CWE-88: Argument Injection
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
Also known as Improper Neutralization of Argument Delimiters in a Command.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- python-libnmap project python-libnmapArgument injection in python-libnmap9.0 Critical
- git-pull-or-clone project git-pull-or-cloneCommand Injection9.8 Critical
- git-php project git-phpCommand Injection8.1 High
- git-interface project git-interface, yarkeev yarkeev/git-interface +1 moreCommand Injection vulnerability in git-interface@2.1.1 in yarkeev/git-interface9.8 Critical
- git, debian linux, fedoraproject extra packages for enterprise linux +1 more +3 moreCommand Injection8.1 High
- composer, fedoraproject fedora, tenable tenable.sc +2 moreMissing input validation can lead to command execution in composer8.3 High
- busyboxBusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to...8.8 High
- simple-git project simple-gitCommand Injection8.1 High
- cocoapods cocoapods-downloaderCommand Injection8.1 High
- cocoapods cocoapods-downloaderCommand Injection8.1 High
- vcs project vcsCommand Injection8.1 High
- cmswingCmsWing CMS 1.3.7 is affected by a Remote Code Execution (RCE) vulnerability via parameter: log rule9.8 Critical
- ungit project ungitRemote Code Execution (RCE)8.8 High
- libvcs project libvcsCommand Injection8.1 High
- simple-git project simple-gitCommand Injection8.1 High
- weblateRemote Code Execution (RCE)7.2 High
- pear crypt gpgCrypt_GPG does not prevent additional options in GPG calls5.3 Medium
- h2database h2, debian linux, oracle communications cloud native core console +2 moreArbitrary code execution in H2 Console9.8 Critical
- mitre calderaAn issue was discovered in CALDERA 2.8.1. When activated, the Human plugin passes the unsanitized...8.8 High
- bundler, rubygems +1 moreLocal Code Execution through Argument Injection via dash leading git url parameter in Gemfile6.7 Medium
- huawei emui, harmonyos, magic ui +2 moreThere is a Parameter injection vulnerability in Huawei Smartphone.Successful exploitation of this...9.8 Critical
- qutebrowserArbitrary command execution on Windows in qutebrowser8.8 High
- amazon aws workspacesIn the Amazon AWS WorkSpaces client before 3.1.9 on Windows, argument injection in the workspaces...8.8 High
ghostnpmRemote command injection when using sendmail email transport5.8 Medium- device42The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery...8.1 High
- cisco ios xr software, ios xr +1 moreCisco IOS XR Software Arbitrary File Read and Write Vulnerability8.1 High
- testzentrum-odw testerfassungA Shell Metacharacter Injection vulnerability in result.php in DRK Odenwaldkreis Testerfassung...8.1 High
- att xmillWithin the function HandleFileArg the argument filepattern is under control of the user who...7.8 High
- quectel eg25-g firmwareQuectel EG25-G devices through 202006130814 allow executing arbitrary code remotely by using an...9.8 Critical
- palo alto networks pan-osPAN-OS: OS Command Argument Injection in Web Interface4.9 Medium
- ivanti mobileiron, mobileiron core +1 moreIvanti MobileIron Core clish Restricted Shell Escape via Argument Injection6.5 Medium
- etherpadAn Argument Injection issue in the plugin management of Etherpad 1.8.13 allows privileged users...7.2 High
- echobh sharecareAn issue was discovered in Echo ShareCare 8.15.5. The UnzipFile feature in Access...8.8 High
- kuaifan kuaifancmsKuaiFanCMS V5.x contains an arbitrary file read vulnerability in the html_url parameter of the...6.5 Medium
- dragonfly project dragonflyDragonfly contains remote code execution vulnerability9.8 Critical
- cisco modeling labsCisco Modeling Labs Web UI Command Injection Vulnerability8.8 High
- jetbrains teamcityIn JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was...9.8 Critical
- djangoproject django, fedoraproject fedora +1 moreHeader injection possible in Django6.1 Medium
- eximExim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default...9.8 Critical
- flarum framework, debian linux +1 moreLaravel allows environment manipulation via query string8.7 High
- composer, debian linux, fedoraproject fedora +2 moreMissing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composer8.8 High
- demon1a discord-reconLFI and possible code execution on discord-recon using tools arguments8.1 High
- innorix file transfer solution, agent.exe +1 moreInnorix File Transfer Solution File Download and Execution Vulnerability7.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the...8.8 High
- cisco ios xr software, ios xr +1 moreCisco IOS XR Software Command Injection Vulnerability6.6 Medium
- douzone nbbdownloader.ocxDouzone ActiveX File Download and Execution Vulnerability7.8 High
- apkleaks project apkleaksImproper Neutralization of Argument Delimiters in a Decompiling Package Process9.3 Critical
- cisco ios xe, ios xe sd-wan, ios xe software +2 moreCisco IOS XE SD-WAN Software Parameter Injection Vulnerabilities6.0 Medium
- cisco ios xe, ios xe sd-wan, ios xe software +2 moreCisco IOS XE SD-WAN Software Parameter Injection Vulnerabilities6.0 Medium
- ericcornelissen shescapeNull characters not escaped in shescape6.3 Medium
- Show moreLoading…