CWE-88: Argument Injection
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
Also known as Improper Neutralization of Argument Delimiters in a Command.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- https://github.com/foobaroy/ foomuuriA crafted "interface" input parameter can lead to integrity loss of the firewall configuration7.0 High
- https://github.com/kde/ smb4kLocal users can perform arbitrary unmounts via smb4k mount helper due to lack of input validation6.9 Medium
- red hat libnbd, enterprise linux 10, enterprise linux 8 +2 more +4 moreLibnbd: libnbd: arbitrary code execution via ssh argument injection through a malicious uri4.8 Medium
- lfprojects model context protocol servers, modelcontextprotocol servers +1 moremcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files6.3 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero6.6 Medium
- jpylypiw easywallEasywall 0.3.1 - Authenticated Command Injection in /ports-save Endpoint8.7 High
- cloudinaryCloudinary Node SDK is vulnerable to Arbitrary Argument Injection through parameters that include an ampersand8.8 High
- idis icm viewerIDIS ICM Viewer Argument Injection8.7 High
tracexeccrates.iotracexec has `env` command argument injection via environment variables starting with dash in traced exec events1.0 Low- dell data domain operating system, powerprotect data domain with data domain operating system (dd os) of feature release, powerprotect data domain with data domain operating system (dd os) lts2023 +1 more +3 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...6.7 Medium
- dell data domain operating system, powerprotect data domain with data domain operating system (dd os) of feature release, powerprotect data domain with data domain operating system (dd os) lts2023 +2 more +4 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...4.3 Medium
- unity editor, unity3d unity editor +1 moreUnity Editor 2019.1 through 6000.3 could allow remote attackers to exploit file loading and Local...7.4 High
- pebcak go-mailgo-mail has insufficient address encoding when passing mail addresses to the SMTP client8.2 High
- conventional-changelog@conventional-changelog/git-client has an Argument Injection vulnerability5.3 Medium
- crestron touchscreens x70Privilege escalation via SCP login8.6 High
- dell thinos, thinos 10 +1 moreDell ThinOS 10, versions prior to 2508_10.0127, contains an Improper Neutralization of Argument...8.4 High
- commvault commcell, commvault +1 moreArgument Injection Vulnerability in CommServe6.9 Medium
- rails activestorage, red hat 3scale api management platform 2, satellite 6 +2 moreActive Storage allowed transformation methods that were potentially unsafe9.2 Critical
- lenovo vantage, commercial vantage +1 moreAn improper validation vulnerability was reported in Lenovo Vantage that under certain conditions...8.5 High
- lenovo vantage, commercial vantage +1 moreAn improper validation vulnerability was reported in Lenovo Vantage that under certain conditions...8.5 High
- advantech iviewAdvantech iView Argument Injection7.1 High
- advantech iviewAdvantech iView Argument Injection7.1 High
- kubernetes-sigs headlampKubernetes Headlamp Allows Arbitrary Command Injection in macOS Process headlamp@codeSign7.8 High
- gitGit alllows arbitrary file writes via bundle-uri parameter injection8.6 High
- j6t git-guiGit GUI can create and overwrite files for which the user has write permission8.5 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9 +1 moreEvent-driven-ansible: authenticated argument injection in git url in eda project creation8.8 High
- filebrowserFile Browser Allows Execution of Shell Commands That Can Spawn Other Commands8.0 High
