CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-77

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-1010306 77 Exec Code 2019-07-15 2019-07-30
7.5
 None Remote Low Not required Partial Partial Partial
Slanger 0.6.0 is affected by: Remote Code Execution (RCE). The impact is: A remote attacker can execute arbitrary commands by sending a crafted request to the server. The component is: Message handler & request validator. The attack vector is: Remote unauthenticated. The fixed version is: after commit 5267b455caeb2e055cccf0d2b6a22727c111f5c3.
2 CVE-2019-1010179 77 Exec Code 2019-07-24 2019-08-01
7.5
 None Remote Low Not required Partial Partial Partial
PHKP including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b is affected by: Improper Neutralization of Special Elements used in a Command ('Command Injection'). The impact is: It is possible to manipulate gpg-keys or execute commands remotely. The component is: function pgp_exec() phkp.php:98. The attack vector is: HKP-Api: /pks/lookup?search.
3 CVE-2019-1010174 77 2019-07-25 2019-09-28
7.5
 None Remote Low Not required Partial Partial Partial
CImg The CImg Library v.2.3.3 and earlier is affected by: command injection. The impact is: RCE. The component is: load_network() function. The attack vector is: Loading an image from a user-controllable url can lead to command injection, because no string sanitization is done on the url. The fixed version is: v.2.3.4.
4 CVE-2019-1000018 77 Exec Code 2019-02-04 2019-04-11
4.6
 None Local Low Not required Partial Partial Partial
rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.
5 CVE-2019-15954 77 Exec Code +Priv 2019-09-05 2019-09-06
9.0
 None Remote Low Single system Complete Complete Complete
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution (RCE) on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of evaluating the tag by the back-end, it is possible to escape the sandbox object by using the following payload: <script total>global.process.mainModule.require(child_process).exec(RCE);</script>
6 CVE-2019-15949 77 Exec Code 2019-09-05 2019-09-06
9.0
 None Remote Low Single system Complete Complete Complete
Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a passwordless sudo entry; the script executes check_plugin, which is owned by the nagios user. A user logged into Nagios XI with permissions to modify plugins, or the nagios user on the server, can modify the check_plugin executable and insert malicious commands to execute as root.
7 CVE-2019-15530 77 2019-08-23 2019-08-27
9.0
 None Remote Low Single system Complete Complete Complete
An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the LoginPassword field to Login.
8 CVE-2019-15529 77 2019-08-23 2019-08-27
9.0
 None Remote Low Single system Complete Complete Complete
An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Username field to Login.
9 CVE-2019-15528 77 2019-08-23 2019-08-27
9.0
 None Remote Low Single system Complete Complete Complete
An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Interface field to SetStaticRouteSettings.
10 CVE-2019-15527 77 2019-08-23 2019-08-27
9.0
 None Remote Low Single system Complete Complete Complete
An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the MaxIdTime field to SetWanSettings.
11 CVE-2019-15526 77 2019-08-23 2019-08-27
9.0
 None Remote Low Single system Complete Complete Complete
An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Type field to SetWanSettings, a related issue to CVE-2019-13482.
12 CVE-2019-15107 77 2019-08-15 2019-09-16
10.0
 None Remote Low Not required Complete Complete Complete
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
13 CVE-2019-15029 77 Exec Code 2019-09-05 2019-09-06
9.0
 None Remote Low Single system Complete Complete Complete
FusionPBX 4.4.8 allows an attacker to execute arbitrary system commands by submitting a malicious command to the service_edit.php file (which will insert the malicious command into the database). To trigger the command, one needs to call the services.php file via a GET request with the service id followed by the parameter a=start to execute the stored command.
14 CVE-2019-15027 77 Exec Code 2019-08-14 2019-08-27
10.0
 None Remote Low Not required Complete Complete Complete
The MediaTek Embedded Multimedia Card (eMMC) subsystem for Android on MT65xx, MT66xx, and MT8163 SoC devices allows attackers to execute arbitrary commands as root via shell metacharacters in a filename under /data, because clear_emmc_nomedia_entry in platform/mt6577/external/meta/emmc/meta_clr_emmc.c invokes 'system("/system/bin/rm -r /data/' followed by this filename upon an eMMC clearance from a Meta Mode boot. NOTE: compromise of Fire OS on the Amazon Echo Dot would require a second hypothetical vulnerability that allows creation of the required file under /data.
