VYPR

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

ClassDraftLikelihood: High

Description

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Hierarchy (View 1000)

Related attack patterns (CAPEC)

CAPEC-136 · CAPEC-15 · CAPEC-183 · CAPEC-248 · CAPEC-40 · CAPEC-43 · CAPEC-75 · CAPEC-76

CVEs mapped to this weakness (3,835)

page 118 of 192
  • CVE-2023-2377HigApr 28, 2023
    risk 0.47cvss 7.2epss 0.08

    A vulnerability was detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The impacted element is an unknown function of the component Web Management Interface. The manipulation of the argument Name results in command injection. The attack can be launched remotely. The exploit…

  • CVE-2023-2376HigApr 28, 2023
    risk 0.47cvss 7.2epss 0.08

    A security vulnerability has been detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The affected element is an unknown function of the component Web Management Interface. The manipulation of the argument dpi leads to command injection. The attack can be initiated remotely.…

  • CVE-2023-2374HigApr 28, 2023
    risk 0.47cvss 7.2epss 0.07

    A security flaw has been discovered in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This issue affects some unknown processing of the component Web Management Interface. Performing a manipulation of the argument ecn-down results in command injection. It is possible to initiate…

  • CVE-2023-2373HigApr 28, 2023
    risk 0.47cvss 7.2epss 0.08

    A vulnerability was identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This vulnerability affects unknown code of the component Web Management Interface. Such manipulation of the argument ecn-up leads to command injection. The attack may be performed from remote. The…

  • CVE-2022-36769HigApr 26, 2023
    risk 0.47cvss 7.2epss 0.01

    IBM Cloud Pak for Data 4.5 and 4.6 could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 232034.

  • CVE-2023-20865HigApr 20, 2023
    risk 0.47cvss 7.2epss 0.02

    VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs can execute arbitrary commands as root.

  • CVE-2023-29855HigApr 18, 2023
    risk 0.47cvss 7.2epss 0.01

    WBCE CMS 1.5.3 has a command execution vulnerability via admin/languages/install.php.

  • CVE-2023-30638HigApr 14, 2023
    risk 0.47cvss 7.2epss 0.01

    Atos Unify OpenScape SBC 10 before 10R3.1.3, OpenScape Branch 10 before 10R3.1.2, and OpenScape BCF 10 before 10R10.7.0 allow remote authenticated admins to inject commands.

  • CVE-2022-4934HigApr 4, 2023
    risk 0.47cvss 7.2epss 0.02

    A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrators to execute arbitrary code.

  • CVE-2023-1458HigMar 25, 2023
    risk 0.47cvss 7.2epss 0.03

    A vulnerability has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6 and classified as critical. Affected by this vulnerability is an unknown functionality of the component OSPF Handler. The manipulation of the argument area leads to command injection. The attack can be…

  • CVE-2023-1457HigMar 25, 2023
    risk 0.47cvss 7.2epss 0.02

    A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. Affected is an unknown function of the component Static Routing Configuration Handler. The manipulation of the argument next-hop-interface leads to command injection. It is…

  • CVE-2023-1456HigMar 25, 2023
    risk 0.47cvss 7.2epss 0.02

    A vulnerability, which was classified as critical, has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. This issue affects some unknown processing of the component NAT Configuration Handler. The manipulation leads to command injection. The attack may be initiated remotely.…

  • CVE-2023-1168HigMar 22, 2023
    risk 0.47cvss 7.2epss 0.01

    An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system, leading to…

  • CVE-2023-28460HigMar 15, 2023
    risk 0.47cvss 7.2epss 0.02

    A command injection vulnerability was discovered in Array Networks APV products. A remote attacker can send a crafted packet after logging into the affected appliance as an administrator, resulting in arbitrary shell code execution. This is fixed in 8.6.1.262 or newer and…

  • CVE-2023-22770HigMar 1, 2023
    risk 0.47cvss 7.2epss 0.01

    Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

  • CVE-2023-22769HigMar 1, 2023
    risk 0.47cvss 7.2epss 0.01

    Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

  • CVE-2023-22768HigMar 1, 2023
    risk 0.47cvss 7.2epss 0.01

    Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

  • CVE-2023-22767HigMar 1, 2023
    risk 0.47cvss 7.2epss 0.01

    Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

  • CVE-2023-22766HigMar 1, 2023
    risk 0.47cvss 7.2epss 0.01

    Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

  • CVE-2023-22765HigMar 1, 2023
    risk 0.47cvss 7.2epss 0.01

    Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.