cve.bz

CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection), page 134

Filter

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.

What the weakness is: CWE-78 at MITRE

Ask an AI about CWE-78

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-78: Improper Neutralization of Special Elements used in an OS Command and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/78.html and https://cve.bz/cve/cwe/78?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2014-0593EPSS 1.9%

    The set_version script as shipped with obs-service-set_version is a source validator for the Open Build Service (OBS). In versions prior to 0.5.3-1.1 this script did not properly sanitize the input provided by the user, allowing for code e…

  2. 9.8CVE-2018-11229EPSS 5.6%

    Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via command injection in Crestron Toolbox Protocol (CTP).

  3. 8.8CVE-2018-0274EPSS 3.8%

    A vulnerability in the CLI parser of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insufficient…

  4. 9.8CVE-2017-7637EPSS 3.0%

    QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to run arbitrary OS commands against the system with root privileges.

  5. 7.8CVE-2018-6662EPSS 0.2%

    Privilege Escalation vulnerability in McAfee Management of Native Encryption (MNE) before 4.1.4 allows local users to gain elevated privileges via a crafted user input.

  6. 9.8CVE-2017-16042EPSS 4.6%

    Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.

  7. 8.8CVE-2018-11189EPSS 3.3%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 1 of 6).

  8. 8.8CVE-2018-11188EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 46 of 46).

  9. 8.8CVE-2018-11187EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 45 of 46).

  10. 8.8CVE-2018-11186EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 44 of 46).

  11. 8.8CVE-2018-11185EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 43 of 46).

  12. 7.2CVE-2018-11184EPSS 4.3%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 42 of 46).

  13. 8.8CVE-2018-11183EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 41 of 46).

  14. 8.8CVE-2018-11182EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 40 of 46).

  15. 8.8CVE-2018-11181EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 39 of 46).

  16. 8.8CVE-2018-11180EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 38 of 46).

  17. 8.8CVE-2018-11179EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 37 of 46).

  18. 8.8CVE-2018-11178EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 36 of 46).

  19. 8.8CVE-2018-11177EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 35 of 46).

  20. 8.8CVE-2018-11176EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 34 of 46).

  21. 8.8CVE-2018-11175EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 33 of 46).

  22. 8.8CVE-2018-11174EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 32 of 46).

  23. 8.8CVE-2018-11173EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 31 of 46).

  24. 8.8CVE-2018-11172EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 30 of 46).

  25. 8.8CVE-2018-11171EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 29 of 46).

  26. 8.8CVE-2018-11170EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 28 of 46).

  27. 8.8CVE-2018-11169EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 27 of 46).

  28. 8.8CVE-2018-11168EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 26 of 46).

  29. 8.8CVE-2018-11167EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 25 of 46).

  30. 8.8CVE-2018-11166EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 24 of 46).

  31. 8.8CVE-2018-11165EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 23 of 46).

  32. 8.8CVE-2018-11164EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 22 of 46).

  33. 7.2CVE-2018-11163EPSS 4.3%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 21 of 46).

  34. 8.8CVE-2018-11162EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 20 of 46).

  35. 8.8CVE-2018-11161EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 19 of 46).

  36. 8.8CVE-2018-11160EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 18 of 46).

  37. 8.8CVE-2018-11159EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 17 of 46).

  38. 8.8CVE-2018-11158EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 16 of 46).

  39. 8.8CVE-2018-11157EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 15 of 46).

  40. 8.8CVE-2018-11156EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 14 of 46).

  41. 8.8CVE-2018-11155EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 13 of 46).

  42. 8.8CVE-2018-11154EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 12 of 46).

  43. 8.8CVE-2018-11153EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 11 of 46).

  44. 8.8CVE-2018-11152EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 10 of 46).

  45. 7.2CVE-2018-11151EPSS 4.3%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 9 of 46).

  46. 8.8CVE-2018-11150EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 8 of 46).

  47. 8.8CVE-2018-11149EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 7 of 46).

  48. 8.8CVE-2018-11148EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 6 of 46).

  49. 8.8CVE-2018-11147EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 5 of 46).

  50. 8.8CVE-2018-11146EPSS 4.4%

    Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 4 of 46).