Filtered by CWE-78
Filtered by vendor Subscriptions
Total 5430 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2017-6320 1 Barracuda 1 Load Balancer Adc 2025-04-20 8.8 High
A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1.006 (2016-08-19); fixed in 6.1.0.003 (2017-01-17)) in which an authenticated user can execute arbitrary shell commands and gain root privileges. The vulnerability stems from unsanitized data being processed in a system call when the delete_assessment command is issued.
CVE-2017-11566 1 Appsec-labs 1 Appuse 2025-04-20 7.8 High
AppUse 4.0 allows shell command injection via a proxy field.
CVE-2017-9828 1 Vivotek 6 Network Camera Fd8164, Network Camera Fd8164 Firmware, Network Camera Fd816ba and 3 more 2025-04-20 N/A
'/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attackers to execute any shell command as root via a crafted HTTP request. This vulnerability is already verified on VIVOTEK Network Camera IB8369/FD8164/FD816BA; most others have similar firmware that may be affected. An attack uses shell metacharacters in the senderemail parameter.
CVE-2017-11321 1 Ucopia 1 Wireless Appliance 2025-04-20 7.2 High
The restricted shell interface in UCOPIA Wireless Appliance before 5.1.8 allows remote authenticated users to gain 'admin' privileges via shell metacharacters in the less command.
CVE-2017-11381 1 Trendmicro 1 Deep Discovery Director 2025-04-20 N/A
A command injection vulnerability exists in Trend Micro Deep Discovery Director 1.1 that allows an attacker to restore accounts that can access the pre-configuration console.
CVE-2017-17105 1 Zivif 2 Pr115-204-p-rs, Pr115-204-p-rs Firmware 2025-04-20 N/A
Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 (and possibly in-between versions) web cameras are vulnerable to unauthenticated, blind remote command injection via CGI scripts used as part of the web interface, as demonstrated by a cgi-bin/iptest.cgi?cmd=iptest.cgi&-time="1504225666237"&-url=$(reboot) request.
CVE-2016-7844 1 Gigaccsecure 1 Gigacc Office 2025-04-20 N/A
GigaCC OFFICE ver.2.3 and earlier allows remote attackers to execute arbitrary OS commands via specially crafted mail template.
CVE-2016-7819 1 Iodata 4 Ts-wrla, Ts-wrla Firmware, Ts-wrlp and 1 more 2025-04-20 N/A
I-O DATA DEVICE TS-WRLP firmware version 1.01.02 and earlier and TS-WRLA firmware version 1.01.02 and earlier allows an attacker with administrator rights to execute arbitrary OS commands via unspecified vectors.
CVE-2017-6970 2 Alienvault, Nfsen 3 Ossim, Unified Security Management, Nfsen 2025-04-20 N/A
AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow local users to execute arbitrary commands in a privileged context via an NfSen socket, aka AlienVault ID ENG-104863.
CVE-2016-5313 1 Symantec 1 Web Gateway 2025-04-20 N/A
Symantec Web Gateway (SWG) before 5.2.5 allows remote authenticated users to execute arbitrary OS commands.
CVE-2017-1000116 3 Debian, Mercurial, Redhat 9 Debian Linux, Mercurial, Enterprise Linux and 6 more 2025-04-20 N/A
Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.
CVE-2017-16926 1 Ohcount Project 1 Ohcount 2025-04-20 N/A
Ohcount 3.0.0 is prone to a command injection via specially crafted filenames containing shell metacharacters, which can be exploited by an attacker (providing a source tree for Ohcount processing) to execute arbitrary code as the user running Ohcount.
CVE-2017-7981 2 Enalean, Phpwiki Project 2 Tuleap, Phpwiki 2025-04-20 N/A
Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin. This occurs in the Project Wiki component because the proc_open PHP function is used within PhpWiki before 1.5.5 with a syntax value in its first argument, and an authenticated Tuleap user can control this value, even with shell metacharacters, as demonstrated by a '<?plugin SyntaxHighlighter syntax="c;id"' line to execute the id command.
CVE-2017-1000220 1 Pidusage Project 1 Pidusage 2025-04-20 N/A
soyuka/pidusage <=1.1.4 is vulnerable to command injection in the module resulting in arbitrary command execution
CVE-2017-1000215 1 Xrootd 1 Xrootd 2025-04-20 N/A
ROOT xrootd version 4.6.0 and below is vulnerable to an unauthenticated shell command injection resulting in remote code execution
CVE-2017-10904 1 Qt 1 Qt 2025-04-20 N/A
Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
CVE-2017-12636 1 Apache 1 Couchdb 2025-04-20 N/A
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
CVE-2017-1000214 1 Gitphp Project 1 Gitphp 2025-04-20 N/A
GitPHP by xiphux is vulnerable to OS Command Injections
CVE-2017-2848 1 Foscam 2 C1 Indoor Hd Camera, C1 Indoor Hd Camera Firmware 2025-04-20 8.8 High
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configuration resulting in command injection. An attacker can simply send an HTTP request to the device to trigger this vulnerability.
CVE-2017-11395 1 Trendmicro 1 Smart Protection Server 2025-04-20 N/A
Command injection vulnerability in Trend Micro Smart Protection Server (Standalone) 3.1 and 3.2 server administration UI allows attackers with authenticated access to execute arbitrary code on vulnerable installations.