CWE-88: Argument Injection
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
Also known as Improper Neutralization of Argument Delimiters in a Command.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- facebook gameroomThe fbgames protocol handler registered as part of Facebook Gameroom does not properly quote...9.8 Critical
- inspur clusterengineA Remote Code Execution vulnerability has been found in Inspur ClusterEngine V4.0. A remote...9.8 Critical
- endian firewall communityEndian Firewall Community (aka EFW) 3.3.2 allows remote authenticated users to execute arbitrary...8.8 High
- gnu screen, debian linux, fedoraproject fedora +2 moreencoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service ...9.8 Critical
- bitcoinBitcoin Core before 0.19.0 might allow remote attackers to execute arbitrary code when another...9.8 Critical
- tp-link tl-wr841n firmwareA Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 (JP) with firmware...8.8 High
- draytek vigor2960 firmwareDrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA...8.8 High
- dolibarr erp\/crmDolibarr authenticated Remote Code Execution7.2 High
- xinuos openserverXinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via...9.8 Critical
- go toolchain cmd/go, golang go +1 moreArbitrary code execution via the go command with cgo in cmd/go7.5 High
- nodemailerCommand Injection8.6 High
- iliasRemote Code Execution can occur via the external news feed in ILIAS 6.4 because of incorrect...8.8 High
- cisco sd-wan vmanageCisco SD-WAN vManage Software Command Injection Vulnerability6.7 Medium
- mitsubishi electric corporation gt14 model of got 1000 series, mitsubishielectric coreos +1 moreImproper neutralization of argument delimiters in a command ('Argument Injection') vulnerability...9.8 Critical
- mitsubishi electric corporation melsec iq-r series, mitsubishielectric melsec iq-rd81dl96 firmware, melsec iq-rd81mes96n firmware +3 more +5 moreImproper neutralization of argument delimiters in a command ('Argument Injection') vulnerability...6.5 Medium
- blueman-project blueman, debian linux, fedoraproject fedora +2 moreLocal privilege escalation Blueman7.1 High
- nagios xiImproper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote,...7.2 High
- ozeki ng sms gatewayAn issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings...5.3 Medium
- ibm spectrum scaleIBM Spectrum Scale V5.0.0.0 through V5.0.4.3 and V4.2.0.0 through V4.2.3.21 could allow a local...6.2 Medium
- nim-lang nimSecurity update for nim9.8 Critical
- firejail project firejail, debian linux, fedoraproject fedora +1 more +3 moreFirejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option,...7.8 High
- teamviewerTeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. A...8.8 High
- cisco data center network managerCisco Data Center Network Manager Privilege Escalation Vulnerability7.8 High
- mitsubishielectric coreos, mitsubishi electric corporation got2000 series gt27, gt25, and gt23 +1 moreTCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with...9.8 Critical
- rakuten viberViber for Windows up to 13.2.0.39 does not properly quote its custom URI handler. A malicious...7.5 High
- aapanelaaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via the...7.2 High
- se ecostruxure operator terminal expertA CWE-88: Argument Injection or Modification vulnerability exists in EcoStruxure Operator...7.8 High
- raonwiz inc k upload, raonwiz raon k upload +1 moreRAONWIZ Inc K Upload, arguments modiffication via missing support for integrity check vulnerability8.7 High
- roundcube webmail, opensuse backports sle, leap +2 morercube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via...9.8 Critical
- red hat ansible, redhat ansible tower, cloudforms management engine +1 more +3 moreArgument Injection in Ansible3.9 Low
- mitsubishi electric corporation electric melqic iu1 series, mitsubishielectric iu1-1m20-d firmware +1 moreImproper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability...8.8 High
- mozilla firefox, firefox esr +1 moreCommand line arguments could have been injected during Firefox invocation as a shell handler for...8.8 High
- sensiolabs symfony, fedoraproject fedora +1 moreArgument injection in a MimeTypeGuesser in Symfony7.5 High
- wacom driverAn exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3,...7.8 High
- wacom driverAn exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3,...7.1 High
- sangoma session border controller firmwareThe Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to Argument...9.8 Critical
- sangoma session border controller firmwareThe Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to an...9.8 Critical
- mozilla firefox, firefox esr +1 moreLogging-related command line parameters are not properly sanitized when Firefox is launched by...8.8 High
- rustls project rustlsrustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to...7.5 High
- mixin-deep project mixin-deep, fedoraproject fedora, oracle communications cloud native core network function cloud native environment +2 morePrototype Pollution in mixin-deep9.8 Critical
- getvera vera edge firmwarecgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users...8.8 High
- windriver vxworks, belden garrettcom magnum dx940e firmware, hirschmann hios +4 more +6 moreWind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Control in IPv4...7.1 High
- londontrustmedia private internet access vpn clientA vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux...7.8 High
- mobatek mobaxtermIn MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows...8.8 High
- apache geodeArgument Injection in Apache Geode server6.5 Medium
- atlassian sourcetree, sourcetree for windows +1 moreAn argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers, in all...8.8 High
- cisco nx-os software, nx-os, firepower extensible operating system +2 moreCisco FXOS and NX-OS Software Command Injection Vulnerability4.2 Medium
- cisco nx-os software, nx-os +1 moreCisco NX-OS Software Command Injection Vulnerability6.7 Medium
- cisco nx-os software, nx-os, firepower extensible operating system +2 moreCisco FXOS and NX-OS Software Command Injection Vulnerability6.7 Medium
- cisco nx-os software, nx-os +1 moreCisco NX-OS Software Command Injection Vulnerability6.7 Medium
- Show moreLoading…