15 CVE-2019-14986 77 2019-08-13 2019-08-21
9.3
 None Remote Medium Not required Complete Complete Complete
eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web interface, because features such as File-Browser and Shell Command (as well as "Set root password") are exposed.
16 CVE-2019-14984 77 Exec Code 2019-08-13 2019-08-21
6.8
 None Remote Medium Not required Partial Partial Partial
eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because the undocumented addons/xmlapi/exec.cgi script uses CMD_EXEC to execute TCL code from a POST request.
17 CVE-2019-14923 77 Exec Code 2019-08-16 2019-08-27
6.5
 None Remote Low Single system Partial Partial Partial
EyesOfNetwork 5.1 allows Remote Command Execution via shell metacharacters in the module/tool_all/ host field.
18 CVE-2019-14745 77 Exec Code 2019-08-07 2019-10-07
6.8
 None Remote Medium Not required Partial Partial Partial
In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to improper handling of symbol names embedded in executables.
19 CVE-2019-14744 77 Exec Code 2019-08-07 2019-08-15
5.1
 None Remote High Not required Partial Partial Partial
In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.
20 CVE-2019-14260 77 2019-08-01 2019-08-08
7.7
 None Local Network Low Single system Complete Complete Complete
On the Alcatel-Lucent Enterprise (ALE) 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injection (missing input validation) issue in the password change field for the Change Password interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request.
21 CVE-2019-14259 77 2019-08-01 2019-08-08
7.7
 None Local Network Low Single system Complete Complete Complete
On the Polycom Obihai Obi1022 VoIP phone with firmware 5.1.11, a command injection (missing input validation) issue in the NTP server IP address field for the "Time Service Settings web" interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request.
22 CVE-2019-13640 77 Exec Code 2019-07-17 2019-08-24
7.5
 None Remote Low Not required Partial Partial Partial
In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed.
23 CVE-2019-13597 77 Exec Code 2019-07-14 2019-07-30
7.5
 None Remote Low Not required Partial Partial Partial
_s_/sprm/_s_/dyn/Player_setScriptFile in Sahi Pro 8.0.0 allows command execution. It allows one to run ".sah" scripts via Sahi Launcher. Also, one can create a new script with an editor. It is possible to execute commands on the server using the _execute() function.
24 CVE-2019-13561 77 Exec Code 2019-07-11 2019-07-12
10.0
 None Remote Low Not required Complete Complete Complete
D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metacharacters in the online_firmware_check.cgi check_fw_url parameter.
25 CVE-2019-13482 77 2019-07-10 2019-08-27
9.0
 None Remote Low Single system Complete Complete Complete
An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Type field to SetWanSettings.
26 CVE-2019-13481 77 2019-07-10 2019-07-12
9.0
 None Remote Low Single system Complete Complete Complete
An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the MTU field to SetWanSettings.
27 CVE-2019-13398 77 Exec Code 2019-07-07 2019-07-09
9.0
 None Remote Low Single system Complete Complete Complete
Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrl_save_profile.cgi (save parameter) and cgi-bin/ddns.cgi.
28 CVE-2019-13278 77 2019-07-10 2019-07-16
10.0
 None Remote Low Not required Complete Complete Complete
TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains multiple command injections when processing user input for the setup wizard, allowing an unauthenticated user to run arbitrary commands on the device. The vulnerability can be exercised on the local intranet or remotely if remote administration is enabled.
29 CVE-2019-13155 77 2019-07-02 2019-07-02
6.5
 None Remote Low Single system Partial Partial Partial
An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the IP Address in Add Virtual Server.
30 CVE-2019-13154 77 2019-07-02 2019-07-02
6.5
 None Remote Low Single system Partial Partial Partial
An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the TCP Ports To Open in Add Gaming Rule.
31 CVE-2019-13153 77 2019-07-02 2019-07-02
6.5
 None Remote Low Single system Partial Partial Partial
An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the Private Port in Add Virtual Server.
32 CVE-2019-13152 77 2019-07-02 2019-07-02
6.5
 None Remote Low Single system Partial Partial Partial
An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the IP Address in Add Gaming Rule.
