VYPR

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

ClassDraftLikelihood: High

Description

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-136 · CAPEC-15 · CAPEC-183 · CAPEC-248 · CAPEC-40 · CAPEC-43 · CAPEC-75 · CAPEC-76

CVEs mapped to this weakness (3,835)

page 144 of 192
  • CVE-2025-20184MedFeb 5, 2025
    Cisco Systems, Inc.
    Asyncos
    risk 0.42cvss 6.5epss 0.01

    A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Web Appliance could allow an authenticated, remote attacker to perform command injection attacks against an affected device. The attacker must…

  • CVE-2024-53615MedJan 30, 2025
    Mjau Mjau
    Files.photo.gallery
    risk 0.42cvss 6.5epss 0.01

    A command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remote attackers to execute arbitrary code via a crafted video file.

  • CVE-2024-51772MedDec 3, 2024
    Arubanetworks
    ClearPass Policy Manager
    risk 0.42cvss 6.4epss 0.00

    An authenticated RCE vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying…

  • CVE-2024-53333MedNov 21, 2024
    Totolink
    EX200
    risk 0.42cvss 6.3epss 0.19

    TOTOLINK EX200 v4.0.3c.7646_B20201211 was found to contain a command insertion vulnerability in the setUssd function. This vulnerability allows an attacker to execute arbitrary commands via the "ussd" parameter.

  • CVE-2024-39438MedOct 9, 2024
    UNISOC
    linkturbonative
    risk 0.42cvss 6.5epss 0.00

    In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed.

  • CVE-2024-39437MedOct 9, 2024
    UNISOC
    linkturbonative
    risk 0.42cvss 6.5epss 0.00

    In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed.

  • CVE-2024-39436MedOct 9, 2024
    UNISOC
    linkturbonative
    risk 0.42cvss 6.5epss 0.00

    In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed.

  • CVE-2024-20365MedOct 2, 2024
    Cisco Systems, Inc.
    UCS B-Series
    risk 0.42cvss 6.5epss 0.01

    A vulnerability in the Redfish API of Cisco UCS B-Series, Cisco UCS Managed C-Series, and Cisco UCS X-Series Servers could allow an authenticated, remote attacker with administrative privileges to perform command injection attacks on an affected system and elevate privileges to…

  • CVE-2024-45348MedSep 23, 2024
    Mi
    Ax9000 Firmware
    risk 0.42cvss 6.4epss 0.01

    Xiaomi Router AX9000 has a post-authorization command injection vulnerability. This vulnerability is caused by the lack of validation of user input, and an attacker can exploit this vulnerability to execute arbitrary code.

  • CVE-2024-8213MedAug 27, 2024
    Dlink
    DNS-120
    risk 0.42cvss 6.3epss 0.07

    A vulnerability classified as critical has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to…

  • CVE-2024-8212MedAug 27, 2024
    Dlink
    DNS-120
    risk 0.42cvss 6.3epss 0.07

    A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been rated as…

  • CVE-2024-8210MedAug 27, 2024
    Dlink
    DNS-120
    risk 0.42cvss 6.3epss 0.07

    A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been classified…

  • CVE-2024-8134MedAug 24, 2024
    Dlink
    DNS-120
    risk 0.42cvss 6.3epss 0.08

    A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been rated as…

  • CVE-2024-8133MedAug 24, 2024
    Dlink
    DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04
    risk 0.42cvss 6.3epss 0.08

    A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been declared as…

  • CVE-2024-8131MedAug 24, 2024
    Dlink
    DNS-120
    risk 0.42cvss 6.3epss 0.08

    A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 and classified as…

  • CVE-2024-8130MedAug 24, 2024
    Dlink
    DNS-120
    risk 0.42cvss 6.3epss 0.08

    A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 and classified as…

  • CVE-2024-8128MedAug 24, 2024
    Dlink
    DNS-120
    risk 0.42cvss 6.3epss 0.08

    A vulnerability, which was classified as critical, has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04…

  • CVE-2024-7110MedAug 22, 2024
    GitLab Inc.
    GitLab
    risk 0.42cvss 6.4epss 0.00

    An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execute arbitrary command in a victim's pipeline through prompt injection.

  • CVE-2024-7700MedAug 12, 2024
    Theforeman
    Foreman
    risk 0.42cvss 6.5epss 0.01

    A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page. This flaw allows an attacker with the necessary privileges to inject arbitrary commands into the configuration,…

  • CVE-2024-7436MedAug 3, 2024
    Dlink
    DI-8100
    risk 0.42cvss 6.3epss 0.08

    A vulnerability, which was classified as critical, has been found in D-Link DI-8100 16.07. This issue affects the function msp_info_htm of the file msp_info.htm. The manipulation of the argument cmd leads to command injection. The attack may be initiated remotely. The exploit…