CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Description
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Hierarchy (View 1000)
Parents
Children
none
Related attack patterns (CAPEC)
CAPEC-108 · CAPEC-15 · CAPEC-43 · CAPEC-6 · CAPEC-88
CVEs mapped to this weakness (2,016)
page 84 of 101| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-25908 | — | 0.00 | — | 0.01 | Jan 24, 2023 | All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization. | ||
| CVE-2022-25350 | — | 0.00 | — | 0.00 | Jan 24, 2023 | All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization. | ||
| CVE-2023-24422 | 0.00 | — | 0.00 | Jan 24, 2023 | A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in… | |||
| CVE-2020-23256 | 0.00 | — | 0.01 | Jan 20, 2023 | An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service. | |||
| CVE-2022-21191 | 0.00 | — | 0.01 | Jan 13, 2023 | Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function. | |||
| CVE-2022-25890 | — | 0.00 | — | 0.01 | Jan 9, 2023 | All versions of the package wifey are vulnerable to Command Injection via the connect() function due to improper input sanitization. | ||
| CVE-2022-25923 | — | 0.00 | — | 0.02 | Jan 6, 2023 | Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess() functionality due to improper user-input sanitization. | ||
| CVE-2022-24431 | — | 0.00 | — | 0.02 | Dec 21, 2022 | All versions of package abacus-ext-cmdline are vulnerable to Command Injection via the execute function due to improper user-input sanitization. | ||
| CVE-2022-25171 | — | 0.00 | — | 0.02 | Dec 21, 2022 | The package p4 before 0.0.7 are vulnerable to Command Injection via the run() function due to improper input sanitization | ||
| CVE-2022-4643 | 0.00 | — | 0.04 | Dec 21, 2022 | A vulnerability was found in docconv up to 1.2.0. It has been declared as critical. This vulnerability affects the function ConvertPDFImages of the file pdf_ocr.go. The manipulation of the argument path leads to os command injection. The attack can be initiated remotely.… | |||
| CVE-2022-24377 | — | 0.00 | — | 0.01 | Dec 15, 2022 | The package cycle-import-check before 1.3.2 are vulnerable to Command Injection via the writeFileToTmpDirAndOpenIt function due to improper user-input sanitization. | ||
| CVE-2022-25912 | — | 0.00 | — | 0.28 | Dec 12, 2022 | The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS… | ||
| CVE-2022-41642 | 0.00 | — | 0.02 | Dec 5, 2022 | OS command injection vulnerability in Nadesiko3 (PC Version) v3.3.61 and earlier allows a remote attacker to execute an arbitrary OS command when processing compression and decompression on the product. | |||
| CVE-2022-42496 | 0.00 | — | 0.02 | Dec 5, 2022 | OS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to obtain appkey of the product and execute an arbitrary OS command on the product. | |||
| CVE-2022-22984 | 0.00 | — | 0.05 | Nov 30, 2022 | The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package… | |||
| CVE-2022-24441 | 0.00 | — | 0.03 | Nov 30, 2022 | The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges… | |||
| CVE-2022-38649 | 0.00 | — | 0.07 | Nov 22, 2022 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue… | |||
| CVE-2022-40954 | 0.00 | — | 0.01 | Nov 22, 2022 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue… | |||
| CVE-2022-41131 | 0.00 | — | 0.01 | Nov 22, 2022 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue… | |||
| CVE-2022-40189 | 0.00 | — | 0.16 | Nov 22, 2022 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue… |
- CVE-2022-25908Jan 24, 2023risk 0.00cvss —epss 0.01
All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization.
- CVE-2022-25350Jan 24, 2023risk 0.00cvss —epss 0.00
All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization.
- CVE-2023-24422Jan 24, 2023risk 0.00cvss —epss 0.00
A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in…
- CVE-2020-23256Jan 20, 2023risk 0.00cvss —epss 0.01
An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service.
- CVE-2022-21191Jan 13, 2023risk 0.00cvss —epss 0.01
Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function.
- CVE-2022-25890Jan 9, 2023risk 0.00cvss —epss 0.01
All versions of the package wifey are vulnerable to Command Injection via the connect() function due to improper input sanitization.
- CVE-2022-25923Jan 6, 2023risk 0.00cvss —epss 0.02
Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess() functionality due to improper user-input sanitization.
- CVE-2022-24431Dec 21, 2022risk 0.00cvss —epss 0.02
All versions of package abacus-ext-cmdline are vulnerable to Command Injection via the execute function due to improper user-input sanitization.
- CVE-2022-25171Dec 21, 2022risk 0.00cvss —epss 0.02
The package p4 before 0.0.7 are vulnerable to Command Injection via the run() function due to improper input sanitization
- CVE-2022-4643Dec 21, 2022risk 0.00cvss —epss 0.04
A vulnerability was found in docconv up to 1.2.0. It has been declared as critical. This vulnerability affects the function ConvertPDFImages of the file pdf_ocr.go. The manipulation of the argument path leads to os command injection. The attack can be initiated remotely.…
- CVE-2022-24377Dec 15, 2022risk 0.00cvss —epss 0.01
The package cycle-import-check before 1.3.2 are vulnerable to Command Injection via the writeFileToTmpDirAndOpenIt function due to improper user-input sanitization.
- CVE-2022-25912Dec 12, 2022risk 0.00cvss —epss 0.28
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS…
- CVE-2022-41642Dec 5, 2022risk 0.00cvss —epss 0.02
OS command injection vulnerability in Nadesiko3 (PC Version) v3.3.61 and earlier allows a remote attacker to execute an arbitrary OS command when processing compression and decompression on the product.
- CVE-2022-42496Dec 5, 2022risk 0.00cvss —epss 0.02
OS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to obtain appkey of the product and execute an arbitrary OS command on the product.
- CVE-2022-22984Nov 30, 2022risk 0.00cvss —epss 0.05
The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package…
- CVE-2022-24441Nov 30, 2022risk 0.00cvss —epss 0.03
The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges…
- CVE-2022-38649Nov 22, 2022risk 0.00cvss —epss 0.07
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue…
- CVE-2022-40954Nov 22, 2022risk 0.00cvss —epss 0.01
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue…
- CVE-2022-41131Nov 22, 2022risk 0.00cvss —epss 0.01
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue…
- CVE-2022-40189Nov 22, 2022risk 0.00cvss —epss 0.16
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue…