cve.bz

CWE-77: Improper Neutralization of Special Elements used in a Command, page 57

Filter

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

What the weakness is: CWE-77 at MITRE

Ask an AI about CWE-77

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-77: Improper Neutralization of Special Elements used in a Command and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/77.html and https://cve.bz/cve/cwe/77?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2023-22750EPSS 1.7%

    There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Succ…

  2. 9.8CVE-2023-22749EPSS 1.7%

    There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Succ…

  3. 9.8CVE-2023-22748EPSS 1.7%

    There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Succ…

  4. 9.8CVE-2023-22747EPSS 1.7%

    There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Succ…

  5. 6.7CVE-2023-20075EPSS 0.9%

    Vulnerability in the CLI of Cisco Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary commands. These vulnerability is due to improper input validation in the CLI. An attacker could exploit this vulne…

  6. 8.8CVE-2021-3855EPSS 1.8%

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Liman Central Management System Liman MYS (HTTP/Controllers, CronMail, Jobs modules) allows Command Injection. This issue affects Liman C…

  7. 9.8CVE-2022-48259EPSS 0.9%

    There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation could allow attackers to gain higher privileges.

  8. 9.8CVE-2022-48255EPSS 1.1%

    There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. A Huawei printer has a system command injection vulnerability. Successful exploitation could lead to remote code execution.

  9. 9.8CVE-2023-23080EPSS 2.5%

    Certain Tenda products are vulnerable to command injection. This affects Tenda CP7 Tenda CP7<=V11.10.00.2211041403 and Tenda CP3 v.10 Tenda CP3 v.10<=V20220906024_2025 and Tenda IT7-PCS Tenda IT7-PCS<=V2209020914 and Tenda IT7-LCS Tenda IT…

  10. 9.8CVE-2023-26602ExploitEPSS 17%

    ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create extensions, as demonstrated by snmpset for NET-SNMP-EXTEND-MIB with /bin/sh for command execution.

  11. 8.8CVE-2023-23295EPSS 3.8%

    Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an modify the sysCmd parameter in order to execute commands as root.

  12. 8.8CVE-2023-23294EPSS 2.7%

    Korenix JetWave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection. An attacker can modify the file_name parameter to execute commands as root.

  13. 8.8CVE-2023-23917EPSS 1.0%

    A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create their own server in your cloud and become an admin so this vulnerability could affec…

  14. 8.8CVE-2022-45600EPSS 2.3%

    Aztech WMB250AC Mesh Routers Firmware Version 016 2020 devices improperly manage sessions, which allows remote attackers to bypass authentication in opportunistic circumstances and execute arbitrary commands with administrator privileges b…

  15. 9.8CVE-2023-24184EPSS 1.3%

    TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability.

  16. 7.3CVE-2022-48338EPSS 1.6%

    An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Insi…

  17. 9.8CVE-2023-25805EPSS 1.6%

    versionn, software for changing version information across multiple files, has a command injection vulnerability in all versions prior to version 1.1.0. This issue is patched in version 1.1.0.

  18. 9.8CVE-2022-40021EPSS 1.4%

    QVidium Technologies Amino A140 (prior to firmware version 1.0.0-283) was discovered to contain a command injection vulnerability.

  19. 8.8CVE-2022-45701ExploitEPSS 43%

    Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature.

  20. 9.8CVE-2023-24238EPSS 1.9%

    TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the city parameter at setting/delStaticDhcpRules.

  21. 9.8CVE-2023-24236EPSS 1.9%

    TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the province parameter at setting/delStaticDhcpRules.

  22. 8.8CVE-2023-0861EPSS 29%

    NetModule NSRW web administration interface executes an OS command constructed with unsanitized user input. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges. This issue affects N…

  23. 9.8CVE-2023-0849EPSS 2.8%

    A vulnerability has been found in Netgear WNDR3700v2 1.0.1.14 and classified as critical. This vulnerability affects unknown code of the component Web Interface. The manipulation leads to command injection. The attack can be initiated remo…

  24. 8.0CVE-2023-21778EPSS 1.0%

    Microsoft Dynamics Unified Service Desk Remote Code Execution Vulnerability

  25. 7.8CVE-2023-21805EPSS 0.7%

    Windows MSHTML Platform Remote Code Execution Vulnerability

  26. 8.8CVE-2023-22935EPSS 0.6%

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘display.page.search.patterns.sensitivity’ search parameter lets a search bypass SPL safeguards for risky commands. The vulnerability requires a higher privileged user to i…

  27. 5.3CVE-2023-0830ExploitEPSS 21%

    A vulnerability classified as critical has been found in EasyNAS 1.1.0. Affected is the function system of the file /backup.pl. The manipulation leads to os command injection. It is possible to launch the attack remotely. The exploit has b…

  28. 9.8CVE-2023-24161EPSS 1.9%

    TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the webWlanIdx parameter in the setWebWlanIdx function.

  29. 9.8CVE-2023-24160EPSS 1.9%

    TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function.

  30. 9.8CVE-2023-24159EPSS 1.9%

    TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admpass parameter in the setPasswordCfg function.

  31. 9.8CVE-2022-40022ExploitEPSS 92%

    Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.

  32. 9.8CVE-2023-0789EPSS 1.7%

    Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.

  33. 7.8CVE-2023-0127EPSS 2.0%

    A command injection vulnerability in the firmware_update command, in the device's restricted telnet interface, allows an authenticated attacker to execute arbitrary commands as root.

  34. 10.0CVE-2023-0776EPSS 1.2%

    Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login executi…

  35. 8.8CVE-2022-45104EPSS 1.4%

    Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain a command execution vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to execute ar…

  36. 9.8CVE-2022-43550EPSS 1.8%

    A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows which could allow an attacker to insert an arbitrary URL which opens up the opportunity to remote e…

  37. 9.8CVE-2023-23333ExploitEPSS 99.2%

    There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php.

  38. 9.8CVE-2021-31575EPSS 1.7%

    In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not n…

  39. 9.8CVE-2021-31574EPSS 1.7%

    In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not n…

  40. 9.8CVE-2021-31573EPSS 1.7%

    In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not n…

  41. 9.8CVE-2023-24276EPSS 1.9%

    TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the country parameter at setting/delStaticDhcpRules.

  42. 7.8CVE-2022-25855EPSS 1.0%

    All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization.

  43. 9.8CVE-2023-24157EPSS 2.1%

    A command injection vulnerability in the serverIp parameter in the function updateWifiInfo of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.

  44. 9.8CVE-2023-24156EPSS 2.1%

    A command injection vulnerability in the ip parameter in the function recvSlaveUpgstatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.

  45. 9.8CVE-2023-24154EPSS 1.9%

    TOTOLINK T8 V4.1.5cu was discovered to contain a command injection vulnerability via the slaveIpList parameter in the function setUpgradeFW.

  46. 9.8CVE-2023-24153EPSS 2.1%

    A command injection vulnerability in the version parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.

  47. 9.8CVE-2023-24152EPSS 2.1%

    A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.

  48. 9.8CVE-2023-24151EPSS 2.1%

    A command injection vulnerability in the ip parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.

  49. 9.8CVE-2023-24150EPSS 2.1%

    A command injection vulnerability in the serverIp parameter in the function meshSlaveDlfw of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.

  50. 9.8CVE-2023-24148EPSS 1.8%

    TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadUserData function.