33 CVE-2019-13151 77 2019-07-02 2019-07-02
6.5
 None Remote Low Single system Partial Partial Partial
An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the action set_sta_enrollee_pin_5g and the key wps_sta_enrollee_pin.
34 CVE-2019-13150 77 2019-07-02 2019-07-02
6.5
 None Remote Low Single system Partial Partial Partial
An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication). The command injection exists in the key ip_addr.
35 CVE-2019-13149 77 2019-07-02 2019-07-02
6.5
 None Remote Low Single system Partial Partial Partial
An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the key passwd in Routing RIP Settings.
36 CVE-2019-13148 77 2019-07-02 2019-07-02
6.5
 None Remote Low Single system Partial Partial Partial
An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the UDP Ports To Open in Add Gaming Rule.
37 CVE-2019-13139 77 Exec Code 2019-08-22 2019-09-10
4.6
 None Local Low Not required Partial Partial Partial
In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command execution. An issue exists in the way "docker build" processes remote git URLs, and results in command injection into the underlying "git clone" command, leading to code execution in the context of the user executing the "docker build" command. This occurs because git ref can be misinterpreted as a flag.
38 CVE-2019-13128 77 2019-07-01 2019-07-08
9.0
 None Remote Low Single system Complete Complete Complete
An issue was discovered on D-Link DIR-823G devices with firmware 1.02B03. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the IPAddress or Gateway field to SetStaticRouteSettings.
39 CVE-2019-13024 77 Exec Code 2019-07-01 2019-07-26
9.0
 None Remote Low Single system Complete Complete Complete
Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "init_script"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it by calling the vulnerable page www/include/configuration/configGenerate/xml/generateFiles.php (which passes the inserted value to the database to shell_exec without sanitizing it, allowing one to execute system arbitrary commands).
40 CVE-2019-12997 77 2019-06-28 2019-07-03
9.0
 None Remote Low Single system Complete Complete Complete
In Loopchain through 2.2.1.3, an attacker can escalate privileges from a low-privilege shell by changing the environment (aka injection in the DEFAULT_SCORE_HOST environment variable).
41 CVE-2019-12992 77 2019-07-16 2019-07-17
9.0
 None Remote Low Single system Complete Complete Complete
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 6 of 6).
42 CVE-2019-12991 77 2019-07-16 2019-07-17
9.0
 None Remote Low Single system Complete Complete Complete
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).
43 CVE-2019-12988 77 2019-07-16 2019-07-17
10.0
 None Remote Low Not required Complete Complete Complete
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 4 of 6).
44 CVE-2019-12987 77 2019-07-16 2019-07-17
10.0
 None Remote Low Not required Complete Complete Complete
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6).
45 CVE-2019-12986 77 2019-07-16 2019-07-17
10.0
 None Remote Low Not required Complete Complete Complete
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 2 of 6).
46 CVE-2019-12985 77 2019-07-16 2019-07-17
10.0
 None Remote Low Not required Complete Complete Complete
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 1 of 6).
47 CVE-2019-12840 77 Exec Code 2019-06-15 2019-06-18
9.0
 None Remote Low Single system Complete Complete Complete
In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi.
48 CVE-2019-12839 77 Exec Code 2019-06-15 2019-06-17
6.5
 None Remote Low Single system Partial Partial Partial
In OrangeHRM 4.3.1 and before, there is an input validation error within admin/listMailConfiguration (txtSendmailPath parameter) that allows authenticated attackers to achieve arbitrary command execution.
49 CVE-2019-12805 77 Exec Code 2019-08-09 2019-10-09
6.8
 None Remote Medium Not required Partial Partial Partial
NCSOFT Game Launcher, NC Launcher2 2.4.1.691 and earlier versions have a vulnerability in the custom protocol handler that could allow remote attacker to execute arbitrary command. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page. This can be leveraged for code execution in the context of the current user.
50 CVE-2019-12792 77 2019-08-15 2019-08-28
9.0
 None Remote Low Single system Complete Complete Complete
A command injection vulnerability in UploadHandler.php in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users to root.
Total number of vulnerabilities : 489   Page : 1 (This Page)2 3 4 5 6 7 8 9 10
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.