Filtered by CWE-77
Filtered by vendor Subscriptions
Total 2458 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-5355 1 Anji-plus 1 Aj-report 2025-03-01 6.3 Medium
A vulnerability, which was classified as critical, has been found in anji-plus AJ-Report up to 1.4.1. This issue affects the function IGroovyHandler. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266267.
CVE-2023-21778 1 Microsoft 1 Dynamics 365 2025-03-01 8 High
Microsoft Dynamics Unified Service Desk Remote Code Execution Vulnerability
CVE-2023-1277 1 Ubuntukylin 1 Kylin-system-updater 2025-02-28 7.8 High
A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin. Affected is the function InstallSnap of the component Update Handler. The manipulation leads to command injection. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222600.
CVE-2024-29946 1 Splunk 2 Cloud, Splunk 2025-02-28 8.1 High
In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub lacks protections for risky SPL commands. This could let attackers bypass SPL safeguards for risky commands in the Hub. The vulnerability would require the attacker to phish the victim by tricking them into initiating a request within their browser.
CVE-2023-40598 1 Splunk 2 Splunk, Splunk Cloud Platform 2025-02-28 8.5 High
In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance.
CVE-2023-39362 2 Cacti, Fedoraproject 2 Cacti, Fedora 2025-02-28 7.2 High
Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution on the underlying server. The `lib/snmp.php` file has a set of functions, with similar behavior, that accept in input some variables and place them into an `exec` call without a proper escape or validation. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-23369 1 Qnap 3 Media Streaming Add-on, Multimedia Console, Qts 2025-02-27 9 Critical
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.2 ( 2023/05/04 ) and later Multimedia Console 1.4.8 ( 2023/05/05 ) and later QTS 5.1.0.2399 build 20230515 and later QTS 4.3.6.2441 build 20230621 and later QTS 4.3.4.2451 build 20230621 and later QTS 4.3.3.2420 build 20230621 and later QTS 4.2.6 build 20230621 and later Media Streaming add-on 500.1.1.2 ( 2023/06/12 ) and later Media Streaming add-on 500.0.0.11 ( 2023/06/16 ) and later
CVE-2023-0628 1 Docker 1 Docker Desktop 2025-02-27 6.1 Medium
Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:// URL.
CVE-2023-0978 2 Mcafee, Trellix 2 Advanced Threat Defense, Intelligent Sandbox 2025-02-27 6.4 Medium
A command injection vulnerability in Trellix Intelligent Sandbox CLI for version 5.2 and earlier, allows a local user to inject and execute arbitrary operating system commands using specially crafted strings. This vulnerability is due to insufficient validation of arguments that are passed to specific CLI command. The vulnerability allows the attack
CVE-2025-20117 2025-02-27 5.1 Medium
A vulnerability in the CLI of Cisco APIC could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient validation of arguments that are passed to specific CLI commands. An attacker could exploit this vulnerability by including crafted input as the argument of an affected CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of root.
CVE-2023-27240 1 Tenda 2 Ax3, Ax3 Firmware 2025-02-27 9.8 Critical
Tenda AX3 V16.03.12.11 was discovered to contain a command injection vulnerability via the lanip parameter at /goform/AdvSetLanip.
CVE-2023-28460 1 Arraynetworks 21 Apv10650, Apv11600, Apv1600 and 18 more 2025-02-27 7.2 High
A command injection vulnerability was discovered in Array Networks APV products. A remote attacker can send a crafted packet after logging into the affected appliance as an administrator, resulting in arbitrary shell code execution. This is fixed in 8.6.1.262 or newer and 10.4.2.93 or newer.
CVE-2023-28617 2 Gnu, Redhat 6 Org Mode, Enterprise Linux, Rhel Aus and 3 more 2025-02-27 7.8 High
org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters.
CVE-2022-4009 1 Octopus 1 Octopus Server 2025-02-27 8.8 High
In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation
CVE-2023-1168 1 Hpe 20 Aruba Cx 10000-48y6, Aruba Cx 6200f 48g, Aruba Cx 6200m 24g and 17 more 2025-02-26 7.2 High
An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system, leading to a complete compromise of the switch running AOS-CX.
CVE-2024-30220 1 Planex 1 Mzk-mf300n Firmware 2025-02-26 8.8 High
Command injection vulnerability in PLANEX COMMUNICATIONS wireless LAN routers allows a network-adjacent unauthenticated attacker to execute an arbitrary command by sending a specially crafted request to a certain port. Note that MZK-MF300N is no longer supported, therefore the update for this product is not provided.
CVE-2024-57608 2025-02-26 6.5 Medium
An issue in Via Browser 6.1.0 allows a a remote attacker to execute arbitrary code via the mark.via.Shell component.
CVE-2023-27224 1 Jc21 1 Nginx Proxy Manager 2025-02-26 9.8 Critical
An issue found in NginxProxyManager v.2.9.19 allows an attacker to execute arbitrary code via a lua script to the configuration file.
CVE-2023-27079 1 Tenda 2 G103, G103 Firmware 2025-02-26 7.5 High
Command Injection vulnerability found in Tenda G103 v.1.0.05 allows an attacker to obtain sensitive information via a crafted package
CVE-2023-27078 1 Tp-link 2 Tl-mr3020, Tl-mr3020 Firmware 2025-02-26 9.8 Critical
A command injection issue was found in TP-Link MR3020 v.1_150921 that allows a remote attacker to execute arbitrary commands via a crafted request to the tftp endpoint.