CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- helmholz rex100, rex200/250, mb connect line mbnet.mini +1 more +3 moreCommand injection via malicious configuration7.2 High
- oalders http::daemon, red hat enterprise linux 10, enterprise linux 7 +2 more +4 moreHTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()9.1 Critical
- tanium connectTanium addressed an unauthorized code execution vulnerability in Connect.8.8 High
github.com/sipeed/picoclawGo,govulncheck-vulndbopenSUSE +1 morepicoclaw is vulnerable to OS command injection via the ExecTool component7.3 High- No product listed@pensar/apex <= 0.0.58 is vulnerable to OS command injection via the smart_enumerate tool. The...8.8 High
- prolix-oc lumiverseLumiverse: Spindle extension install runs untrusted lifecycle scripts before security scan9.1 Critical
- openvpn connectPrivilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS...9.4 Critical
- twentyTwenty: SQL Injection via the timeZone field9.9 Critical
- haojing8312 workclawhaojing8312 WorkClaw Blacklist bash.rs is_dangerous os command injection5.3 Medium
- vowpalwabbit vowpal wabbitVowpal Wabbit: Shell injection via crafted PR title in python_checks.yml allows arbitrary command execution on CI runner5.0 Medium
- totolink n300rhTotolink N300RH Web Management cstecgi.cgi setPasswordCfg os command injection9.3 Critical
- devolutions server, mariadb, red hat enterprise linux 10 +5 more +7 moreMariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL6.3 Medium
- devolutions server, mariadb, red hat enterprise linux 10 +4 more +6 moreMariaDB: wsrep SST unsafe parameter handling on the donor side8.0 High
- totolink ca750-poeTotolink CA750-PoE Setting cstecgi.cgi setWiFiWpsConfig os command injection5.3 Medium
- totolink ca750-poeTotolink CA750-PoE Setting cstecgi.cgi recvUpgradeNewFw os command injection5.3 Medium
- totolink ca750-poeTotolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injection5.3 Medium
- totolink ca750-poeTotolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injection5.3 Medium
- pavel-odintsov fastnetmonFastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the...8.1 High
- pavel-odintsov fastnetmonFastNetMon Community Edition through 1.2.9 contains a configuration injection vulnerability in...8.1 High
- pavel-odintsov fastnetmonFastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the...9.8 Critical
- samba, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreSamba: samba: remote code execution in printing subsystem via unescaped job description9.0 Critical
- samba, red hat enterprise linux 10, enterprise linux 10.0 extended update support +26 more +28 moreSamba: remote code execution in samr9.0 Critical
- totolink ca750-poeTotolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injection5.3 Medium
- totolink ca750-poeTotolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injection5.3 Medium
- totolink ca750-poeTotolink CA750-PoE Setting cstecgi.cgi NTPSyncWithHost os command injection5.3 Medium
- totolink ca750-poeTotolink CA750-PoE Setting cstecgi.cgi setPasswordCfg os command injection5.3 Medium
- totolink ca750-poeTotolink CA750-PoE Setting cstecgi.cgi setWebWlanIdx os command injection5.3 Medium
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setAccessDeviceCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setWanCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setOpenVpnCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi UploadOpenVpnCert os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setOpenVpnCertGenerationCfg os command injection9.3 Critical
- founddream miniclawdFoundDream miniclawd exec.ts ExecTool.execute os command injection6.9 Medium
- dtstack taierDTStack Taier REST API Runtime.exec os command injection5.3 Medium
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setL2tpServerCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setQosCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setMacFilterRules os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setWiFiAdvancedCfg os command injection9.3 Critical
- edimax ew-7438rpnEdimax EW-7438RPn Content-Type formWlanMP os command injection5.3 Medium
- nec platforms, ltd. aterm cm51fd, aterm mr51fn +1 moreAn OS Command Injection vulnerability exists in Aterm. If a malicious third person gains...8.5 High
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setStaticDhcpRules os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setFirewallType os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injection9.3 Critical
- Show moreLoading…