VYPR

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-15 · CAPEC-43 · CAPEC-6 · CAPEC-88

CVEs mapped to this weakness (7,107)

page 202 of 356
  • CVE-2021-26115HigDec 19, 2024
    Fortinet
    Fortiwan
    risk 0.51cvss 7.8epss 0.01

    An OS command injection (CWE-78) vulnerability in FortiWAN version 4.5.7 and below Command Line Interface may allow a local, authenticated and unprivileged attacker to escalate their privileges to root via executing a specially-crafted command.An OS command injection (CWE-78)…

  • CVE-2024-52058HigDec 13, 2024
    Rti
    Connext Professional
    risk 0.51cvss 7.8epss 0.01

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in RTI Connext Professional (System Designer) allows OS Command Injection.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.0 before 6.1.2.19.

  • CVE-2024-47115HigDec 7, 2024
    IBM
    Aix
    risk 0.51cvss 7.8epss 0.00

    IBM AIX 7.2, 7.3 and VIOS 3.1 and 4.1 could allow a local user to execute arbitrary commands on the system due to improper neutralization of input.

  • CVE-2024-48861HigNov 22, 2024
    Qnap
    Qurouter
    risk 0.51cvss 7.8epss 0.01

    An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local network attackers to execute commands. We have already fixed the vulnerability in the following versions: QuRouter 2.4.4.106 and later

  • CVE-2024-7517HigNov 21, 2024
    Brocade
    Fabric OS
    risk 0.51cvss 7.8epss 0.01

    A command injection vulnerability in Brocade Fabric OS before 9.2.0c, and 9.2.1 through 9.2.1a on IP extension platforms could allow a local authenticated attacker to perform a privileged escalation via crafted use of the portcfg command. This specific exploitation is only…

  • CVE-2024-38641HigSep 6, 2024
    Qnap
    Qts
    risk 0.51cvss 7.8epss 0.01

    An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local network users to execute commands via unspecified vectors. We have already fixed the vulnerability in the following…

  • CVE-2024-42736HigAug 13, 2024
    Totolink
    X5000R
    risk 0.51cvss 7.8epss 0.02

    In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in addBlacklist. Authenticated Attackers can send malicious packet to execute arbitrary commands.

  • CVE-2024-34013HigJul 18, 2024
    Acronis
    True Image
    risk 0.51cvss 7.8epss 0.01

    Local privilege escalation due to OS command injection vulnerability. The following products are affected: Acronis True Image (macOS) before build 41396, Acronis True Image OEM (macOS) before build 42571.

  • CVE-2024-39524HigJul 11, 2024
    Juniper Networks
    OS Evolved
    risk 0.51cvss 7.8epss 0.00

    An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to 'root' leading to a full compromise of the system. The Junos OS Evolved CLI…

  • CVE-2024-39523HigJul 11, 2024
    Juniper Networks
    OS Evolved
    risk 0.51cvss 7.8epss 0.00

    An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to 'root' leading to a full compromise of the system. The Junos OS Evolved CLI…

  • CVE-2024-39522HigJul 11, 2024
    Juniper Networks
    OS Evolved
    risk 0.51cvss 7.8epss 0.00

    An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to 'root' leading to a full compromise of the system. The Junos OS Evolved CLI…

  • CVE-2024-39521HigJul 11, 2024
    Juniper Networks
    OS Evolved
    risk 0.51cvss 7.8epss 0.00

    An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to 'root' leading to a full compromise of the system. The Junos OS Evolved CLI…

  • CVE-2024-39520HigJul 11, 2024
    Juniper Networks
    OS Evolved
    risk 0.51cvss 7.8epss 0.00

    An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to 'root' leading to a full compromise of the system. The Junos OS Evolved CLI…

  • CVE-2024-20399MedKEVJul 1, 2024
    Cisco Systems, Inc.
    NX-OS Software
    risk 0.51cvss 6.0epss 0.04

    A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation…

  • CVE-2024-20326HigMay 16, 2024
    Cisco Systems, Inc.
    Crosswork Network Services Orchestrator
    risk 0.51cvss 7.8epss 0.00

    A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to read and write arbitrary files as root on the underlying operating system. This vulnerability is due to improper…

  • CVE-2024-30314HigMay 16, 2024
    Adobe Inc.
    Dreamweaver
    risk 0.51cvss 7.8epss 0.01

    Dreamweaver Desktop versions 21.3 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does require user…

  • CVE-2023-42122HigMay 3, 2024
    Control By Web
    Control Web Panel
    risk 0.51cvss 7.8epss 0.01

    Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Control Web Panel. An attacker must first obtain the ability to execute low-privileged code on the…

  • CVE-2024-24890HigMar 25, 2024
    Openeuler
    gala-gopher
    risk 0.51cvss 7.8epss 0.01

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler gala-gopher on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/gala-gopher/blob/master/src/probes/…

  • CVE-2024-2415HigMar 13, 2024
    Movistar
    4G router
    risk 0.51cvss 7.8epss 0.01

    Command injection vulnerability in Movistar 4G router affecting version ES_WLD71-T1_v2.0.201820. This vulnerability allows an authenticated user to execute commands inside the router by making a POST request to the URL '/cgi-bin/gui.cgi'.

  • CVE-2024-22228HigFeb 12, 2024
    Dell
    Unity
    risk 0.51cvss 7.8epss 0.01

    Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_cifssupport utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root…