cve.bz

CWE-77: Improper Neutralization of Special Elements used in a Command, page 58

Filter

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

What the weakness is: CWE-77 at MITRE

Ask an AI about CWE-77

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-77: Improper Neutralization of Special Elements used in a Command and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/77.html and https://cve.bz/cve/cwe/77?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2023-24146EPSS 1.9%

    TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the minute parameter in the setRebootScheCfg function.

  2. 9.8CVE-2023-24145EPSS 1.8%

    TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the plugin_version parameter in the setUnloadUserData function.

  3. 9.8CVE-2023-24144EPSS 1.9%

    TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the hour parameter in the setRebootScheCfg function.

  4. 9.8CVE-2023-24143EPSS 1.9%

    TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagTracertHop parameter in the setNetworkDiag function.

  5. 9.8CVE-2023-24142EPSS 1.9%

    TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingSize parameter in the setNetworkDiag function.

  6. 9.8CVE-2023-24141EPSS 1.9%

    TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingTimeOut parameter in the setNetworkDiag function.

  7. 9.8CVE-2023-24140EPSS 1.9%

    TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingNum parameter in the setNetworkDiag function.

  8. 9.8CVE-2023-24139EPSS 1.9%

    TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagHost parameter in the setNetworkDiag function.

  9. 9.8CVE-2023-24138EPSS 1.9%

    TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the host_time parameter in the NTPSyncWithHost function.

  10. 7.5CVE-2023-0649EPSS 3.2%

    A vulnerability has been found in dst-admin 1.5.0 and classified as critical. This vulnerability affects unknown code of the file /home/sendBroadcast. The manipulation of the argument message leads to command injection. The attack can be i…

  11. 7.5CVE-2023-0648EPSS 3.1%

    A vulnerability, which was classified as critical, was found in dst-admin 1.5.0. This affects an unknown part of the file /home/masterConsole. The manipulation of the argument command leads to command injection. It is possible to initiate …

  12. 7.5CVE-2023-0647EPSS 3.1%

    A vulnerability, which was classified as critical, has been found in dst-admin 1.5.0. Affected by this issue is some unknown functionality of the file /home/kickPlayer. The manipulation of the argument userId leads to command injection. Th…

  13. 7.5CVE-2023-0646EPSS 3.2%

    A vulnerability classified as critical was found in dst-admin 1.5.0. Affected by this vulnerability is an unknown functionality of the file /home/cavesConsole. The manipulation of the argument command leads to command injection. The attack…

  14. 9.8CVE-2023-0640EPSS 6.5%

    A vulnerability was found in TRENDnet TEW-652BRP 3.04b01. It has been classified as critical. Affected is an unknown function of the file ping.ccp of the component Web Interface. The manipulation leads to command injection. It is possible …

  15. 9.8CVE-2023-0638EPSS 2.9%

    A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical. This vulnerability affects unknown code of the component Web Interface. The manipulation leads to command injection. The attack can be initiated rem…

  16. 7.8CVE-2023-22657EPSS 0.4%

    On F5OS-A beginning in version 1.2.0 to before 1.3.0 and F5OS-C beginning in version 1.3.0 to before 1.5.0, processing F5OS tenant file names may allow for command injection. Note: Software versions which have reached End of Technical Sup…

  17. 8.8CVE-2023-0611EPSS 3.9%

    A vulnerability, which was classified as critical, has been found in TRENDnet TEW-652BRP 3.04B01. This issue affects some unknown processing of the file get_set.ccp of the component Web Management Interface. The manipulation leads to comma…

  18. 6.7CVE-2022-45095EPSS 0.6%

    Dell PowerScale OneFS, 8.2.x-9.4.x, contain a command injection vulnerability. An authenticated user having access local shell and having the privilege to gather logs from the cluster could potentially exploit this vulnerability, leading t…

  19. 7.8CVE-2022-25916EPSS 1.1%

    Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function.

  20. 9.8CVE-2022-21129EPSS 2.8%

    Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function. **Note:** In order to exploit this vulnerability appium-running 0.1.3 has to…

  21. 9.8CVE-2023-24612EPSS 1.3%

    The PdfBook extension through 2.0.5 before b07b6a64 for MediaWiki allows command injection via an option.

