cve.bz

CWE-88: Improper Neutralization of Argument Delimiters in a Command (Argument Injection), page 9

Filter

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

What the weakness is: CWE-88 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 5
  • CAPEC-41 Using Meta-characters in E-mail Headers to Inject Malicious Payloads Likelihood: High · Severity: High
  • CAPEC-88 OS Command Injection Likelihood: High · Severity: High
  • CAPEC-137 Parameter Injection Likelihood: Medium · Severity: Medium
  • CAPEC-174 Flash Parameter Injection Likelihood: High · Severity: Medium
  • CAPEC-460 HTTP Parameter Pollution (HPP) Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-88, as MITRE names them. Credits.

Ask an AI about CWE-88

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-88: Improper Neutralization of Argument Delimiters in a Command and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/88.html and https://cve.bz/cve/cwe/88?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2021-29472EPSS 4.8%

    Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow code to be executed in the HgDriver if …

  2. 8.8CVE-2021-29461EPSS 2.5%

    Discord Recon Server is a bot that allows one to do one's reconnaissance process from one's Discord. A vulnerability in Discord Recon Server prior to 0.0.3 could be exploited to read internal files from the system and write files into the …

  3. 7.8CVE-2020-7851EPSS 0.7%

    Innorix Web-Based File Transfer Solution versuibs prior to and including 9.2.18.385 contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to the internal method. A remote attacker cou…

  4. 7.8CVE-2021-1485EPSS 0.3%

    A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges on the underlying Linux operating system (OS) of an affected device. This …

  5. 7.8CVE-2020-7850EPSS 0.8%

    NBBDownloader.ocx ActiveX Control in Groupware contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted w…

  6. 9.8CVE-2021-21386EPSS 2.3%

    APKLeaks is an open-source project for scanning APK file for URIs, endpoints & secrets. APKLeaks prior to v2.0.3 allows remote attackers to execute arbitrary OS commands via package name inside application manifest. An attacker could inclu…

  7. 6.7CVE-2021-1454EPSS 0.3%

    Multiple vulnerabilities in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system with root privileges. These vulnerabilities are due to insufficient input validation…

  8. 6.7CVE-2021-1383EPSS 0.6%

    Multiple vulnerabilities in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system with root privileges. These vulnerabilities are due to insufficient input validation…

  9. 7.8CVE-2021-21384EPSS 0.6%

    shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into …

  10. 9.8CVE-2021-24030EPSS 1.8%

    The fbgames protocol handler registered as part of Facebook Gameroom does not properly quote arguments passed to the executable. That allows a malicious URL to cause code execution. This issue affects versions prior to v1.26.0.

  11. 9.8CVE-2020-21224ExploitEPSS 39%

    A Remote Code Execution vulnerability has been found in Inspur ClusterEngine V4.0. A remote attacker can send a malicious login packet to the control server

  12. 9.8CVE-2021-26937EPSS 9.3%

    encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character sequence.

  13. 9.8CVE-2021-3401EPSS 11%

    Bitcoin Core before 0.19.0 might allow remote attackers to execute arbitrary code when another application unsafely passes the -platformpluginpath argument to the bitcoin-qt program, as demonstrated by an x-scheme-handler/bitcoin handler f…

  14. 7.2CVE-2020-35136EPSS 6.6%

    Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilename_template parameter to …

  15. 9.8CVE-2020-7769EPSS 2.3%

    This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.

  16. 8.8CVE-2020-25268EPSS 2.4%

    Remote Code Execution can occur via the external news feed in ILIAS 6.4 because of incorrect parameter sanitization for Magpie RSS data.

  17. 6.7CVE-2020-27129EPSS 0.3%

    A vulnerability in the remote management feature of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to inject arbitrary commands and potentially gain elevated privileges. The vulnerability is due to improper vali…

  18. 9.8CVE-2020-5648EPSS 3.5%

    Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QM…

  19. 6.5CVE-2020-5657EPSS 1.1%

    Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial num…

  20. 7.0CVE-2020-15238ExploitEPSS 4.6%

    Blueman is a GTK+ Bluetooth Manager. In Blueman before 2.1.4, the DhcpClient method of the D-Bus interface to blueman-mechanism is prone to an argument injection vulnerability. The impact highly depends on the system configuration. If Polk…

  21. 7.2CVE-2020-5792ExploitEPSS 59%

    Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user.

