Filtered by CWE-77
Filtered by vendor Subscriptions
Total 2165 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-3086 1 Moxa 100 Uc-2101-lx, Uc-2101-lx Firmware, Uc-2102-lx and 97 more 2024-11-21 7.1 High
Cradlepoint IBR600 NCOS versions 6.5.0.160bc2e and prior are vulnerable to shell escape, which enables local attackers with non-superuser credentials to gain full, unrestrictive shell access which may allow an attacker to execute arbitrary code.
CVE-2022-3008 2 Debian, Tinygltf Project 2 Debian Linux, Tinygltf 2024-11-21 8.1 High
The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input that would result in a path expansion. We recommend upgrading to 2.6.0 or past commit 52ff00a38447f06a17eab1caa2cf0730a119c751
CVE-2022-39987 1 Raspap 1 Raspap 2024-11-21 8.8 High
A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via the "entity" POST parameters in /ajax/networking/get_wgkey.php.
CVE-2022-39986 1 Raspap 1 Raspap 2024-11-21 9.8 Critical
A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg_id parameter in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php.
CVE-2022-39265 1 Mybb 1 Mybb 2024-11-21 7.2 High
MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the `_Can manage settings?_` permission and may depend on configured file permissions. MyBB 1.8.31 resolves this issue with the commit `0cd318136a`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2022-39243 2 Linux, Nuprocess Project 2 Linux Kernel, Nuprocess 2024-11-21 8.4 High
NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check. This vulnerability can only be exploited to inject command line arguments on Linux. Version 2.0.5 contains a patch. As a workaround, users of the library can sanitize command strings to remove NUL characters prior to passing them to NuProcess for execution.
CVE-2022-39088 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2024-11-21 6.7 Medium
In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed.
CVE-2022-39087 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2024-11-21 6.7 Medium
In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed.
CVE-2022-39086 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2024-11-21 6.7 Medium
In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed.
CVE-2022-39085 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2024-11-21 6.7 Medium
In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed.
CVE-2022-39084 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2024-11-21 6.7 Medium
In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed.
CVE-2022-39083 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2024-11-21 6.7 Medium
In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed.
CVE-2022-39082 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2024-11-21 6.7 Medium
In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed.
CVE-2022-39081 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2024-11-21 6.7 Medium
In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed.
CVE-2022-39073 1 Zte 2 Mf286r, Mf286r Firmware 2024-11-21 9.8 Critical
There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the vulnerability to execute arbitrary commands.
CVE-2022-37704 1 Zmanda 1 Amanda 2024-11-21 6.7 Medium
Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which may lead to escalation of privileges, denial of service, and information disclosure.
CVE-2022-37425 2 Linux, Opennebula 2 Linux Kernel, Opennebula 2024-11-21 9.9 Critical
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in OpenNebula OpenNebula core on Linux allows Remote Code Inclusion.
CVE-2022-37125 1 Dlink 2 Dir-816, Dir-816 Firmware 2024-11-21 9.8 Critical
D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/NTPSyncWithHost.
CVE-2022-36962 1 Solarwinds 1 Orion Platform 2024-11-21 7.2 High
SolarWinds Platform was susceptible to Command Injection. This vulnerability allows a remote adversary with complete control over the SolarWinds database to execute arbitrary commands.
CVE-2022-36786 1 Dlink 2 Dsl-224, Dsl-224 Firmware 2024-11-21 9.9 Critical
DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 has an interface where you can configure NTP servers (Network Time Protocol) via jsonrpc API. It is possible to inject a command through this interface that will run with ROOT permissions on the router.