Vulnerabilities > Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

DATE CVE VULNERABILITY TITLE RISK
2020-07-23 CVE-2020-15916 OS Command Injection vulnerability in Tenda Ac15 Firmware 15.03.05.19
goform/AdvSetLanip endpoint on Tenda AC15 AC1900 15.03.05.19 devices allows remote attackers to execute arbitrary system commands via shell metacharacters in the lanIp POST parameter.
network
low complexity
tenda CWE-78
critical
 9.8
9.8
2020-07-22 CVE-2020-15893 OS Command Injection vulnerability in Dlink Dir-816L Firmware 2.06/2.06.B09
An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02.
network
low complexity
dlink CWE-78
critical
 9.8
9.8
2020-07-22 CVE-2020-12774 OS Command Injection vulnerability in Dlink Dsl-7740C Firmware V6.Tr069.20180723
D-Link DSL-7740C does not properly validate user input, which allows an authenticated LAN user to inject arbitrary command.
local
low complexity
dlink CWE-78
6.7
6.7
2020-07-20 CVE-2020-15123 OS Command Injection vulnerability in Codecov
In codecov (npm package) before version 3.7.1 the upload method has a command injection vulnerability.
network
low complexity
codecov CWE-78
critical
 9.3
9.3
2020-07-20 CVE-2020-15121 OS Command Injection vulnerability in multiple products
In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection.
network
low complexity
radare fedoraproject CWE-78
critical
 9.6
9.6
2020-07-17 CVE-2020-7206 OS Command Injection vulnerability in HP Nagios-Plugins-Hpilo 1.50
HP nagios plugin for iLO (nagios-plugins-hpilo v1.50 and earlier) has a php code injection vulnerability.
network
low complexity
hp CWE-78
critical
 9.8
9.8
2020-07-17 CVE-2020-5759 OS Command Injection vulnerability in Grandstream products
Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH.
network
low complexity
grandstream CWE-78
critical
 9.8
9.8
2020-07-17 CVE-2020-5758 OS Command Injection vulnerability in Grandstream products
Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP.
network
low complexity
grandstream CWE-78
8.8
8.8
2020-07-17 CVE-2020-5757 OS Command Injection vulnerability in Grandstream products
Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP.
network
low complexity
grandstream CWE-78
critical
 9.8
9.8
2020-07-17 CVE-2020-5756 OS Command Injection vulnerability in Grandstream Gwn7000 Firmware 1.0.6.32
Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab via undocumented API.
network
low complexity
grandstream CWE-78
8.8
8.8