  22. 5.3CVE-2020-14027EPSS 0.8%

    An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings accept custom unsafe arguments, such as ENABLE_LOCAL_INFILE, that can be leveraged by attackers to enable MySQL Load Data Local (rogue MySQL se…

  23. 5.5CVE-2020-4492EPSS 0.3%

    IBM Spectrum Scale V5.0.0.0 through V5.0.4.3 and V4.2.0.0 through V4.2.3.21 could allow a local attacker to cause a denial of service crashing the kernel by sending a subset of ioctls on the device with invalid arguments. IBM X-Force ID: 1…

  24. 9.8CVE-2020-15692EPSS 4.2%

    In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying…

  25. 7.8CVE-2020-17367EPSS 1.5%

    Firejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option, which may lead to command injection.

  26. 8.8CVE-2020-13699ExploitEPSS 26%

    TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. A malicious website could launch TeamViewer with arbitrary parameters, as demonstrated by a teamviewer10: --play URL. An attacker could force a v…

  27. 7.8CVE-2020-3380EPSS 0.6%

    A vulnerability in the CLI of Cisco Data Center Network Manager (DCNM) could allow an authenticated, local attacker to elevate privileges to root and execute arbitrary commands on the underlying operating system. The vulnerability is due t…

  28. 9.8CVE-2020-5599EPSS 3.5%

    TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains an improper neutralization of argument delimiters in a command…

  29. 7.5CVE-2020-14049EPSS 2.2%

    Viber for Windows up to 13.2.0.39 does not properly quote its custom URI handler. A malicious website could launch Viber with arbitrary parameters, forcing a victim to send an NTLM authentication request, and either relay the request or ca…

  30. 7.2CVE-2020-14421EPSS 6.0%

    aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via the Script Content box on the Add Cron Job screen.

  31. 7.8CVE-2020-7496EPSS 0.9%

    A CWE-88: Argument Injection or Modification vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD)which could cause unauthorized write access when opening the project file.

  32. 9.8CVE-2020-7808EPSS 0.7%

    In RAONWIZ K Upload v2018.0.2.51 and prior, automatic update processing without integrity check on update module(web.js) allows an attacker to modify arguments which causes downloading a random DLL and injection on it.

  33. 3.9CVE-2020-1738EPSS 0.4%

    A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible…

  34. 8.8CVE-2020-5546EPSS 0.9%

    Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows an atta…

  35. 8.8CVE-2020-6799EPSS 1.5%

    Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types. This required Firefox to be configured as the default handler for a given file type and for a file downloaded …

  36. 7.5CVE-2019-18888EPSS 2.2%

    An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arb…

  37. 7.8CVE-2019-5013EPSS 0.6%

    An exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3, update helper service in the start/stopLaunchDProcess command. The command takes a user-supplied string argument and executes launchctl under r…

  38. 7.8CVE-2019-5012EPSS 0.5%

    An exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3, update helper service in the startProcess command. The command takes a user-supplied script argument and executes it under root context. A user…

  39. 9.8CVE-2019-12148EPSS 3.5%

    The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to an authentication bypass via an argument injection vulnerability involving special characters in the username field. Upon successful exploitation, a r…

  40. 9.8CVE-2019-12147EPSS 2.6%

    The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to Argument Injection via special characters in the username field. Upon successful exploitation, a remote unauthenticated user can create a local system…

  41. 8.8CVE-2019-11751EPSS 1.1%

    Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as when a user clicks on malicious links in a chat application. This can be used to write a log file to an arbitrary locat…

  42. 7.5CVE-2019-15541EPSS 2.2%

    rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service (loop of conn_event and ready) by arranging for a client to never be writable.

  43. 9.8CVE-2019-10746EPSS 3.7%

    mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

  44. 8.8CVE-2019-15498EPSS 3.4%

    cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh.

  45. 7.1CVE-2019-12264EPSS 8.3%

    Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Control in IPv4 assignment by the ipdhcpc DHCP client component.

  46. 7.8CVE-2019-12578EPSS 0.8%

    A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The openvpn_launcher.64 binary is setuid root. Th…

  47. 8.8CVE-2019-13475EPSS 4.1%

    In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commands when the user visits a specially crafted URL. Based on the available command-line arguments of…

  48. 6.5CVE-2017-15694EPSS 2.2%

    When an Apache Geode server versions 1.0.0 to 1.8.0 is operating in secure mode, a user with write permissions for specific data regions can modify internal cluster metadata. A malicious user could modify this data in a way that affects th…

  49. 7.5CVE-2019-8321EPSS 3.3%

    An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.

  50. 8.8CVE-2019-11582EPSS 4.9%

    An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers, in all versions prior to 3.1.3, allows remote attackers to gain remote code execution through the use of a crafted URI.