  22. 7.2CVE-2021-41231EPSS 1.2%

    OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via DataFlow and to create products was able to execute arbitrary code via the convert profile. Versions 1…

  23. 8.8CVE-2021-41144EPSS 1.2%

    OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, a layout block was able to bypass the block blacklist to execute remote code. Versions 19.4.22 and 20.0.19 contain a patch for this issue.

  24. 7.2CVE-2021-41143EPSS 1.3%

    OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the server. Versions 19.4.22 and 20.0.19 contain a patch for this issue.

  25. 7.2CVE-2021-39217EPSS 1.3%

    OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Custom Layout enabled admin users to execute arbitrary commands via block methods. Versions 19.4.22 and 20.0.19 contain patches for this issue.

  26. 9.8CVE-2022-25962EPSS 1.0%

    All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization.

  27. 9.8CVE-2022-25908EPSS 1.5%

    All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization.

  28. 7.8CVE-2022-25350EPSS 1.2%

    All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization.

  29. 7.8CVE-2022-21810EPSS 1.2%

    All versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization.

  30. 9.8CVE-2023-22884EPSS 12%

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: bef…

  31. 7.5CVE-2020-22662EPSS 1.3%

    In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) befo…

  32. 7.2CVE-2023-20045EPSS 1.0%

    A vulnerability in the web-based management interface of Cisco Small Business RV160 and RV260 Series VPN Routers could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected …

  33. 7.2CVE-2023-20026EPSS 1.3%

    A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320 and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary commands on an affected device. This v…

  34. 8.8CVE-2023-0315ExploitEPSS 98%

    Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8.

  35. 9.8CVE-2023-22496EPSS 36%

    Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the ability to establish a streaming connection can execute arbitrary commands on the targeted Netdata agent. When an alert is t…

  36. 8.8CVE-2022-41955EPSS 1.6%

    Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A remote code execution v…

  37. 9.8CVE-2022-21191EPSS 1.5%

    Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function.

  38. 9.1CVE-2022-4616EPSS 4.8%

    The webserver in Delta DX-3021 versions prior to 1.24 is vulnerable to command injection through the network diagnosis page. This vulnerability could allow a remote unauthenticated user to add files, delete files, and change file permis…

  39. 8.0CVE-2020-36650EPSS 2.2%

    A vulnerability, which was classified as critical, was found in IonicaBizau node-gry up to 5.x. This affects an unknown part. The manipulation leads to command injection. Upgrading to version 6.0.0 is able to address this issue. The patch …

  40. 8.8CVE-2022-45094EPSS 1.4%

    A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (443/tcp) of the affected product, could potentially inject commands into the dhc…

  41. 9.8CVE-2022-39073EPSS 3.4%

    There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the vulnerability to execute arbitrary commands.

  42. 9.8CVE-2020-36642EPSS 2.2%

    A vulnerability was found in trampgeek jobe up to 1.6.x and classified as critical. This issue affects the function run_in_sandbox of the file application/libraries/LanguageTask.php. The manipulation leads to command injection. Upgrading t…

  43. 9.8CVE-2023-22671EPSS 3.0%

    Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injection when calling analyzeHeadless with untrusted input.

  44. 9.8CVE-2022-25923EPSS 2.6%

    Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess() functionality due to improper user-input sanitization.

  45. 9.8CVE-2021-4304EPSS 2.2%

    A vulnerability was found in eprintsug ulcc-core. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file cgi/toolbox/toolbox. The manipulation of the argument password leads to command inje…

  46. 6.7CVE-2022-39088EPSS 0.2%

    In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed.

  47. 6.7CVE-2022-39087EPSS 0.2%

    In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed.

  48. 6.7CVE-2022-39086EPSS 0.2%

    In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed.

  49. 6.7CVE-2022-39085EPSS 0.2%

    In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed.

  50. 6.7CVE-2022-39084EPSS 0.2%

    In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed.