Vulnerabilities > Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2017-09-22 | CVE-2017-14705 | OS Command Injection vulnerability in Denyall I-Suite and web Application Firewall DenyAll WAF before 6.4.1 allows unauthenticated remote command execution via TCP port 3001 because shell metacharacters can be inserted into the type parameter to the tailDateFile function in /webservices/stream/tail.php. | 8.1 |
| 2017-09-22 | CVE-2017-11395 | OS Command Injection vulnerability in Trendmicro Smart Protection Server 3.1/3.2 Command injection vulnerability in Trend Micro Smart Protection Server (Standalone) 3.1 and 3.2 server administration UI allows attackers with authenticated access to execute arbitrary code on vulnerable installations. | 8.8 |
| 2017-09-19 | CVE-2015-3431 | OS Command Injection vulnerability in Pydio Pydio (formerly AjaXplorer) before 6.0.7 allows remote attackers to execute arbitrary commands via unspecified vectors, aka "Pydio OS Command Injection Vulnerabilities." | 9.8 |
| 2017-09-17 | CVE-2017-14500 | OS Command Injection vulnerability in Newsbeuter Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item with a media enclosure (i.e., a podcast file) that includes shell metacharacters in its filename, related to pb_controller.cpp and queueloader.cpp, a different vulnerability than CVE-2017-12904. | 8.8 |
| 2017-09-15 | CVE-2017-9328 | OS Command Injection vulnerability in Terra-Master Terramaster Operating System 3.0.33 Shell metacharacter injection vulnerability in /usr/www/include/ajax/GetTest.php in TerraMaster TOS before 3.0.34 leads to remote code execution as root. | 9.8 |
| 2017-09-15 | CVE-2017-10813 | OS Command Injection vulnerability in Corega WLR 300 NM Firmware 1.90 CG-WLR300NM Firmware version 1.90 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors. | 6.8 |
| 2017-09-13 | CVE-2017-14429 | OS Command Injection vulnerability in Dlink Dir-850L Firmware The DHCP client on D-Link DIR-850L REV. | 9.8 |
| 2017-09-13 | CVE-2017-14405 | OS Command Injection vulnerability in Eyesofnetwork 5.10 The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote command execution via shell metacharacters in a hosts_cacti array parameter to module/admin_device/index.php. | 7.2 |
| 2017-09-07 | CVE-2017-6796 | OS Command Injection vulnerability in Cisco IOS XE A vulnerability in the USB-modem code of Cisco IOS XE Software running on Cisco ASR 920 Series Aggregation Services Routers could allow an authenticated, local attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. | 6.7 |
| 2017-09-07 | CVE-2017-13713 | OS Command Injection vulnerability in Twsz Wifi Repeater Firmware T&W WIFI Repeater BE126 allows remote authenticated users to execute arbitrary code via shell metacharacters in the user parameter to cgi-bin/webupg. | 8.8 |