CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- hikvision ds-3wap521-si, ds-3wap522-si, ds-3wap621e-si +7 more +9 moreSome Hikvision Wireless Access Points are vulnerable to authenticated command execution due to...7.2 High
- ibm hardware management console, hmc v10.3.1050.0, hmc v11.1.1110.0 +2 moreThis Power Hardware Management Console update is being released to address9.8 Critical
- ibm langflow oss, langflow +1 moreLangflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoints9.8 Critical
- ibm app connect enterpriseIBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings8.8 High
- eaton padmImproper input validation in one of the session management interface of Eaton's Tripp Lite series...8.8 High
- eaton padmImproper input validation in one of the session management interface of Eaton's Tripp Lite Series...8.3 High
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreLocal Privilege Escalation vulnerability in /etc/init.d/user-applications via customer website file8.5 High
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreLocal Privilege Escalation via pppd password injection8.5 High
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreOS Command Injection in OCPP Agent via charge_box_id8.8 High
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreudhcpc Privilege Escalation8.5 High
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreLocal Privilege Escalation via Network scripts8.5 High
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreLocal Privilege Escalation vulnerability in /etc/init.d/user-applications via user-application start script8.5 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +14 more +16 morePcp: pcp linux_sockets pmda: arbitrary command execution via command injection7.8 High
- olivetinOliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check6.6 Medium
- gnu bisonArbitrary Command Execution in GNU Bison6.8 Medium
- ibm aspera faspex 5, aspera faspex +1 moreOS command injection in IBM Aspera Faspex9.1 Critical
- ibm aspera faspex 5, aspera faspex +1 moreOS Command Injection in IBM Aspera Faspex9.1 Critical
- elecom co.,ltd. wab-i1750-ps, wab-m1775-ps, wab-m2133 +2 more +4 moreELECOM wireless LAN routers and access points devices contain an OS Command Injection...8.6 High
- elecom co.,ltd. wrc-x3000gs3-b, wrc-x3000gs3a-b +1 moreELECOM wireless LAN routers and access points devices contain an OS Command Injection...8.6 High
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection....7.8 High
- arista velocloud orchestrator, arista networks velocloud orchestrator on-prem +1 moreVeloCloud Orchestrator OS Command Injection10.0 Critical
- ericsson packet core controller (pcc)Improper Neutralization of Special Elements used in an OS Command Vulnerability8.5 High
- progress ecs connection manager, loadmaster, progress software moveit waf +3 more +5 moreProgress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Backup Restore Functionality8.4 High
- progress ecs connection manager, loadmaster, progress software moveit waf +3 more +5 moreProgress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface8.4 High
- progress ecs connection manager, loadmaster, progress software moveit waf +3 more +5 moreProgress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Management Interface8.4 High
- codexu notegenNoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python8.3 High
- rrwo catalyst::view::wkhtmltopdfCatalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options9.8 Critical
- ericcornelissen shescapeShescape: Shell injection via unescaped parentheses on Windows with CMD9.2 Critical
- ericcornelissen shescapeShescape: Path disclosure on Unix with Zsh6.3 Medium
pheditor/pheditorPackagistPheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes8.8 High- gitpython-developers gitpythonGitPython before 3.1.54 Remote Code Execution via kwarg value smuggling8.7 High
- gitpython-developers gitpythonGitPython before 3.1.54 Remote Code Execution via --template7.7 High
- nuxsmin syspasssysPass 3.2.11 Authenticated OS Command Injection via Backup Path8.6 High
- openstack ironic python agentIn OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can...7.2 High
- networkupstools nutupsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD execution8.1 High
- decolua 9router9router before 0.4.60 Remote Code Execution via default password9.4 Critical
- localstack serverless-localstacklocalstack serverless-localstack Configuration index.js os command injection4.8 Medium
- zohocorp manageengine adaudit plusRemote Code Execution10.0 Critical
- conventional-changelogrelease-it conventional-changelog Changelog File index.js writeChangelog os command injection4.8 Medium
- bahmutov find-cypress-specsbahmutov find-cypress-specs Branch index.js shell.exec os command injection4.8 Medium
- tubitak bilgem software technologies research institute pardus-updateRoot Command Injection via Offline Update in TÜBİTAK BİLGEM's pardus-update7.8 High
- No product listedpublint package-manager pack.js child_process.exec os command injection4.8 Medium
- syncfusion ej2-javascript-ui-controlssyncfusion ej2-javascript-ui-controls package.json child_process.exec os command injection4.8 Medium
- n8nn8n before 1.123.67 Remote Code Execution via Git node8.7 High
- danger danger-jsdanger danger-js CLI localGetFileAtSHA.ts danger.git.diffForFile os command injection4.8 Medium
- No product listedoclif JIT Plugin Entry child_process.exec os command injection4.8 Medium
- mongodb compassCompass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow8.4 High
- red hat ansible automation platform 2Ansible-lightspeed: visual studio code ansible lightspeed extension: remote code execution via command injection in configuration settings7.8 High
- red hat ansible automation platform 2Ansible-lightspeed: ansible lightspeed visual studio code extension: arbitrary code execution via command injection in activation script setting7.8 High
- n8nn8n before 2.30.1 Shell Sandbox Bypass on Linux Windows5.5 Medium
- Show moreLoading…