← Back
CWE-78

6,175 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

JSON object

Loading...

CVEs (6,175)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2013-7103
1Mcafee
1Email Gateway
Apr 29, 2026
Dec 14, 2013
N/A· v4
N/A· v3
9.0 HIGH· v2
McAfee Email Gateway 7.6 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the value attribute in a (1) TestFile XML element or the (2) hostname. NOTE: this issue can b...Show more
McAfee Email Gateway 7.6 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the value attribute in a (1) TestFile XML element or the (2) hostname. NOTE: this issue can be combined with CVE-2013-7092 to allow remote attackers to execute commands.Show less
CVE-2013-4457
1Thoughtbot
1Cocaine
Apr 29, 2026
Nov 2, 2013
N/A· v4
N/A· v3
6.8 MEDIUM· v2
The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object, related to recursive variable interpolation.
CVE-2013-5530
1Cisco
1Identity Services Engine Software
Apr 29, 2026
Oct 25, 2013
N/A· v4
N/A· v3
9.0 HIGH· v2
The web framework in Cisco Identity Services Engine (ISE) 1.0 and 1.1.0 before 1.1.0.665-5, 1.1.1 before 1.1.1.268-7, 1.1.2 before 1.1.2.145-10, 1.1.3 before 1.1.3.124-7, 1.1.4 before 1.1.4.218-7, and 1.2 before 1.2.0.89...Show more
The web framework in Cisco Identity Services Engine (ISE) 1.0 and 1.1.0 before 1.1.0.665-5, 1.1.1 before 1.1.1.268-7, 1.1.2 before 1.1.2.145-10, 1.1.3 before 1.1.3.124-7, 1.1.4 before 1.1.4.218-7, and 1.2 before 1.2.0.899-2 allows remote authenticated users to execute arbitrary commands via a crafted session on TCP port 443, aka Bug ID CSCuh81511.Show less
CVE-2013-5703
1Draytek
2Vigor 2700 Router
Vigor 2700 Router Firmware
Apr 29, 2026
Oct 22, 2013
N/A· v4
N/A· v3
6.8 MEDIUM· v2
The DrayTek Vigor 2700 router 2.8.3 allows remote attackers to execute arbitrary JavaScript code, and modify settings or the DNS cache, via a crafted SSID value that is not properly handled during insertion into the sWle...Show more
The DrayTek Vigor 2700 router 2.8.3 allows remote attackers to execute arbitrary JavaScript code, and modify settings or the DNS cache, via a crafted SSID value that is not properly handled during insertion into the sWlessSurvey value in variables.js.Show less
CVE-2012-4108
1Cisco
1Unified Computing System
Apr 29, 2026
Oct 13, 2013
N/A· v4
N/A· v3
6.8 MEDIUM· v2
The fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges and execute arbitrary operating-system commands via crafted parameters to a file-related command, aka Bug ID...Show more
The fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges and execute arbitrary operating-system commands via crafted parameters to a file-related command, aka Bug ID CSCtq86554.Show less
CVE-2013-2578
1Tp Link
5Lm Firmware
Tl Sc3130Tl Sc3130g+2 more
Apr 29, 2026
Oct 11, 2013
N/A· v4
N/A· v3
10.0 HIGH· v2
cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6 allows remote attackers to execute arbitrary commands via shel...Show more
cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6 allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the ServerName parameter and (2) other unspecified parameters.Show less
CVE-2012-4075
1Cisco
1Nx Os
Apr 29, 2026
Oct 5, 2013
N/A· v4
N/A· v3
7.2 HIGH· v2
Cisco NX-OS allows local users to gain privileges and execute arbitrary commands via shell metacharacters in unspecified command parameters, aka Bug IDs CSCtf19827 and CSCtf27788.
CVE-2013-5486
1Cisco
1Prime Data Center Network Manager
Apr 29, 2026
Sep 23, 2013
N/A· v4
N/A· v3
10.0 HIGH· v2
Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to write arbitrary files via the chartid parameter, aka...Show more
Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to write arbitrary files via the chartid parameter, aka Bug IDs CSCue77035 and CSCue77036. NOTE: this can be leveraged to execute arbitrary commands by using the JBoss autodeploy functionality.Show less
