CWE-88: Argument Injection
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
Also known as Improper Neutralization of Argument Delimiters in a Command.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- humming heads inc. defense platform home edition, hummingheads defense platform +1 moreImproper neutralization of argument delimiters in a command ('Argument Injection') issue exists...6.3 Medium
- teamviewer remote full client, remote host +1 moreImproper Neutralization of Argument Delimiters in TeamViewer Clients7.8 High
- watchguard fireware osAuthenticated arbitrary file read/write in WatchGuard Fireware OS6.5 Medium
- wikimedia foundation mediawiki - globalblocking extensionAPI list=globalblocks can reveal IP of autoblock if username and IP are included in the bgtargets parameter3.5 Low
- arista ng firewall, arista networks edge threat management +1 moreA user with administrator privileges can perform command injection7.2 High
- go-gitgo-git has an Argument Injection via the URL field9.2 Critical
- dell powerstore, powerstoreos +1 moreDell PowerStore contains an Improper Neutralization of Argument Delimiters in a Command (...7.1 High
- ivanti connect secureArgument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated...9.1 Critical
- cisco catalyst sd-wan managerCisco SD-WAN vManage Command Injection Vulnerability6.5 Medium
- ivanti connect secure, policy secure +1 moreArgument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti...9.1 Critical
- ivanti connect secure, policy secure +1 moreArgument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti...9.1 Critical
- ivanti connect secure, policy secure +1 moreArgument injection in Ivanti Connect Secure before version 22.7R2 and 9.1R18.7 and Ivanti Policy...9.1 Critical
- ivanti connect secure, policy secure, automation +2 moreArgument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti...9.1 Critical
- ivanti connect secure, policy secure +1 moreArgument injection in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure...9.1 Critical
- siemens sinec security monitorA vulnerability has been identified in Siemens SINEC Security Monitor (All versions < V4.9.0)....9.4 Critical
- bahmutov ggitggit is vulnerable to Arbitrary Argument Injection via the clone() API6.5 Medium
- cisco data center network manager, nexus dashboard fabric controller +1 moreCisco Nexus Dashboard Fabric Controller REST API Command Injection Vulnerability5.5 Medium
- tukaani xzXZ Utils on Microsoft Windows platform are vulnerable to argument injection6.3 Medium
- git git-shallow-clonegit-shallow-clone Argument Injection vulnerability5.3 Medium
- rust-lang rustRust OS Command Injection/Argument Injection vulnerability8.2 High
- comesio relevanssi live ajax search, relevanssi relevanssi-live-ajax-search +1 moreRelevanssi Live Ajax Search <= 2.4 - Unauthenticated WP_Query Argument Injection5.3 Medium
- hitachi energy microscada pro sys600, microscada x sys600, hitachienergy microscada sys600 +2 moreThe product allows user input to control or influence paths or file names that are used in...9.9 Critical
- mitel 6900w series sip phone, 6970 conference unit, 6800 series sip phones +1 more +3 moreA vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the...6.8 Medium
- mitel sip phones, 6863i sip firmware, 6865i sip firmware +14 more +16 moreA vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the...7.2 High
- gogsDuplicate Advisory: Gogs allows argument injection during the tagging of a new release7.7 High
- gogsDuplicate Advisory: github.com/gogs/gogs affected by CVE-2024-399309.9 Critical
- artica pandora fms, pandora fms fms +1 moreArgument Injection Leading to Remote Code Execution in Realtime Graph Extension9.4 Critical
- carrier lenels2 netbox, lenels2 netbox +1 moreLenelS2 NetBox Improper Neutralization of Argumented Delimiters9.3 Critical
- inductive automation ignitionInductive Automation Ignition getParams Argument Injection Remote Code Execution Vulnerability8.8 High
- linux mint xreader, linuxmint +1 moreLinux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability7.8 High
- mitel 6800 series firmware, 6900 series firmware, 6900w series firmware +1 more +3 moreA vulnerability on Mitel 6800 Series and 6900 Series SIP Phones, including 6970 Conference Unit,...6.2 Medium
- github enterprise serverImproper Privilege Management was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console8.0 High
- flatpak, fedoraproject fedora +1 moreFlatpak vulnerable to a sandbox escape via RequestBackground portal due to bad argument parsing8.4 High
- hashicorp go-getter, shared library +1 moreHashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches9.8 Critical
- checkmkArgument injection to runmqsc6.5 Medium
- aenrich a+hrd, a\+hrd +1 moreaEnrich Technology a+HRD - Argument Injection5.3 Medium
- byron gitoxidegix-transport indirect code execution via malicious username6.4 Medium
- rust-lang rust, fedoraproject fedora +1 moreRusts's `std::process::Command` did not properly escape arguments of batch files on Windows10.0 Critical
- commend ws203vicm, ws203vicm firmware +1 moreCommend WS203VICM Argument Injection8.6 High
- embedchainCode execution in Embedchain9.8 Critical
- cisco business wireless access point software, wap371 firmware +1 moreA vulnerability in the web-based management interface of the Cisco WAP371 Wireless-AC/N Dual...6.5 Medium
- cisco prime infrastructure, evolved programmable network manager, evolved programmable network manager (epnm) +2 moreA vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved...6.0 Medium
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress <= 4.2.5.7 - Command Injection8.1 High
- apache openofficeApache OpenOffice: Macro URL arbitrary script execution8.8 High
- buffalo vr-s1000 firmware, buffalo inc. vr-s1000 +1 moreImproper neutralization of argument delimiters in a command ('Argument Injection') vulnerability...7.8 High
- palo alto networks pan-os, cloud ngfw, prisma access +2 morePAN-OS: OS Command Injection Vulnerability in the XML API5.5 Medium
- jellyfinArgument Injection in FFmpeg codec parameters in Jellyfin7.7 High
- atos unify openscape bcf, unify openscape branch, unify openscape session border controller +3 more +5 moreArgument injection vulnerability in Atos Unify OpenScape Session Border Controller, Atos Unify OpenScape Branch and Atos Unify OpenScape BCF10.0 Critical
- docker desktopIn Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in LPE7.2 High
- gitoxidelabs gix-transportgix-transport code execution vulnerability4.1 Medium
- Show moreLoading…