CWE-78: Shell injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an OS Command, Shell metacharacters, OS Command Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- mend mend-renovate-enterprise-edition, renovatebot renovate, mend mend-renovate-ce +3 more +5 moreRenovate before 44.14.7 Command Injection via gradle-wrapper8.5 High
- renovatebot renovate, mend mend-renovate-ce, mend-renovate-enterprise-edition +3 more +5 moreRenovate before 44.14.7 Command Injection via depName7.3 High
- geovision inc. gv-lpclpc2011/2211GV-LPCLPC2011/2211 - Stored FTP-Username Command Injection7.2 High
- geovision inc. gv-lpclpc2011/2211GV-LPCLPC2011/2211 - ONVIF Subscribe Address Command Injection8.8 High
- geovision inc. gv-lpclpc2011/2211GV-LPCLPC2011/2211 - Wireless WEP Key1-Key4 Command Injection7.2 High
- geovision inc. gv-lpc2011/lpc2211GV-LPC2011/LPC2211 - Wireless WPA-PSK Command Injection7.2 High
- geovision inc. gv-lpc2011/lpc2211GV-LPC2011/LPC2211 - Wireless SSID Command Injection7.2 High
- geovision inc. gv-lpc2011/lpc2211GV-LPC2011/LPC2211 - PPPoE Username Shell-Configuration Command Injection7.2 High
- geovision inc. gv-lpc2011/lpc2211GV-LPC2011/LPC2211 - Stored Administrator-Username Command Injection7.2 High
- palo alto networks checkov by prisma cloudCheckov by Prisma Cloud: OS Command Injection Vulnerability1.1 Low
- palo alto networks cloud ngfw, pan-os, prisma access +1 more +3 morePAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration4.0 Medium
- aws labs postgres mcp serverRead-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server9.0 Critical
- hewlett packard enterprise (hpe) clearpass policy manager (cppm)Authenticated Arbitrary File Write allows Remote Code Execution via CPPM Web Interface7.2 High
- hewlett packard enterprise (hpe) clearpass policy manager (cppm)Authenticated Remote Code Execution in CPPM Web Interface7.2 High
- schneider electric powerlogic t300CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'...8.7 High
- dell powerscale onefsDell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8.0.0 through 9.10.1.0, and...6.7 Medium
- dell idrac10, idrac9 +1 moreDell iDRAC9, 14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.10.50, and Dell...7.2 High
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...5.3 Medium
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...7.5 High
- tanium enforceTanium addressed an unauthorized code execution vulnerability in Enforce.7.0 High
- okta access gatewayImproper Input Neutralization in Okta Access Gateway SNMP Configuration Processing6.7 Medium
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)10.0 Critical
- microsoft azure hdinsightAzure HDInsight Ambari Elevation of Privilege Vulnerability7.2 High
- grokability snipe-itSnipe-IT before 8.7.0 Remote Code Execution via Backup Restore8.6 High
- netis systems nx10Netis NX10 OS Command Injection via Ping Diagnostic Handler8.6 High
- hitachi cosminexus component containerOS Command Injection Vulnerability in Cosminexus Component Container9.8 Critical
- red hat certificate system 9, enterprise linux 10, enterprise linux 10.0 extended update support +13 more +15 morePki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)7.2 High
- knowns-dev knownsknowns before 0.30.0 Arbitrary Code Execution via LSP Binary8.5 High
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...7.2 High
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...6.5 Medium
- red hat directory server 11, directory server 11.5 e4s for rhel 8, directory server 11.7 e4s for rhel 8 +13 more +15 more389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor8.4 High
- dell secure connect gateway (scg) 5.0 application, secure connect gateway, secure connect gateway 5.0 - appliance +2 moreDell Secure Connect Gateway (SCG) 5.0 Application, versions prior to 5.36.00.00, contains an...7.3 High
- linksys re7000Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection9.4 Critical
- tenda hg10Tenda HG10 Boa formgponConf os command injection9.4 Critical
- tenda cp3Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injection10.0 Critical
- tenda cp3Tenda CP3 Network Configuration Management system.c sub_2F77E8 os command injection9.4 Critical
- tenda cp3Tenda CP3 NetCheckPing.cpp os command injection9.4 Critical
- tenda cp3Tenda CP3 Kylin system.c SystemAsh os command injection9.4 Critical
- sonicwall network security manager (nsm)An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')...9.1 Critical
- amazon log4j-cve-2021-44228-hotpatchOS command injection in Amazon log4j-cve-2021-44228-hotpatch8.5 High
- ibm iIBM i is Affected By Multiple Vulnerabilities in Debug Server5.3 Medium
- ibm iIBM i is Affected By Multiple Vulnerabilities in Debug Server4.4 Medium
- ibm iIBM i is Affected By Multiple Vulnerabilities in Debug Server4.4 Medium
- opentalker sadtalkerSadTalker OS Command Injection via Audio Filename9.3 Critical
- getomni-ai zeroxzerox 1.1.20 OS Command Injection via Document URL File Extension9.3 Critical
- mladensu cli-mcp-servercli-mcp-server 0.2.5 Command Allowlist Bypass via Shell Substitution9.2 Critical
- xing inc. cptrans-me-xXING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be...9.3 Critical
- openvpnAn argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.6 on...7.7 High
- No product listedAn authenticated remote code execution (RCE) vulnerability in the admin_config.php component of...8.8 High
- mit moos-ivpMOOS-IvP through 24.8.1 alogsplit Command Injection via Input Pathname8.5 High
- Show moreLoading…