VYPR

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-15 · CAPEC-43 · CAPEC-6 · CAPEC-88

CVEs mapped to this weakness (7,107)

page 146 of 356
  • CVE-2022-43654HigMay 7, 2024
    Netgear
    CAX30S
    risk 0.57cvss 8.8epss 0.01

    NETGEAR CAX30S SSO Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR CAX30S routers. Authentication is not required to exploit this vulnerability. The…

  • CVE-2024-33434CriMay 7, 2024
    Tiagorlampert
    Chaos
    risk 0.57cvss 9.8epss 0.01

    An issue in tiagorlampert CHAOS v5.0.1 before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a remote attacker to execute arbitrary code via the unsafe concatenation of the `filename` argument into the `buildStr` string without any…

  • CVE-2023-37407HigMay 3, 2024
    IBM
    Aspera Orchestrator
    risk 0.57cvss 8.8epss 0.01

    IBM Aspera Orchestrator 4.0.1 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 260116.

  • CVE-2023-51585HigMay 3, 2024
    Voltronic Power
    ViewPower
    risk 0.57cvss 8.8epss 0.01

    Voltronic Power ViewPower USBCommEx shutdown Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. User interaction is required to exploit this…

  • CVE-2023-50217HigMay 3, 2024
    Dlink
    G416
    risk 0.57cvss 8.8epss 0.01

    D-Link G416 awsfile rm Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability. The…

  • CVE-2023-50216HigMay 3, 2024
    Dlink
    G416
    risk 0.57cvss 8.8epss 0.01

    D-Link G416 awsfile tar File Handling Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this…

  • CVE-2023-50215HigMay 3, 2024
    Dlink
    G416
    risk 0.57cvss 8.8epss 0.01

    D-Link G416 nodered gz File Handling Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this…

  • CVE-2023-50214HigMay 3, 2024
    Dlink
    G416
    risk 0.57cvss 8.8epss 0.01

    D-Link G416 nodered tar File Handling Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this…

  • CVE-2023-50213HigMay 3, 2024
    Dlink
    G416
    risk 0.57cvss 8.8epss 0.01

    D-Link G416 nodered File Handling Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability.…

  • CVE-2023-50207HigMay 3, 2024
    Dlink
    G416
    risk 0.57cvss 8.8epss 0.01

    D-Link G416 flupl filename Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability. The…

  • CVE-2023-50206HigMay 3, 2024
    Dlink
    G416
    risk 0.57cvss 8.8epss 0.01

    D-Link G416 flupl query_type edit Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability.…

  • CVE-2023-50205HigMay 3, 2024
    Dlink
    G416
    risk 0.57cvss 8.8epss 0.01

    D-Link G416 awsfile chmod Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability. The…

  • CVE-2023-50204HigMay 3, 2024
    Dlink
    G416
    risk 0.57cvss 8.8epss 0.01

    D-Link G416 flupl pythonapp Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 wireless routers. Authentication is not required to exploit this…

  • CVE-2023-50203HigMay 3, 2024
    Dlink
    G416
    risk 0.57cvss 8.8epss 0.01

    D-Link G416 nodered chmod Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability. The…

  • CVE-2023-50202HigMay 3, 2024
    Dlink
    G416
    risk 0.57cvss 8.8epss 0.01

    D-Link G416 flupl pythonmodules Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 wireless routers. Authentication is not required to exploit this…

  • CVE-2023-50201HigMay 3, 2024
    Dlink
    G416
    risk 0.57cvss 8.8epss 0.01

    D-Link G416 cfgsave upusb Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability. The…

  • CVE-2023-50200HigMay 3, 2024
    Dlink
    G416
    risk 0.57cvss 8.8epss 0.01

    D-Link G416 cfgsave backusb Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability. The…

  • CVE-2023-50198HigMay 3, 2024
    Dlink
    G416
    risk 0.57cvss 8.8epss 0.01

    D-Link G416 cfgsave Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 wireless routers. Authentication is not required to exploit this vulnerability. The…

  • CVE-2023-44403HigMay 3, 2024
    Dlink
    DAP-1325
    risk 0.57cvss 8.8epss 0.01

    D-Link DAP-1325 HNAP SetWLanRadioSettings Channel Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit…

  • CVE-2023-42123HigMay 3, 2024
    Control By Web
    mysql_manager
    risk 0.57cvss 8.8epss 0.02

    Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability. The specific…