- julialang registrator, juliaregistries registrator.jl +1 moreRegistrator.jl Argument Injection Vulnerability8.1 High
- microhard ipn4gii / bullet-lte firmware, microhardcorp bulletlte-na2 firmware, ipn4gii-na2 firmware +2 moreMicrohard Bullet-LTE and IPn4Gii AT+MNPINGTM Argument Injection7.1 High
- microhard ipn4gii / bullet-lte firmware, microhardcorp bulletlte-na2 firmware, ipn4gii-na2 firmware +2 moreMicrohard Bullet-LTE and IPn4Gii AT+MNNETSP Argument Injection7.1 High
- microhard ipn4gii / bullet-lte firmware, microhardcorp bulletlte-na2 firmware, ipn4gii-na2 firmware +2 moreMicrohard Bullet-LTE and IPn4Gii AT+MMNAME Argument Injection7.1 High
- microhard ipn4gii / bullet-lte firmware, microhardcorp bulletlte-na2 firmware, ipn4gii-na2 firmware +2 moreMicrohard Bullet-LTE and IPn4Gii AT+MFRULE Argument Injection7.1 High
- microhard ipn4gii / bullet-lte firmware, microhardcorp bulletlte-na2 firmware, ipn4gii-na2 firmware +2 moreMicrohard Bullet-LTE and IPn4Gii AT+MFPORTFWD Argument Injection7.1 High
- microhard ipn4gii / bullet-lte firmware, microhardcorp bulletlte-na2 firmware, ipn4gii-na2 firmware +2 moreMicrohard Bullet-LTE and IPn4Gii AT+MFMAC Argument Injection7.1 High
- microhard ipn4gii / bullet-lte firmware, microhardcorp bulletlte-na2 firmware, ipn4gii-na2 firmware +2 moreMicrohard Bullet-LTE and IPn4Gii AT+MFIP Argument Injection7.1 High
- on semiconductor quantenna wi-fi chipset, onsemi qcs-ax2-a12 firmware, qcs-ax2-s5 firmware +16 more +18 moreON Semiconductor Quantenna router_command.sh (in the sync_time argument) Argument Injection7.7 High
- on semiconductor quantenna wi-fi chipset, onsemi qcs-ax2-a12 firmware, qcs-ax2-s5 firmware +16 more +18 moreON Semiconductor Quantenna router_command.sh (in the get_syslog_from_qtn argument) Argument Injection7.7 High
- on semiconductor quantenna wi-fi chipset, onsemi qcs-ax2-a12 firmware, qcs-ax2-s5 firmware +16 more +18 moreON Semiconductor Quantenna router_command.sh (in the get_file_from_qtn argument) Argument Injection7.7 High
- on semiconductor quantenna wi-fi chipset, onsemi qcs-ax2-a12 firmware, qcs-ax2-s5 firmware +16 more +18 moreON Semiconductor Quantenna router_command.sh (in the put_file_to_qtn argument) Argument Injection7.7 High
- on semiconductor quantenna wi-fi chipset, onsemi qcs-ax2-a12 firmware, qcs-ax2-s5 firmware +16 more +18 moreON Semiconductor Quantenna router_command.sh (in the run_cmd argument) Argument Injection7.7 High
- on semiconductor quantenna wi-fi chipset, onsemi qcs-ax2-a12 firmware, qcs-ax2-s5 firmware +16 more +18 moreON Semiconductor Quantenna set_tx_pow Argument Injection7.7 High
- on semiconductor quantenna wi-fi chipset, onsemi qcs-ax2-a12 firmware, qcs-ax2-s5 firmware +16 more +18 moreON Semiconductor Quantenna transmit_file Argument Injection7.7 High
- atheosAtheos Improper Input Validation Vulnerability Enables RCE in Common.php9.4 Critical
- tridium niagara, niagara enterprise security, niagara framework +2 moreImproper Neutralization of Argument Delimiters in a Command (‘Argument Injection’)7.2 High
- checkmkArbitrary file write with vcrtrace8.7 High
- jellyfinJellyfin Vulnerable to Argument Injection in FFmpeg7.6 High
- devdojo voyagerDevDojo Voyager Argument Injection vulnerability9.1 Critical
pagureDebianPagure: argument injection in pagurerepo.log()9.8 Critical- vim, netapp bootstrap os +1 moreVim vulnerable to potential data loss with zip.vim and special crafted zip files4.4 Medium
- matrix irc bridge, matrix-org matrix-appservice-irc +1 moreMatrix IRC Bridge allows IRC command injection to own puppeted user2.7 Low
- Show moreLoading…