CVE-2013-4984
1Sophos
1Web Appliance
Apr 29, 2026
Sep 10, 2013
N/A· v4
N/A· v3
7.2 HIGH· v2
The close_connections function in /opt/cma/bin/clear_keys.pl in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows local users to gain privileges via shell metacharacters in the second argument.
CVE-2013-4983
1Sophos
1Web Appliance Firmware
Apr 29, 2026
Sep 10, 2013
N/A· v4
N/A· v3
10.0 HIGH· v2
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to...Show more
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to end-user/index.php.Show less
CVE-2012-6605
1Paloaltonetworks
1Pan Os
Apr 29, 2026
Aug 31, 2013
N/A· v4
N/A· v3
9.0 HIGH· v2
The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka Ref ID 34896.
CVE-2012-6604
1Paloaltonetworks
1Pan Os
Apr 29, 2026
Aug 31, 2013
N/A· v4
N/A· v3
9.0 HIGH· v2
The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka Ref ID 35249.
CVE-2012-6602
1Paloaltonetworks
1Pan Os
Apr 29, 2026
Aug 31, 2013
N/A· v4
N/A· v3
9.0 HIGH· v2
The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.4 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 30122.
CVE-2012-6601
1Paloaltonetworks
1Pan Os
Apr 29, 2026
Aug 31, 2013
N/A· v4
N/A· v3
10.0 HIGH· v2
The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.12, 4.0.x before 4.0.10, and 4.1.x before 4.1.4 allows remote attackers to execute arbitrary code via unspecified vectors, aka Ref ID 3...Show more
The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.12, 4.0.x before 4.0.10, and 4.1.x before 4.1.4 allows remote attackers to execute arbitrary code via unspecified vectors, aka Ref ID 36983.Show less
CVE-2012-6600
1Paloaltonetworks
1Pan Os
Apr 29, 2026
Aug 31, 2013
N/A· v4
N/A· v3
9.0 HIGH· v2
The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1.x before 4.1.2 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 3450...Show more
The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1.x before 4.1.2 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 34502.Show less
CVE-2012-6599
1Paloaltonetworks
1Pan Os
Apr 29, 2026
Aug 31, 2013
N/A· v4
N/A· v3
9.0 HIGH· v2
The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.8 and 4.1.x before 4.1.1 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 3347...Show more
The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.8 and 4.1.x before 4.1.1 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 33476.Show less
CVE-2012-6598
1Paloaltonetworks
1Pan Os
Apr 29, 2026
Aug 31, 2013
N/A· v4
N/A· v3
9.0 HIGH· v2
The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.8 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 33080.
CVE-2012-6595
1Paloaltonetworks
1Pan Os
Apr 29, 2026
Aug 31, 2013
N/A· v4
N/A· v3
9.0 HIGH· v2
The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1.x before 4.1.2 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Re...Show more
The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1.x before 4.1.2 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Ref ID 34595.Show less
CVE-2012-6594
1Paloaltonetworks
1Pan Os
Apr 29, 2026
Aug 31, 2013
N/A· v4
N/A· v3
9.0 HIGH· v2
The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11, 4.0.x before 4.0.8, and 4.1.x before 4.1.1 allows remote authenticated administrators to execute arbitrary commands via unspecified...Show more
The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11, 4.0.x before 4.0.8, and 4.1.x before 4.1.1 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Ref ID 34299.Show less
CVE-2012-6593
1Paloaltonetworks
1Pan Os
Apr 29, 2026
Aug 31, 2013
N/A· v4
N/A· v3
10.0 HIGH· v2
Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.4 allows remote attackers to execute arbitrary commands via unspecified vectors, aka Ref ID 30088.