CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Description
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Hierarchy (View 1000)
Parents
Children
none
Related attack patterns (CAPEC)
CAPEC-108 · CAPEC-15 · CAPEC-43 · CAPEC-6 · CAPEC-88
CVEs mapped to this weakness (2,016)
page 85 of 101| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-40127 | 0.00 | — | 0.93 | Nov 14, 2022 | A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0. | |||
| CVE-2022-39321 | — | 0.00 | — | 0.01 | Oct 25, 2022 | GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is encoded into these… | ||
| CVE-2022-39327 | — | 0.00 | — | 0.01 | Oct 25, 2022 | Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an… | ||
| CVE-2022-40764 | 0.00 | — | 0.01 | Oct 3, 2022 | Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell… | |||
| CVE-2022-40929 | — | 0.00 | — | 0.01 | Sep 28, 2022 | XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. NOTE: this is disputed because the issues/4929 report is about an intended and supported use case (running arbitrary Bash scripts on behalf of users). | ||
| CVE-2022-39224 | 0.00 | — | 0.00 | Sep 21, 2022 | Arr-pm is an RPM reader/writer library written in Ruby. Versions prior to 0.0.12 are subject to OS command injection resulting in shell execution if the RPM contains a malicious "payload compressor" field. This vulnerability impacts the `extract` and `files` methods of the… | |||
| CVE-2022-25168 | — | 0.00 | — | 0.03 | Aug 4, 2022 | Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It… | ||
| CVE-2020-28447 | — | 0.00 | — | 0.01 | Jul 25, 2022 | This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopen(filepath) | ||
| CVE-2020-28435 | 0.00 | — | 0.01 | Jul 25, 2022 | This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js. | |||
| CVE-2020-7677 | — | 0.00 | — | 0.01 | Jul 25, 2022 | This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization. | ||
| CVE-2014-0156 | — | 0.00 | — | 0.01 | Jun 30, 2022 | Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as arguments. If untrusted input was included in command arguments, attacker could use this flaw to execute arbitrary command. | ||
| CVE-2022-33140 | 0.00 | — | 0.04 | Jun 15, 2022 | The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUserGroupProvider is… | |||
| CVE-2022-1986 | 0.00 | — | 0.09 | Jun 9, 2022 | OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9. | |||
| CVE-2022-24065 | — | 0.00 | — | 0.02 | Jun 3, 2022 | The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The… | ||
| CVE-2021-34078 | — | 0.00 | — | 0.03 | Jun 1, 2022 | lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file. | ||
| CVE-2021-34083 | — | 0.00 | — | 0.01 | Jun 1, 2022 | Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browser' option in versions up to 1.6.2, google-it will unsafely concat the result's link retrieved from google to a shell… | ||
| CVE-2021-32546 | 0.00 | — | 0.01 | May 31, 2022 | Missing input validation in internal/db/repo_editor.go in Gogs before 0.12.8 allows an attacker to execute code remotely. An unprivileged attacker (registered user) can overwrite the Git configuration in his repository. This leads to Remote Command Execution, because that… | |||
| CVE-2022-29256 | — | 0.00 | — | 0.00 | May 25, 2022 | sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at `npm install` time when installing versions of `sharp` prior to the latest v0.30.5. If an attacker has the ability to set the value of… | ||
| CVE-2022-24437 | — | 0.00 | — | 0.10 | May 1, 2022 | The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to… | ||
| CVE-2022-24881 | 0.00 | — | 0.05 | Apr 26, 2022 | Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, attackers can implement remote code execution through malicious code injection of the template engine. This happens because Velocity and freemarker templates… |
- CVE-2022-40127Nov 14, 2022risk 0.00cvss —epss 0.93
A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.
- CVE-2022-39321Oct 25, 2022risk 0.00cvss —epss 0.01
GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is encoded into these…
- CVE-2022-39327Oct 25, 2022risk 0.00cvss —epss 0.01
Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an…
- CVE-2022-40764Oct 3, 2022risk 0.00cvss —epss 0.01
Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell…
- CVE-2022-40929Sep 28, 2022risk 0.00cvss —epss 0.01
XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. NOTE: this is disputed because the issues/4929 report is about an intended and supported use case (running arbitrary Bash scripts on behalf of users).
- CVE-2022-39224Sep 21, 2022risk 0.00cvss —epss 0.00
Arr-pm is an RPM reader/writer library written in Ruby. Versions prior to 0.0.12 are subject to OS command injection resulting in shell execution if the RPM contains a malicious "payload compressor" field. This vulnerability impacts the `extract` and `files` methods of the…
- CVE-2022-25168Aug 4, 2022risk 0.00cvss —epss 0.03
Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It…
- CVE-2020-28447Jul 25, 2022risk 0.00cvss —epss 0.01
This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopen(filepath)
- CVE-2020-28435Jul 25, 2022risk 0.00cvss —epss 0.01
This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js.
- CVE-2020-7677Jul 25, 2022risk 0.00cvss —epss 0.01
This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.
- CVE-2014-0156Jun 30, 2022risk 0.00cvss —epss 0.01
Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as arguments. If untrusted input was included in command arguments, attacker could use this flaw to execute arbitrary command.
- CVE-2022-33140Jun 15, 2022risk 0.00cvss —epss 0.04
The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUserGroupProvider is…
- CVE-2022-1986Jun 9, 2022risk 0.00cvss —epss 0.09
OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9.
- CVE-2022-24065Jun 3, 2022risk 0.00cvss —epss 0.02
The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The…
- CVE-2021-34078Jun 1, 2022risk 0.00cvss —epss 0.03
lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file.
- CVE-2021-34083Jun 1, 2022risk 0.00cvss —epss 0.01
Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browser' option in versions up to 1.6.2, google-it will unsafely concat the result's link retrieved from google to a shell…
- CVE-2021-32546May 31, 2022risk 0.00cvss —epss 0.01
Missing input validation in internal/db/repo_editor.go in Gogs before 0.12.8 allows an attacker to execute code remotely. An unprivileged attacker (registered user) can overwrite the Git configuration in his repository. This leads to Remote Command Execution, because that…
- CVE-2022-29256May 25, 2022risk 0.00cvss —epss 0.00
sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at `npm install` time when installing versions of `sharp` prior to the latest v0.30.5. If an attacker has the ability to set the value of…
- CVE-2022-24437May 1, 2022risk 0.00cvss —epss 0.10
The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to…
- CVE-2022-24881Apr 26, 2022risk 0.00cvss —epss 0.05
Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, attackers can implement remote code execution through malicious code injection of the template engine. This happens because Velocity and freemarker templates…