cve.bz

CWE-77: Improper Neutralization of Special Elements used in a Command, page 51

Filter

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

What the weakness is: CWE-77 at MITRE

Ask an AI about CWE-77

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-77: Improper Neutralization of Special Elements used in a Command and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/77.html and https://cve.bz/cve/cwe/77?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2023-3710ExploitEPSS 49%

    Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the re…

  2. 7.0CVE-2023-36805EPSS 1.8%

    Windows MSHTML Platform Security Feature Bypass Vulnerability

  3. 8.8CVE-2023-33136EPSS 1.7%

    Azure DevOps Server Remote Code Execution Vulnerability

  4. 9.8CVE-2023-39637EPSS 2.1%

    D-Link DIR-816 A2 1.10 B05 was discovered to contain a command injection vulnerability via the component /goform/Diagnosis.

  5. 8.8CVE-2023-38829EPSS 2.4%

    An issue in NETIS SYSTEMS WF2409E v.3.6.42541 allows a remote attacker to execute arbitrary code via the ping and traceroute functions of the diagnostic tools component in the admin management interface.

  6. 7.2CVE-2023-39362ExploitEPSS 85%

    Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command inje…

  7. 9.8CVE-2023-4310EPSS 1.8%

    BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions 23.2.1 and 23.2.2 contain a command injection vulnerability which can be exploited through a malicious HTTP request. Successful exploitation of this vulnerability …

  8. 8.8CVE-2023-40598EPSS 0.9%

    In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation…

  9. 9.8CVE-2023-38027EPSS 1.6%

    SpotCam Co., Ltd. SpotCam Sense’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to perform arbitrary system command…

  10. 7.8CVE-2023-40796EPSS 0.9%

    Phicomm k2 v22.6.529.216 was discovered to contain a command injection vulnerability via the function luci.sys.call.

  11. 8.8CVE-2023-25649EPSS 1.9%

    There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.

  12. 8.8CVE-2023-37469EPSS 1.6%

    CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a…

  13. 9.8CVE-2023-39834EPSS 2.1%

    PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via create_function.

  14. 6.8CVE-2023-4212EPSS 1.3%

    ​A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the…

  15. 8.8CVE-2023-23564EPSS 2.5%

    An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to execute commands.

  16. 7.5CVE-2020-22570EPSS 1.3%

    Memcached 1.6.0 before 1.6.3 allows remote attackers to cause a denial of service (daemon crash) via a crafted meta command.

  17. 9.8CVE-2023-39618EPSS 1.7%

    TOTOLINK X5000R B20210419 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg interface.

  18. 9.8CVE-2023-39617EPSS 1.7%

    TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were discovered to contain a remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.

  19. 9.8CVE-2023-39809EPSS 1.5%

    N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain an OS command injection vulnerability via shell metacharacters in the system_hostname parameter at /manage/network-basic.php.

  20. 9.8CVE-2023-4414EPSS 9.1%

    A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230807. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /log/decodmail.php. The manipulation of the argumen…

  21. 8.8CVE-2023-38902EPSS 2.6%

    A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers v.EG_3.0(1)B11P219, EAP and RAP series wireless …

  22. 8.8CVE-2023-2910EPSS 1.6%

    Improper neutralization of special elements used in a command ('Command Injection') vulnerability in Printer service functionality in ASUSTOR Data Master (ADM) allows remote unauthorized users to execute arbitrary commands via unspecified …

  23. 9.8CVE-2023-34215EPSS 0.7%

    TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation and improper authentication in the certification-generation function, which …

  24. 9.8CVE-2023-34214EPSS 0.4%

    TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation in the certificate-gen…

  25. 9.8CVE-2023-34213EPSS 0.8%

    TN-5900 Series firmware versions v3.3 and prior are vulnerable to command-injection vulnerability. This vulnerability stems from insufficient input validation and improper authentication in the key-generation function, which could potentia…

  26. 9.8CVE-2023-33239EPSS 1.3%

    TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from insufficient input validation in the key-generation …

  27. 9.8CVE-2023-33238EPSS 0.8%

    TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from inadequate input validation in the certificate manag…

  28. 4.3CVE-2023-20237EPSS 0.3%

    A vulnerability in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access internal HTTP services that are otherwise inaccessible. This vulnerability is due to insufficient restrictions on internal…

  29. 9.1CVE-2023-20017EPSS 1.0%

    Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary commands using root-level privileges. The attacker would need to have Administrator privileges on the…

  30. 9.1CVE-2023-20013EPSS 1.0%

    Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary commands using root-level privileges. The attacker would need to have Administrator privileges on the…

  31. 7.2CVE-2023-20209EPSS 40%

    A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read-write privileges on the application to perform…

  32. 9.8CVE-2023-38866EPSS 2.4%

    COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_415588. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter interface and display_name.

  33. 9.8CVE-2023-38864EPSS 1.2%

    An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the protal_delete_picname parameter in the sub_41171C function at bin/webmgnt.

  34. 9.8CVE-2023-38865EPSS 2.4%

    COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_4143F0. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter timestr.

  35. 9.8CVE-2023-38863EPSS 1.2%

    An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the ifname and mac parameters in the sub_410074 function at bin/webmgnt.

  36. 9.8CVE-2023-38862EPSS 1.2%

    An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the destination parameter of sub_431F64 function in bin/webmgnt.

  37. 9.8CVE-2023-38861EPSS 1.6%

    An issue in Wavlink WL_WNJ575A3 v.R75A3_V1410_220513 allows a remote attacker to execute arbitrary code via username parameter of the set_sys_adm function in adm.cgi.

  38. 9.8CVE-2023-39293EPSS 1.7%

    A Command Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a malicious actor to execute arbitrary commands within the context of the system.

  39. 6.8CVE-2023-40293EPSS 1.8%

    Harman Infotainment 20190525031613 and later allows command injection via unauthenticated RPC with a D-Bus connection object.

  40. 9.8CVE-2023-38034EPSS 1.4%

    A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, could allow a Remote Code Execution (RCE). Affected Products: All UniFi Access Points (Version 6.5.53…

  41. 9.8CVE-2023-39008EPSS 3.1%

    A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands.

  42. 9.8CVE-2023-39001EPSS 3.6%

    A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a crafted backup configuration file.

  43. 7.2CVE-2023-32782EPSS 56%

    A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed …

  44. 7.2CVE-2023-32781ExploitEPSS 14%

    A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get exec…

  45. 9.8CVE-2023-26310EPSS 1.1%

    There is a command injection problem in the old version of the mobile phone backup app.

  46. 7.8CVE-2023-35390EPSS 2.1%

    .NET and Visual Studio Remote Code Execution Vulnerability

  47. 8.8CVE-2023-39523EPSS 2.9%

    ScanCode.io is a server to script and automate software composition analysis with ScanPipe pipelines. Prior to version 32.5.1, the software has a possible command injection vulnerability in the docker fetch process as it allows to append m…

  48. 9.8CVE-2023-38928EPSS 1.5%

    Netgear R7100LG 1.0.0.78 was discovered to contain a command injection vulnerability via the password parameter at usb_remote_invite.cgi.

  49. 8.8CVE-2023-38921EPSS 1.6%

    Netgear WG302v2 v5.2.9 and WAG302v2 v5.1.19 were discovered to contain multiple command injection vulnerabilities in the upgrade_handler function via the firmwareRestore and firmwareServerip parameters.

  50. 9.8CVE-2023-38690EPSS 0.9%

    matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, wh…