cve.bz

CWE-77: Improper Neutralization of Special Elements used in a Command, page 41

Filter

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

What the weakness is: CWE-77 at MITRE

Ask an AI about CWE-77

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-77: Improper Neutralization of Special Elements used in a Command and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/77.html and https://cve.bz/cve/cwe/77?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.8CVE-2024-35520EPSS 9.6%

    Netgear R7000 1.0.11.136 is vulnerable to Command Injection in RMT_invite.cgi via device_name2 parameter.

  2. 6.8CVE-2024-35519EPSS 1.0%

    Netgear EX6120 v1.0.0.68, Netgear EX6100 v1.0.2.28, and Netgear EX3700 v1.0.0.96 are vulnerable to command injection in operating_mode.cgi via the ap_mode parameter.

  3. 6.8CVE-2024-35518EPSS 1.0%

    Netgear EX6120 v1.0.0.68 is vulnerable to Command Injection in genie_fix2.cgi via the wan_dns1_pri parameter.

  4. 9.8CVE-2024-48153EPSS 0.7%

    DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_subconfig function.

  5. 7.2CVE-2024-35522EPSS 1.9%

    Netgear EX3700 ' AC750 WiFi Range Extender Essentials Edition before 1.0.0.98 contains an authenticated command injection in operating_mode.cgi via the ap_mode parameter with ap_24g_manual set to 1 and ap_24g_manual_sec set to NotNone.

  6. 7.2CVE-2024-35517EPSS 15%

    Netgear XR1000 v1.0.0.64 is vulnerable to command injection in usb_remote_smb_conf.cgi via the share_name parameter.

  7. 8.8CVE-2024-44413EPSS 3.1%

    A vulnerability was discovered in DI_8200-16.07.26A1, which has been classified as critical. This issue affects the upgrade_filter_asp function in the upgrade_filter.asp file. Manipulation of the path parameter can lead to command injectio…

  8. 6.9CVE-2024-39563EPSS 1.3%

    A Command Injection vulnerability in Juniper Networks Junos Space allows an unauthenticated, network-based attacker sending a specially crafted request to execute arbitrary shell commands on the Junos Space Appliance, leading to remote com…

  9. 5.3CVE-2024-9793EPSS 23%

    A vulnerability classified as critical was found in Tenda AC1206 up to 15.03.06.23. This vulnerability affects the function ate_iwpriv_set/ate_ifconfig_set of the file /goform/ate. The manipulation leads to command injection. The attack ca…

  10. 6.7CVE-2024-38817EPSS 0.5%

    VMware NSX contains a command injection vulnerability.  A malicious actor with access to the NSX Edge CLI terminal may be able to craft malicious payloads to execute arbitrary commands on the operating system as root.

  11. 7.8CVE-2024-7840EPSS 0.7%

    In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a command injection attack is possible through improper neutralization of hyperlink elements.

  12. 6.7CVE-2024-39438EPSS 0.3%

    In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed.

  13. 6.7CVE-2024-39437EPSS 0.3%

    In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed.

  14. 6.7CVE-2024-39436EPSS 0.3%

    In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed.

  15. 8.4CVE-2023-37154EPSS 0.5%

    check_by_ssh in Nagios nagios-plugins 2.4.5 allows arbitrary command execution via ProxyCommand, LocalCommand, and PermitLocalCommand with \${IFS}. This has been categorized both as fixed in e8810de, and as intended behavior.

  16. 7.8CVE-2024-43601EPSS 1.1%

    Visual Studio Code for Linux Remote Code Execution Vulnerability

  17. 9.1CVE-2024-43591EPSS 1.6%

    Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability

  18. 7.8CVE-2024-43497EPSS 0.7%

    DeepSpeed Remote Code Execution Vulnerability

  19. 7.2CVE-2024-9380KEVEPSS 58%

    An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.

  20. 9.3CVE-2024-47562EPSS 0.3%

    A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly neutralize special elements in user input to the ```ssmctl-client``` command. This could allow an authentica…

  21. 4.8CVE-2024-8983EPSS 0.4%

    Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capabil…

  22. 6.7CVE-2024-20492EPSS 0.6%

    A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnera…

  23. 8.8CVE-2024-20432EPSS 1.1%

    A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to perform a command injection attack against an affected device. &nbsp; This vuln…

  24. 7.2CVE-2024-20365EPSS 0.9%

    A vulnerability in the Redfish API of Cisco UCS B-Series, Cisco UCS Managed C-Series, and Cisco UCS X-Series Servers could allow an authenticated, remote attacker with administrative privileges to perform command injection attacks on an af…

  25. 8.0CVE-2024-46084EPSS 0.8%

    Scriptcase 9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_unzip function.

