CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Description
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Hierarchy (View 1000)
Parents
Children
none
Related attack patterns (CAPEC)
CAPEC-108 · CAPEC-15 · CAPEC-43 · CAPEC-6 · CAPEC-88
CVEs mapped to this weakness (7,107)
page 167 of 356| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2012-5693 | Hig | 0.57 | 8.8 | 0.02 | Jan 3, 2020 | Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddressTB parameter to (1) remoteAttack.pl or (2) guessPassword.pl in frameworkgui/; the filename parameter to (3) CSAttack.pl or… | ||
| CVE-2019-9197 | Hig | 0.57 | 8.8 | 0.04 | Dec 31, 2019 | The com.unity3d.kharma protocol handler in Unity Editor 2018.3 allows remote attackers to execute arbitrary code. | ||
| CVE-2019-10774 | Cri | 0.57 | 9.8 | 0.05 | Dec 30, 2019 | php-shellcommand versions before 1.6.1 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. | ||
| CVE-2019-6014 | Hig | 0.57 | 8.8 | 0.01 | Dec 26, 2019 | DBA-1510P firmware 1.70b009 and earlier allows an attacker to execute arbitrary OS commands via Web User Interface. | ||
| CVE-2019-19920 | Hig | 0.57 | 8.8 | 0.03 | Dec 22, 2019 | sa-exim 4.2.1 allows attackers to execute arbitrary code if they can write a .cf file or a rule. This occurs because Greylisting.pm relies on eval (rather than direct parsing and/or use of the taint feature). This issue is similar to CVE-2018-11805. | ||
| CVE-2019-15598 | Cri | 0.57 | 9.8 | 0.03 | Dec 18, 2019 | A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command. | ||
| CVE-2019-3988 | Hig | 0.57 | 8.8 | 0.02 | Dec 11, 2019 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the bssid parameter. | ||
| CVE-2019-3987 | Hig | 0.57 | 8.8 | 0.02 | Dec 11, 2019 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the key parameter. | ||
| CVE-2019-3986 | Hig | 0.57 | 8.8 | 0.01 | Dec 11, 2019 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the encryption parameter. | ||
| CVE-2019-3985 | Hig | 0.57 | 8.8 | 0.02 | Dec 11, 2019 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the ssid parameter. | ||
| CVE-2014-0163 | Hig | 0.57 | 8.8 | 0.02 | Dec 11, 2019 | Openshift has shell command injection flaws due to unsanitized data being passed into shell commands. | ||
| CVE-2019-14889 | Hig | 0.57 | 8.8 | 0.03 | Dec 10, 2019 | A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way… | ||
| CVE-2019-19469 | Hig | 0.57 | 8.8 | 0.01 | Dec 1, 2019 | In Zmanda Management Console 3.3.9, ZMC_Admin_Advanced?form=adminTasks&action=Apply&command= allows CSRF, as demonstrated by command injection with shell metacharacters. This may depend on weak default credentials. | ||
| CVE-2019-16964 | Hig | 0.57 | 8.8 | 0.02 | Oct 21, 2019 | app/call_centers/cmd.php in the Call Center Queue Module in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated attackers (with at least the permission call_center_queue_add or call_center_queue_edit)… | ||
| CVE-2019-17501 | Hig | 0.57 | 8.8 | 0.02 | Oct 14, 2019 | Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > Discovery screen). CVE-2019-17501 and CVE-2019-16405 are similar to one another and may be the same. | ||
| CVE-2019-17499 | Hig | 0.57 | 8.8 | 0.03 | Oct 11, 2019 | The setter.xml component of the Common Gateway Interface on Compal CH7465LG 6.12.18.25-2p4 devices does not properly validate ping command arguments, which allows remote authenticated users to execute OS commands as root via shell metacharacters in the Target_IP parameter. | ||
| CVE-2019-11527 | Hig | 0.57 | 8.8 | 0.03 | Oct 10, 2019 | An issue was discovered in Softing uaGate SI 1.60.01. A CGI script is vulnerable to command injection with a maliciously crafted url parameter. | ||
| CVE-2019-15014 | Hig | 0.57 | 8.8 | 0.02 | Oct 9, 2019 | A command injection vulnerability exists in the Zingbox Inspector versions 1.286 and earlier, that allows for an authenticated user to execute arbitrary system commands in the CLI. | ||
| CVE-2019-12651 | Hig | 0.57 | 8.8 | 0.03 | Sep 25, 2019 | Multiple vulnerabilities in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands with elevated privileges on the affected device. For more information about these vulnerabilities, see the Details section… | ||
| CVE-2019-15701 | Hig | 0.57 | 8.8 | 0.02 | Aug 27, 2019 | components/Modals/HelpModal.jsx in BloodHound 2.2.0 allows remote attackers to execute arbitrary OS commands (by spawning a child process as the current user on the victim's machine) when the search function's autocomplete feature is used. The victim must import data from an… |
- risk 0.57cvss 8.8epss 0.02
Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddressTB parameter to (1) remoteAttack.pl or (2) guessPassword.pl in frameworkgui/; the filename parameter to (3) CSAttack.pl or…
- risk 0.57cvss 8.8epss 0.04
The com.unity3d.kharma protocol handler in Unity Editor 2018.3 allows remote attackers to execute arbitrary code.
