Filtered by CWE-77
Filtered by vendor Subscriptions
Total 2150 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-10193 1 Wavlink 6 Wn530h4, Wn530h4 Firmware, Wn530hg4 and 3 more 2024-10-23 4.7 Medium
A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028 and classified as critical. This issue affects the function ping_ddns of the file internet.cgi. The manipulation of the argument DDNS leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-40089 1 Viloliving 1 Vilo 5 Mesh Wifi System Firmware 2024-10-23 9.1 Critical
A Command Injection vulnerability in Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, authenticated attackers to execute arbitrary code by injecting shell commands into the name of the Vilo device.
CVE-2024-48904 1 Trendmicro 1 Cloud Edge 2024-10-23 9.8 Critical
An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances. Please note: authentication is not required in order to exploit this vulnerability.
CVE-2024-35285 1 Mitel 1 Micollab Nupoint Messanger 2024-10-23 9.8 Critical
A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization.
CVE-2024-48659 1 Dcnglobal 1 Dcme-320-l Firmware 2024-10-23 9.8 Critical
An issue in DCME-320-L <=9.3.2.114 allows a remote attacker to execute arbitrary code via the log_u_umount.php component.
CVE-2024-48153 1 Draytek 1 Vigor3900 Firmware 2024-10-17 9.8 Critical
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_subconfig function.
CVE-2024-39438 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2024-10-17 6.5 Medium
In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed.
CVE-2024-39437 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2024-10-17 6.5 Medium
In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed.
CVE-2024-39436 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2024-10-17 6.5 Medium
In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed.
CVE-2024-35519 1 Netgear 6 Ex3700, Ex3700 Firmware, Ex6100 and 3 more 2024-10-16 8.4 High
Netgear EX6120 v1.0.0.68, Netgear EX6100 v1.0.2.28, and Netgear EX3700 v1.0.0.96 are vulnerable to command injection in operating_mode.cgi via the ap_mode parameter.
CVE-2024-35520 1 Netgear 2 R7000, R7000 Firmware 2024-10-16 8.4 High
Netgear R7000 1.0.11.136 is vulnerable to Command Injection in RMT_invite.cgi via device_name2 parameter.
CVE-2024-35518 1 Netgear 2 Ex6120, Ex6120 Firmware 2024-10-16 8.4 High
Netgear EX6120 v1.0.0.68 is vulnerable to Command Injection in genie_fix2.cgi via the wan_dns1_pri parameter.
CVE-2024-44413 1 Dlink 1 Di-8200 Firmware 2024-10-16 8.8 High
A vulnerability was discovered in DI_8200-16.07.26A1, which has been classified as critical. This issue affects the upgrade_filter_asp function in the upgrade_filter.asp file. Manipulation of the path parameter can lead to command injection.
CVE-2024-7840 1 Progress 1 Telerik Reporting 2024-10-15 7.8 High
In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a command injection attack is possible through improper neutralization of hyperlink elements.
CVE-2024-39563 1 Juniper 1 Junos Space 2024-10-15 7.3 High
A Command Injection vulnerability in Juniper Networks Junos Space allows an unauthenticated, network-based attacker sending a specially crafted request to execute arbitrary shell commands on the Junos Space Appliance, leading to remote command execution by the web application, gaining complete control of the device. A specific script in the Junos Space web application allows attacker-controlled input from a GET request without sufficient input sanitization. A specially crafted request can exploit this vulnerability to execute arbitrary shell commands on the Junos Space Appliance. This issue affects Junos Space 24.1R1. Previous versions of Junos Space are unaffected by this vulnerability.
CVE-2024-47562 1 Siemens 1 Sinec Security Monitor 2024-10-11 8.8 High
A vulnerability has been identified in Siemens SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly neutralize special elements in user input to the ```ssmctl-client``` command. This could allow an authenticated, lowly privileged local attacker to execute privileged commands in the underlying OS.
CVE-2024-44400 2 D-link, Dlink 3 Di-8400 Firmware, Di-8400, Di-8400 Firmware 2024-10-11 8 High
A vulnerability was discovered in DI_8400-16.07.26A1, which has been classified as critical. This issue affects the upgrade_filter_asp function in the upgrade_filter.asp file. Manipulation of the path parameter can lead to command injection.
CVE-2024-9380 1 Ivanti 1 Endpoint Manager Cloud Services Appliance 2024-10-10 7.2 High
An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.
CVE-2023-37154 1 Nagios 1 Plugins 2024-10-10 8.4 High
check_by_ssh in Nagios nagios-plugins 2.4.5 allows arbitrary command execution via ProxyCommand, LocalCommand, and PermitLocalCommand with \${IFS}. This has been categorized both as fixed in e8810de, and as intended behavior.
CVE-2024-38817 1 Vmware 3 Cloud Foundation, Nsx, Nsx-t 2024-10-10 6.7 Medium
VMware NSX contains a command injection vulnerability.  A malicious actor with access to the NSX Edge CLI terminal may be able to craft malicious payloads to execute arbitrary commands on the operating system as root.