  26. 5.6CVE-2024-44610EPSS 1.0%

    PCAN-Ethernet Gateway FD before 1.3.0 and PCAN-Ethernet Gateway before 2.11.0 are vulnerable to Command injection via shell metacharacters in a Software Update to processing.php.

  27. 7.1CVE-2024-9145EPSS 0.8%

    Wiz Code Visual Studio Code extension in versions 1.0.0 up to 1.5.3 and Wiz (legacy) Visual Studio Code extension in versions 0.13.0 up to 0.17.8 are vulnerable to local command injection if the user opens a maliciously crafted Dockerfile …

  28. 9.8CVE-2024-46256EPSS 3.1%

    A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add Let's Encrypt Certificate.

  29. 4.0CVE-2024-45989EPSS 0.3%

    Monica AI Assistant desktop application v2.3.0 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. A prompt injection allows an attacker to modify chatbot answer with an unloaded image that exfiltrates the user's s…

  30. 8.8CVE-2024-39577EPSS 0.9%

    Dell SmartFabric OS10 Software, versions 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with remote access co…

  31. 5.5CVE-2024-8405EPSS 0.2%

    An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific flaw exists within the web-print.exe process, which can incorrectly create files that don’t exist whe…

  32. 7.8CVE-2024-7679EPSS 0.7%

    In Progress Telerik UI for WinForms versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elements.

  33. 9.8CVE-2024-7575EPSS 0.7%

    In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elements.

  34. 10.0CVE-2024-45066EPSS 0.8%

    A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE IP sub-menu can allow a remote attacker to inject arbitrary commands.

  35. 10.0CVE-2024-43693EPSS 0.8%

    A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE UTILITY sub-menu can allow a remote attacker to inject arbitrary commands.

  36. 9.8CVE-2024-42507EPSS 1.4%

    Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Succe…

  37. 9.8CVE-2024-42506EPSS 1.4%

    Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Succe…

  38. 9.8CVE-2024-42505EPSS 1.5%

    Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Succe…

  39. 8.8CVE-2024-0005EPSS 0.6%

    A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP configuration.

  40. 8.8CVE-2024-45348EPSS 0.8%

    Xiaomi Router AX9000 has a post-authorization command injection vulnerability. This vulnerability is caused by the lack of validation of user input, and an attacker can exploit this vulnerability to execute arbitrary code.

  41. 5.1CVE-2024-9076EPSS 21%

    A vulnerability was found in DedeCMS up to 5.7.115. It has been rated as critical. This issue affects some unknown processing of the file /dede/article_string_mix.php. The manipulation leads to os command injection. The attack may be initi…

  42. 9.8CVE-2024-45682EPSS 2.0%

    There is a command injection vulnerability that may allow an attacker to inject malicious input on the device's operating system.

  43. 7.8CVE-2024-42025EPSS 0.8%

    A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and earlier) allows a malicious actor with unifi user shell access to escalate privileges to root on the …

  44. 9.8CVE-2024-46048EPSS 18%

    Tenda FH451 v1.0.0.9 has a command injection vulnerability in the formexeCommand function i

  45. 8.8CVE-2024-8640EPSS 1.0%

    An issue has been discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. Due to incomplete input filtering, it was possible to inject commands into a co…

  46. 9.2CVE-2024-45824EPSS 1.3%

    CVE-2024-45824 IMPACT A remote code vulnerability exists in the affected products. The vulnerability occurs when chained with Path Traversal, Command Injection, and XSS Vulnerabilities and allows for full unauthenticated remote code exe…

  47. 8.8CVE-2024-44577EPSS 1.0%

    RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the time_date function.

  48. 8.8CVE-2024-44574EPSS 1.0%

    RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the sys_conf function.

  49. 8.8CVE-2024-44572EPSS 1.0%

    RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the sys_mgmt function.

  50. 8.8CVE-2024-44570EPSS 0.5%

    RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a code injection vulnerability via the getParams function in phpinf.php.