Vulnerabilities > Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-10-21 | CVE-2021-1529 | OS Command Injection vulnerability in Cisco IOS XE A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. | 7.8 |
| 2021-10-19 | CVE-2021-31357 | OS Command Injection vulnerability in Juniper Junos OS Evolved A command injection vulnerability in tcpdump command processing on Juniper Networks Junos OS Evolved allows an attacker with authenticated CLI access to be able to bypass configured access protections to execute arbitrary shell commands within the context of the current user. | 7.8 |
| 2021-10-19 | CVE-2021-30358 | OS Command Injection vulnerability in Checkpoint Mobile Access Portal Agent Mobile Access Portal Native Applications who's path is defined by the administrator with environment variables may run applications from other locations by the Mobile Access Portal Agent. | 7.2 |
| 2021-10-15 | CVE-2021-27561 | OS Command Injection vulnerability in Yealink Device Management 3.6.0.20 Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication. | 9.8 |
| 2021-10-14 | CVE-2020-22724 | OS Command Injection vulnerability in Mercury Mer1200 Firmware and Mer1200G Firmware A remote command execution vulnerability exists in add_server_service of PPTP_SERVER in Mercury Router MER1200 v1.0.1 and Mercury Router MER1200G v1.0.1. | 9.8 |
| 2021-10-12 | CVE-2021-37732 | OS Command Injection vulnerability in multiple products A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x.x: 6.5.4.18 and below; Aruba Instant 8.5.x.x: 8.5.0.11 and below; Aruba Instant 8.6.x.x: 8.6.0.6 and below; Aruba Instant 8.7.x.x: 8.7.1.0 and below. | 7.2 |
| 2021-10-12 | CVE-2021-37727 | OS Command Injection vulnerability in multiple products A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.20 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3 and below. | 7.2 |
| 2021-10-12 | CVE-2021-37730 | OS Command Injection vulnerability in multiple products A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.20 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3 and below. | 7.2 |
| 2021-10-11 | CVE-2021-20122 | OS Command Injection vulnerability in Telus Prv65B444A-S-Ts Firmware 3.00.20 The Telus Wi-Fi Hub (PRV65B444A-S-TS) with firmware version 3.00.20 is affected by an authenticated command injection vulnerability in multiple parameters passed to tr69_cmd.cgi. | 7.2 |
| 2021-10-07 | CVE-2021-42071 | OS Command Injection vulnerability in Visual-Tools DVR Vx16 Firmware 4.2.28.0 In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header. | 9.8 |