CWE-88: Argument Injection
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
Also known as Improper Neutralization of Argument Delimiters in a Command.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- ibm lotus notesArgument injection vulnerability in IBM Lotus Notes 6.0.3 and 6.5 allows remote attackers to...10.0 High
- apple mac os xArgument injection vulnerability in the SSH URI handler for Safari on Mac OS 10.3.3 and earlier...7.6 High
- opera browserArgument injection vulnerability in Opera before 7.50 does not properly filter "-" characters...2.6 Low
- kde konquerorThe URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters...7.5 High
- microsoft windows xp, windows server 2003 +1 moreHelp and Support Center in Microsoft Windows XP SP1 does not properly validate HCP URLs, which...5.1 Medium
- microsoft outlook, office +1 moreArgument injection vulnerability in Microsoft Outlook 2002 does not sufficiently filter...7.5 High
- php, openpkg +1 moreArgument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to...7.5 High
- microsoft internet explorerInternet Explorer 6 and earlier, when used with the Telnet client in Services for Unix (SFU) 2.0,...7.5 High
- phpPHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail()...7.5 High
- microsoft internet explorerInternet Explorer 5.5 and earlier executes Telnet sessions using command line arguments that are...5.1 Medium
- ibm aixSome implementations of rlogin allow root access if given a -froot parameter.10.0 High