CWE-78
5,885 CVEs • Abstraction: Base • Likelihood of Exploit: High
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVEs (5,885)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Kddi 1Home Spot Cube Firmware May 6, 2026 Jan 30, 2016 N/A· v4 4.7 MEDIUM· v3 6.5 MEDIUM· v2 KDDI HOME SPOT CUBE devices before 2 allow remote authenticated users to execute arbitrary OS commands via unspecified vectors. |
1Cisco 2Firepower Extensible Operating System Unified Computing SystemMay 6, 2026 Jan 22, 2016 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 An unspecified CGI script in Cisco FX-OS before 1.1.2 on Firepower 9000 devices and Cisco Unified Computing System (UCS) Manager before 2.2(4b), 2.2(5) before 2.2(5a), and 3.0 before 3.0(2e) allows remote attackers to ex...Show more |
Seeds acmailer before 3.8.21 and 3.9.x before 3.9.15 Beta allows remote authenticated users to execute arbitrary OS commands via unspecified vectors. |
2Canonical Pygments2Pygments Ubuntu LinuxMay 6, 2026 Jan 8, 2016 N/A· v4 9.0 CRITICAL· v3 9.3 HIGH· v2 The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name. |
1Ibm 2Spectrum Protect For Virtual Environments Spectrum Protect SnapshotMay 6, 2026 Jan 2, 2016 N/A· v4 10.0 CRITICAL· v3 10.0 HIGH· v2 The Data Protection extension in the VMware GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 7.1 before 7.1.3.0 and Tivoli Storage Fla...Show more |
1Ibm 3Security Access Manager 9.0 Firmware Security Access Manager For Web 7.0 FirmwareSecurity Access Manager For Web 8.0 FirmwareMay 6, 2026 Jan 2, 2016 N/A· v4 8.0 HIGH· v3 8.5 HIGH· v2 IBM Security Access Manager for Web 7.0.0 before FP19 and 8.0 before 8.0.1.3 IF3, and Security Access Manager 9.0 before 9.0.0.0 IF1, allows remote authenticated users to execute arbitrary OS commands by leveraging Local...Show more |
1Mcafee 1Mcafee Enterprise Security Manager May 6, 2026 Dec 2, 2015 N/A· v4 N/A· v3 9.3 HIGH· v2 McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC) 9.3.x before 9.3.2MR19, 9.4.x before 9.4.2MR9, and 9.5.x before 9.5.0MR8, when...Show more |
1Cisco 1Firepower Extensible Operating System May 6, 2026 Nov 24, 2015 N/A· v4 N/A· v3 6.5 MEDIUM· v2 An unspecified script in the web interface in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote authenticated users to execute arbitrary OS commands via crafted parameters, ak...Show more |
1Cisco 1Firepower Extensible Operating System May 6, 2026 Nov 19, 2015 N/A· v4 N/A· v3 7.2 HIGH· v2 The Management I/O (MIO) component in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows local users to execute arbitrary OS commands as root via crafted CLI input, aka Bug ID CSCux10...Show more |
PC-EGG pWebManager before 3.3.10, and before 2.2.2 for PHP 4.x, allows remote authenticated users to execute arbitrary OS commands by leveraging the editor role. |
Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP3 allows remote attackers to execute arbitrary OS commands via crafted data. |
The admin web interface in Cisco AsyncOS 8.x before 8.0.8-113, 8.1.x and 8.5.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance (WSA) devices allows remote authe...Show more |
1Typemoon 4Fate/hollow Ataraxia Fate/stay NightFate/stay Night + Hollow Ataraxia Set+1 moreMay 6, 2026 Nov 6, 2015 N/A· v4 N/A· v3 10.0 HIGH· v2 TYPE-MOON Fate/stay night, Fate/hollow ataraxia, Witch on the Holy Night, and Fate/stay night + hollow ataraxia set allow remote attackers to execute arbitrary OS commands via crafted saved data. |
The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted serialized data in a cookie. |
eventapp/lib/gcloud.rb in the ISUCON5 qualifier portal (aka eventapp) web application before 2015-10-30 makes improper popen calls, which allows remote attackers to execute arbitrary commands via an HTTP request that inc...Show more |
1Infinite Automation Systems 1Mango Automation May 6, 2026 Oct 28, 2015 N/A· v4 N/A· v3 6.5 MEDIUM· v2 Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors. |
icewind1991 SMB before 1.0.3 allows remote authenticated users to execute arbitrary SMB commands via shell metacharacters in the user argument in the (1) listShares function in Server.php or the (2) connect or (3) read f...Show more |
The external SMB storage driver in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 allows remote authenticated users to execute arbitrary SMB commands via a ; (semicolon) character in a file. |
install.php in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to execute arbitrary commands via the adminPassword parameter, a different issue than CVE-2015-7381. |
1Mcafee 3Enterprise Security Manager Enterprise Security Manager/log ManagerEnterprise Security Manager/receiverMay 6, 2026 Sep 22, 2015 N/A· v4 N/A· v3 6.5 MEDIUM· v2 McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC) before 9.3.2MR18, 9.4.x before 9.4.2MR8, and 9.5.x before 9.5.0MR7 allow remote...Show more |