- risk 0.57cvss 9.8epss 0.05
php-shellcommand versions before 1.6.1 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.
- risk 0.57cvss 8.8epss 0.01
DBA-1510P firmware 1.70b009 and earlier allows an attacker to execute arbitrary OS commands via Web User Interface.
- risk 0.57cvss 8.8epss 0.03
sa-exim 4.2.1 allows attackers to execute arbitrary code if they can write a .cf file or a rule. This occurs because Greylisting.pm relies on eval (rather than direct parsing and/or use of the taint feature). This issue is similar to CVE-2018-11805.
- risk 0.57cvss 9.8epss 0.03
A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command.
- risk 0.57cvss 8.8epss 0.02
Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the bssid parameter.
- risk 0.57cvss 8.8epss 0.02
Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the key parameter.
- risk 0.57cvss 8.8epss 0.01
Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the encryption parameter.
- risk 0.57cvss 8.8epss 0.02
Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the ssid parameter.
- risk 0.57cvss 8.8epss 0.02
Openshift has shell command injection flaws due to unsanitized data being passed into shell commands.
- risk 0.57cvss 8.8epss 0.03
A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way…
- risk 0.57cvss 8.8epss 0.01
In Zmanda Management Console 3.3.9, ZMC_Admin_Advanced?form=adminTasks&action=Apply&command= allows CSRF, as demonstrated by command injection with shell metacharacters. This may depend on weak default credentials.
- risk 0.57cvss 8.8epss 0.02
app/call_centers/cmd.php in the Call Center Queue Module in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated attackers (with at least the permission call_center_queue_add or call_center_queue_edit)…
- risk 0.57cvss 8.8epss 0.02
Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > Discovery screen). CVE-2019-17501 and CVE-2019-16405 are similar to one another and may be the same.
- risk 0.57cvss 8.8epss 0.03
The setter.xml component of the Common Gateway Interface on Compal CH7465LG 6.12.18.25-2p4 devices does not properly validate ping command arguments, which allows remote authenticated users to execute OS commands as root via shell metacharacters in the Target_IP parameter.
- risk 0.57cvss 8.8epss 0.03
An issue was discovered in Softing uaGate SI 1.60.01. A CGI script is vulnerable to command injection with a maliciously crafted url parameter.
- risk 0.57cvss 8.8epss 0.02
A command injection vulnerability exists in the Zingbox Inspector versions 1.286 and earlier, that allows for an authenticated user to execute arbitrary system commands in the CLI.
- risk 0.57cvss 8.8epss 0.03
Multiple vulnerabilities in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands with elevated privileges on the affected device. For more information about these vulnerabilities, see the Details section…
- risk 0.57cvss 8.8epss 0.02
components/Modals/HelpModal.jsx in BloodHound 2.2.0 allows remote attackers to execute arbitrary OS commands (by spawning a child process as the current user on the victim's machine) when the search function's autocomplete feature is used. The victim must import data from an…