VYPR

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

ClassDraftLikelihood: High

Description

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-136 · CAPEC-15 · CAPEC-183 · CAPEC-248 · CAPEC-40 · CAPEC-43 · CAPEC-75 · CAPEC-76

CVEs mapped to this weakness (3,834)

page 34 of 192
  • CVE-2020-28423CriAug 2, 2022
    Monorepo Build Project
    Monorepo Build
    risk 0.64cvss 9.8epss 0.01

    This affects all versions of package monorepo-build.

  • CVE-2016-4991CriJul 28, 2022
    Nodepdf Project
    Nodepdf
    risk 0.64cvss 9.8epss 0.02

    Input passed to the Pdf() function is shell escaped and passed to child_process.exec() during PDF rendering. However, the shell escape does not properly encode all special characters, namely, semicolon and curly braces. This can be abused to achieve command execution. This…

  • CVE-2020-28447CriJul 25, 2022
    Xopen Project
    Xopen
    risk 0.64cvss 9.8epss 0.01

    This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopen(filepath)

  • CVE-2020-28445CriJul 25, 2022
    Npm Help
    npm-help
    risk 0.64cvss 9.8epss 0.01

    This affects all versions of package npm-help. The injection point is located in line 13 in index.js file in export.latestVersion() function.

  • CVE-2020-28443CriJul 25, 2022
    Sonar Wrapper Project
    Sonar Wrapper
    risk 0.64cvss 9.8epss 0.01

    This affects all versions of package sonar-wrapper. The injection point is located in lib/sonarRunner.js.

  • CVE-2020-28438CriJul 25, 2022
    Deferred Exec Project
    Deferred Exec
    risk 0.64cvss 9.8epss 0.01

    This affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js

  • CVE-2022-34592CriJul 7, 2022
    Wavlink
    WL-WN575A3
    risk 0.64cvss 9.8epss 0.03

    Wavlink WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability via the function obtw. This vulnerability allows attackers to execute arbitrary commands via a crafted POST request.

  • CVE-2022-28618CriMay 20, 2022
    HPE
    Nimble Storage
    risk 0.64cvss 9.8epss 0.02

    A command injection security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble Storage Secondary Flash Arrays that could allow an attacker to execute arbitrary commands on a Nimble appliance. HPE has…

  • CVE-2022-27588CriMay 5, 2022
    QVR
    QVR
    risk 0.64cvss 9.8epss 0.01

    We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.6 build 20220401 and later

  • CVE-2021-43163CriMay 4, 2022
    Ruijie Networks
    ReyeeOS
    risk 0.64cvss 9.8epss 0.02

    A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the checkNet function in /cgi-bin/luci/api/auth.

  • CVE-2022-29080CriApr 12, 2022
    Npm Dependency Versions Project
    Npm Dependency Versions
    risk 0.64cvss 9.8epss 0.02

    The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions with a JSON object in which pkgs is a key, and there are shell metacharacters in a value.

  • CVE-2021-43474CriApr 7, 2022
    Dlink
    Dir 823x Firmware
    risk 0.64cvss 9.8epss 0.03

    An Access Control vulnerability exists in D-Link DIR-823G REVA1 1.02B05 (Lastest) via any parameter in the HNAP1 function

  • CVE-2021-23247CriApr 1, 2022
    Quick Game Engine
    quick game engine
    risk 0.64cvss 9.8epss 0.02

    A command injection vulerability found in quick game engine allows arbitrary remote code in quick app. Allows remote attacke0rs to gain arbitrary code execution in quick game engine

  • CVE-2022-27083CriMar 24, 2022
    Tenda
    M3
    risk 0.64cvss 9.8epss 0.03

    Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadAccessCodePic.

  • CVE-2022-27082CriMar 24, 2022
    Tenda
    M3
    risk 0.64cvss 9.8epss 0.03

    Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetInternetLanInfo.

  • CVE-2022-27081CriMar 24, 2022
    Tenda
    M3
    risk 0.64cvss 9.8epss 0.03

    Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetLanInfo.

  • CVE-2022-27080CriMar 24, 2022
    Tenda
    M3
    risk 0.64cvss 9.8epss 0.03

    Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setWorkmode.

  • CVE-2022-27079CriMar 24, 2022
    Tenda
    M3
    risk 0.64cvss 9.8epss 0.03

    Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setPicListItem.

  • CVE-2022-27078CriMar 24, 2022
    Tenda
    M3
    risk 0.64cvss 9.8epss 0.03

    Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setAdInfoDetail.

  • CVE-2022-27077CriMar 24, 2022
    Tenda
    M3
    risk 0.64cvss 9.8epss 0.03

    Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadWeiXinPic.