fc-s/ptFLIR Thermal Camera FC-S/PT firmware version 8.0.0.64 Authenticated OS Command Injection8.7 High
- pnpmpnpm vulnerable to Command Injection via environment variable substitution7.6 High
- kieback&peter neutrino-gltCommand injection in Kieback&Peter Neutrino-GLT6.9 Medium
- trendnet tew-811dru, tew-811dru firmware +1 moreTRENDnet TEW-811DRU httpd uapply.cgi setDeviceURL os command injection8.6 High
- trendnet tew-713re, tew-713re firmware +1 moreTRENDnet TEW-713RE formFSrvX os command injection9.3 Critical
- cayin technology smp-1000, smp-200, smp-2000 +16 more +18 moreCayin Signage Media Player 3.0 Authenticated Remote Command Injection via NTP Parameter8.7 High
- d-link dir-600, dir-608, dir-610 +14 more +16 moreD-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration Endpoint9.3 Critical
- coollabs coolifyCoolify has Git Repository RCE10.0 Critical
- coollabs coolifyCoolify has Docker Compose Injection issue9.4 Critical
- centreon infra monitoring, web +1 moreRCE via the backup feature available only to user with high privilege7.2 High
- Show moreLoading…