Filtered by CWE-78
Filtered by vendor Subscriptions
Total 5420 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-41942 1 Sourcegraph 1 Sourcegraph 2025-04-23 7.9 High
Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host parameter of the `/list-gitolite` endpoint. It was possible to send a crafted request to gitserver that would execute commands inside the container. Successful exploitation requires the ability to send local requests to gitserver. The issue is patched in version 4.1.0.
CVE-2023-7002 1 Backupbliss 1 Backup Migration 2025-04-23 7.2 High
The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operating system.
CVE-2022-45026 1 Markdown Preview Enhanced Project 1 Markdown Preview Enhanced 2025-04-23 9.8 Critical
An issue in Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom allows attackers to execute arbitrary commands during the GFM export process.
CVE-2022-45025 1 Markdown Preview Enhanced Project 1 Markdown Preview Enhanced 2025-04-23 9.8 Critical
Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerability via the PDF file import function.
CVE-2022-45506 1 Tenda 2 W30e, W30e Firmware 2025-04-23 9.8 Critical
Tenda W30E v1.0.1.25(633) was discovered to contain a command injection vulnerability via the fileNameMit parameter at /goform/delFileName.
CVE-2022-45497 1 Tenda 2 W6-s, W6-s Firmware 2025-04-23 9.8 Critical
Tenda W6-S v1.0.0.4(510) was discovered to contain a command injection vulnerability in the tpi_get_ping_output function at /goform/exeCommand.
CVE-2022-43464 1 Unimo 6 Udr-ja1604, Udr-ja1604 Firmware, Udr-ja1608 and 3 more 2025-04-23 8.8 High
Hidden functionality vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.
CVE-2020-6627 1 Seagate 6 Stcg2000300, Stcg2000300 Firmware, Stcg3000300 and 3 more 2025-04-23 9.8 Critical
The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in cirrus/application/helpers/mv_backend_helper.php by leveraging the "start" state and sending a check_device_name request.
CVE-2022-45145 1 Call-cc 1 Chicken 2025-04-23 9.8 Critical
egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file.
CVE-2022-44606 1 Unimo 6 Udr-ja1604, Udr-ja1604 Firmware, Udr-ja1608 and 3 more 2025-04-23 8.8 High
OS command injection vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.
CVE-2022-43867 2 Ibm, Linux 2 Spectrum Scale Container Native Storage Access, Linux Kernel 2025-04-23 7.8 High
IBM Spectrum Scale 5.1.0.1 through 5.1.4.1 could allow a local attacker to execute arbitrary commands in the container. IBM X-Force ID: 239437.
CVE-2022-25912 1 Simple-git Project 1 Simple-git 2025-04-23 8.1 High
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).
CVE-2022-45043 1 Tenda 2 Ax12, Ax12 Firmware 2025-04-22 8.8 High
Tenda AX12 V22.03.01.16_cn is vulnerable to command injection via goform/fast_setting_internet_set.
CVE-2022-45996 1 Tenda 2 W15e, W20e Firmware 2025-04-22 7.2 High
Tenda W20E V16.01.0.6(3392) is vulnerable to Command injection via cmd_get_ping_output.
CVE-2022-45977 1 Tenda 2 Ax12, Ax12 Firmware 2025-04-22 8.8 High
Tenda AX12 V22.03.01.21_CN was found to have a command injection vulnerability via /goform/setMacFilterCfg function.
CVE-2021-32849 1 Gerapy 1 Gerapy 2025-04-22 8.8 High
Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in version 0.9.9. There are no known workarounds.
CVE-2022-24725 1 Shescape Project 1 Shescape 2025-04-22 6.2 Medium
Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bash with the `escape` or `escapeAll` functions from the _shescape_ API with the `interpolation` option set to `true`. Other tested shells, Dash and Zsh, are not affected. Depending on how the output of _shescape_ is used, directory traversal may be possible in the application using _shescape_. The issue was patched in version 1.5.1. As a workaround, manually escape all instances of the tilde character (`~`) using `arg.replace(/~/g, "\\~")`.
CVE-2022-24803 1 Asciidoctor-include-ext Project 1 Asciidoctor-include-ext 2025-04-22 10 Critical
Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible even when `allow-uri-read` is disabled! The problem has been patched in the referenced commits.
CVE-2024-50993 1 Netgear 2 R8500, R8500 Firmware 2025-04-22 8 High
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at admin_account.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
CVE-2022-31137 1 Roxy-wi 1 Roxy-wi 2025-04-22 10 Critical
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. System commands can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Attackers need not be authenticated to exploit this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.