VYPR

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-15 · CAPEC-43 · CAPEC-6 · CAPEC-88

CVEs mapped to this weakness (6,835)

page 72 of 342
  • CVE-2020-7636CriApr 6, 2020
    Adb Driver Project
    Adb Driver
    risk 0.64cvss 9.8epss 0.04

    adb-driver through 0.1.8 is vulnerable to Command Injection.It allows execution of arbitrary commands via the command function.

  • CVE-2020-7635CriApr 6, 2020
    Compass Compile Project
    Compass Compile
    risk 0.64cvss 9.8epss 0.04

    compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument.

  • CVE-2020-7633CriApr 6, 2020
    Apiconnect CLI Plugins Project
    Apiconnect CLI Plugins
    risk 0.64cvss 9.8epss 0.04

    apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via the pluginUri argument.

  • CVE-2020-7632CriApr 6, 2020
    Node Mpv Project
    Node Mpv
    risk 0.64cvss 9.8epss 0.04

    node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.

  • CVE-2020-7631CriApr 6, 2020
    Diskusage Ng Project
    Diskusage Ng
    risk 0.64cvss 9.8epss 0.04

    diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument.

  • CVE-2020-7630CriApr 2, 2020
    Git Add Remote Project
    Git Add Remote
    risk 0.64cvss 9.8epss 0.04

    git-add-remote through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the name argument.

  • CVE-2020-7629CriApr 2, 2020
    Install Package Project
    Install Package
    risk 0.64cvss 9.8epss 0.04

    install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.

  • CVE-2020-7628CriApr 2, 2020
    Umount Project
    Umount
    risk 0.64cvss 9.8epss 0.02

    umount through 1.1.6 is vulnerable to Command Injection. The argument device can be controlled by users without any sanitization.

  • CVE-2020-7627CriApr 2, 2020
    Node Key Sender Project
    Node Key Sender
    risk 0.64cvss 9.8epss 0.04

    node-key-sender through 1.0.11 is vulnerable to Command Injection. It allows execution of arbitrary commands via the 'arrParams' argument in the 'execute()' function.

  • CVE-2020-7626CriApr 2, 2020
    Karma Mojo Project
    Karma Mojo
    risk 0.64cvss 9.8epss 0.04

    karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument.

  • CVE-2020-7624CriApr 2, 2020
    Effect Project
    Effect
    risk 0.64cvss 9.8epss 0.04

    effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument.

  • CVE-2020-7621CriApr 2, 2020
    IBM
    Strongloop Nginx Controller
    risk 0.64cvss 9.8epss 0.03

    strong-nginx-controller through 1.0.2 is vulnerable to Command Injection. It allows execution of arbitrary command as part of the '_nginxCmd()' function.

  • CVE-2020-7620CriApr 2, 2020
    Netease
    Pomelo Monitor
    risk 0.64cvss 9.8epss 0.02

    pomelo-monitor through 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' params.

  • CVE-2020-7619CriApr 2, 2020
    Get Git Data Project
    Get Git Data
    risk 0.64cvss 9.8epss 0.02

    get-git-data through 1.3.1 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments provided to get-git-data.

  • CVE-2019-19606CriMar 30, 2020
    Plane
    Plane
    risk 0.64cvss 9.8epss 0.02

    X-Plane before 11.41 has multiple improper path validations that could allow reading and writing files from/to arbitrary paths (or a leak of OS credentials to a remote system) via crafted network packets. This could be used to execute arbitrary commands on the system.

  • CVE-2020-10886CriMar 25, 2020
    TP-Link
    Archer A7
    risk 0.64cvss 9.8epss 0.06

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tmpServer service, which…

  • CVE-2020-10882HigMar 25, 2020
    TP-Link
    Archer A7
    risk 0.64cvss 8.8epss 0.41

    This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service,…

  • CVE-2020-5561CriMar 25, 2020
    Keijiban Tsumiki
    Keijiban Tsumiki
    risk 0.64cvss 9.8epss 0.02

    Keijiban Tsumiki v1.15 allows remote attackers to execute arbitrary OS commands via unspecified vectors.

  • CVE-2020-5560CriMar 25, 2020
    WL-Enq
    WL-Enq
    risk 0.64cvss 9.8epss 0.02

    WL-Enq 1.11 and 1.12 allows remote attackers to execute arbitrary OS commands with the administrative privilege via unspecified vectors.

  • CVE-2020-5556CriMar 25, 2020
    Shihonkanri Plus GOOUT
    Plus GOOUT
    risk 0.64cvss 9.8epss 0.02

    Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to execute arbitrary OS commands via unspecified vectors.