cve.bz

CWE-77: Improper Neutralization of Special Elements used in a Command, page 47

Filter

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

What the weakness is: CWE-77 at MITRE

Ask an AI about CWE-77

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-77: Improper Neutralization of Special Elements used in a Command and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/77.html and https://cve.bz/cve/cwe/77?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.2CVE-2024-1356EPSS 1.2%

    Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operat…

  2. 6.8CVE-2023-51835EPSS 7.3%

    An issue in TRENDnet TEW-822DRE v.1.03B02 allows a local attacker to execute arbitrary code via the parameters ipv4_ping in the /boafrm/formSystemCheck.

  3. 8.8CVE-2024-26298EPSS 0.9%

    Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as…

  4. 8.8CVE-2024-26297EPSS 0.9%

    Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as…

  5. 8.8CVE-2024-26296EPSS 0.9%

    Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as…

  6. 8.8CVE-2024-26295EPSS 0.9%

    Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as…

  7. 8.8CVE-2024-26294EPSS 0.9%

    Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as…

  8. 8.0CVE-2024-22544EPSS 9.3%

    An issue was discovered in Linksys Router E1700 version 1.0.04 (build 3), allows authenticated attackers to execute arbitrary code via the setDateTime function.

  9. 6.5CVE-2024-25082EPSS 1.9%

    Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.

  10. 4.2CVE-2024-25081EPSS 1.1%

    Splinefont in FontForge through 20230101 allows command injection via crafted filenames.

  11. 9.8CVE-2023-49959EPSS 1.4%

    In Indo-Sol PROFINET-INspektor NT through 2.4.0, a command injection vulnerability in the gedtupdater service of the firmware allows remote attackers to execute arbitrary system commands with root privileges via a crafted filename paramete…

  12. 9.8CVE-2024-1781EPSS 15%

    A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_20230719. It has been rated as critical. This issue affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component shttpd. The manipulation leads to comma…

  13. 9.8CVE-2024-25850EPSS 19%

    Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the wps_ap_ssid5g parameter

  14. 9.8CVE-2023-24331EPSS 2.1%

    Command Injection vulnerability in D-Link Dir 816 with firmware version DIR-816_A2_v1.10CNB04 allows attackers to run arbitrary commands via the urlAdd parameter.

  15. 8.8CVE-2023-24330EPSS 1.3%

    Command Injection vulnerability in D-Link Dir 882 with firmware version DIR882A1_FW130B06 allows attackers to run arbitrary commands via crafted POST request to /HNAP1/.

  16. 7.8CVE-2024-23346ExploitEPSS 3.8%

    Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prio…

  17. 9.8CVE-2024-24377EPSS 1.1%

    An issue in idocv v.14.1.3_20231228 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted script.

  18. 8.8CVE-2024-24301EPSS 2.1%

    Command Injection vulnerability discovered in 4ipnet EAP-767 device v3.42.00 within the web interface of the device allows attackers with valid credentials to inject arbitrary shell commands to be executed by the device with root privilege…

  19. 8.7CVE-2024-22093EPSS 0.8%

    When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed systems. A successful exploit can allow the attacker to cross a security boundary.  Not…

  20. 9.1CVE-2024-1378EPSS 2.3%

    A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via nomad templates when configuring SMTP options…

  21. 9.1CVE-2024-1374EPSS 2.6%

    A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via nomad templates when configuring audit log fo…

  22. 9.1CVE-2024-1372EPSS 2.3%

    A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when configuring SAML settings. Exploitation of t…

  23. 9.1CVE-2024-1369EPSS 2.3%

    A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when setting the username and password for collec…

  24. 9.1CVE-2024-1359EPSS 2.3%

    A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when setting up an HTTP proxy. Exploitation of th…

  25. 9.1CVE-2024-1355EPSS 2.4%

    A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via the actions-console docker container while se…

  26. 8.0CVE-2024-1354EPSS 1.7%

    A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via the `syslog-ng` configuration file. Exploitat…

  27. 7.5CVE-2024-20667EPSS 1.4%

    Azure DevOps Server Remote Code Execution Vulnerability

  28. 8.3CVE-2023-47218ExploitEPSS 90%

    An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the …

  29. 7.8CVE-2024-23749ExploitEPSS 4.7%

    KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitization and validation, failure to escape special characters, and insecure system calls (at lines 2369-…

  30. 9.8CVE-2023-49716EPSS 0.6%

    In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an authenticated user with network access could run arbitrary commands from a remote computer.

  31. 9.8CVE-2023-46687EPSS 0.9%

    In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could execute arbitrary commands in root context from a remote computer.

  32. 8.8CVE-2023-40263EPSS 1.2%

    An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows authenticated command injection via ftp.

  33. 9.8CVE-2024-24321EPSS 1.9%

    An issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4_ssid_2 parameter in the sub_42DA54 function.

  34. 9.8CVE-2024-24216EPSS 1.3%

    Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/module/repo/model.php.

  35. 9.8CVE-2024-23049EPSS 1.2%

    An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component.

  36. 7.2CVE-2024-22107EPSS 2.5%

    An issue was discovered in GTB Central Console 15.17.1-30814.NG. The method systemSettingsDnsDataAction at /opt/webapp/src/AppBundle/Controller/React/SystemSettingsController.php is vulnerable to command injection via the /old/react/v1/api…

  37. 8.8CVE-2023-47562EPSS 1.1%

    An OS command injection vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following v…

  38. 9.8CVE-2023-45025EPSS 1.1%

    An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the …

  39. 7.2CVE-2023-41283EPSS 1.0%

    An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed th…

  40. 7.2CVE-2023-41282EPSS 1.0%

    An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed th…

  41. 7.2CVE-2023-41281EPSS 1.0%

    An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed th…

  42. 8.8CVE-2024-22903EPSS 1.9%

    Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK function.

  43. 8.8CVE-2024-22900EPSS 1.9%

    Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function.

  44. 7.8CVE-2024-0325EPSS 0.8%

    In Helix Sync versions prior to 2024.1, a local command injection was identified. Reported by Bryan Riggins.

  45. 9.8CVE-2024-23745EPSS 2.0%

    In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, even if a NIB file is modified within an application, Gatekeeper may still permit…

  46. 9.8CVE-2024-21488EPSS 3.3%

    Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for functi…

  47. 7.2CVE-2024-0920EPSS 8.6%

    A vulnerability was found in TRENDnet TEW-822DRE 1.03B02. It has been declared as critical. This vulnerability affects unknown code of the file /admin_ping.htm of the component POST Request Handler. The manipulation of the argument ipv4_pi…

  48. 7.2CVE-2024-0919EPSS 23%

    A vulnerability was found in TRENDnet TEW-815DAP 1.0.2.0. It has been classified as critical. This affects the function do_setNTP of the component POST Request Handler. The manipulation of the argument NtpDstStart/NtpDstEnd leads to comman…

  49. 7.8CVE-2024-22545EPSS 0.5%

    An issue was discovered in TRENDnet TEW-824DRU version 1.04b01, allows unauthenticated attackers to execute arbitrary code via the system.ntp.server parameter in the sub_420AE0() function. The attack can be launched remotely.

  50. 8.8CVE-2024-23628EPSS 3.2%

    A command injection vulnerability exists in the 'SaveStaticRouteIPv6Params' parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability to achieve command execution. Authentication is required, however can be bypa…