Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

CVEs (6,175)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2012-3076 1Cisco 1Telepresence Recording Server Apr 29, 2026 Jul 12, 2012 N/A· v4 N/A· v3 9.0 HIGH· v2 The administrative web interface on Cisco TelePresence Recording Server before 1.8.0 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Bug ID CSCth85804.
CVE-2012-3075 1Cisco 11Telepresence System 1300 65 Telepresence System 3000Telepresence System 3010+8 more Apr 29, 2026 Jul 12, 2012 N/A· v4 N/A· v3 9.0 HIGH· v2 The administrative web interface on Cisco TelePresence Immersive Endpoint Devices before 1.7.4 allows remote authenticated users to execute arbitrary commands via a malformed request on TCP port 443, aka Bug ID CSCtn9972...Show more The administrative web interface on Cisco TelePresence Immersive Endpoint Devices before 1.7.4 allows remote authenticated users to execute arbitrary commands via a malformed request on TCP port 443, aka Bug ID CSCtn99724.Show less
CVE-2012-3074 1Cisco 11Telepresence System 1300 65 Telepresence System 3000Telepresence System 3010+8 more Apr 29, 2026 Jul 12, 2012 N/A· v4 N/A· v3 8.3 HIGH· v2 An unspecified API on Cisco TelePresence Immersive Endpoint Devices before 1.9.1 allows remote attackers to execute arbitrary commands by leveraging certain adjacency and sending a malformed request on TCP port 61460, ak...Show more An unspecified API on Cisco TelePresence Immersive Endpoint Devices before 1.9.1 allows remote attackers to execute arbitrary commands by leveraging certain adjacency and sending a malformed request on TCP port 61460, aka Bug ID CSCtz38382.Show less
CVE-2012-2516 1Ge 5Intelligent Platforms Proficy Batch Execution Intelligent Platforms Proficy HistorianIntelligent Platforms Proficy Hmi/scada Ifix+2 more Apr 29, 2026 Jul 5, 2012 N/A· v4 N/A· v3 9.3 HIGH· v2 An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA iFIX 5.0 and 5.1; Proficy Pulse...Show more An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA iFIX 5.0 and 5.1; Proficy Pulse 1.0; Proficy Batch Execution 5.6; SI7 I/O Driver 7.20 through 7.42; and other products, allows remote attackers to execute arbitrary commands via crafted input, related to a "command injection vulnerability."Show less
CVE-2012-3366 1Anl 1Bcfg2 Apr 29, 2026 Jul 3, 2012 N/A· v4 N/A· v3 9.0 HIGH· v2 The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server).
CVE-2012-1988 4Canonical DebianFedoraproject+1 more 5Debian Linux FedoraPuppet+2 more Apr 29, 2026 May 29, 2012 N/A· v4 N/A· v3 6.0 MEDIUM· v2 Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on t...Show more Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.Show less
CVE-2012-1795 1Webglimpse 1Webglimpse Apr 29, 2026 Mar 20, 2012 N/A· v4 N/A· v3 7.5 HIGH· v2 webglimpse.cgi in Webglimpse before 2.20.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter, as exploited in the wild in March 2012.
CVE-2011-4002 1Mawashimono 1Nikki Apr 29, 2026 Nov 30, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 HP no Mawashimono Nikki 6.6 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."
CVE-2011-4502 4Canyon Tech EdimaxSitecom+1 more 126114wg 6114wg Router FirmwareBr 6104k Router Firmware+9 more Apr 29, 2026 Nov 22, 2011 N/A· v4 N/A· v3 10.0 HIGH· v2 The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmwa...Show more The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to execute arbitrary commands via shell metacharacters.Show less
CVE-2011-1513 1E107 1E107 Apr 29, 2026 Nov 4, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 Static code injection vulnerability in install_.php in e107 CMS 0.7.24 and probably earlier versions, when the installation script is not removed, allows remote attackers to inject arbitrary PHP code into e107_config.php...Show more Static code injection vulnerability in install_.php in e107 CMS 0.7.24 and probably earlier versions, when the installation script is not removed, allows remote attackers to inject arbitrary PHP code into e107_config.php via a crafted MySQL server name.Show less
CVE-2011-2148 1Smartertools 1Smarterstats Apr 29, 2026 May 20, 2011 N/A· v4 N/A· v3 10.0 HIGH· v2 Admin/frmSite.aspx in the SmarterTools SmarterStats 6.0 web server allows remote attackers to execute arbitrary commands via vectors involving a leading and trailing & (ampersand) character, and (1) an STTTState cookie,...Show more Admin/frmSite.aspx in the SmarterTools SmarterStats 6.0 web server allows remote attackers to execute arbitrary commands via vectors involving a leading and trailing & (ampersand) character, and (1) an STTTState cookie, (2) the ctl00%24MPH%24txtAdminNewPassword_SettingText parameter, (3) the ctl00%24MPH%24txtSmarterLogDirectory parameter, (4) the ctl00%24MPH%24ucSiteSeoSearchEngineSettings%24chklistEngines_SettingCheckBox%2414 parameter, (5) the ctl00%24MPH%24ucSiteSeoSettings%24txtSeoMaxKeywords_SettingText parameter, or (6) the ctl00_MPH_grdLogLocations_HiddenLSR parameter, related to an "OS command injection" issue.Show less
CVE-2011-1904 1Proofpoint 2Messaging Security Gateway Protection Server Apr 29, 2026 May 5, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 An unspecified function in the web interface in Proofpoint Messaging Security Gateway 6.2.0.263:6.2.0.237 and earlier in Proofpoint Protection Server 5.5.3, 5.5.4, 5.5.5, 6.0.2, 6.1.1, and 6.2.0 allows remote attackers t...Show more An unspecified function in the web interface in Proofpoint Messaging Security Gateway 6.2.0.263:6.2.0.237 and earlier in Proofpoint Protection Server 5.5.3, 5.5.4, 5.5.5, 6.0.2, 6.1.1, and 6.2.0 allows remote attackers to execute arbitrary commands via unknown vectors, related to a "command injection" issue.Show less
CVE-2011-0456 1Otrs 1Otrs Apr 29, 2026 Mar 11, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 webscript.pl in Open Ticket Request System (OTRS) 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."
CVE-2011-0382 1Cisco 2Telepresence Recording Server Telepresence Recording Server Software Apr 29, 2026 Feb 25, 2011 N/A· v4 N/A· v3 10.0 HIGH· v2 The CGI subsystem on Cisco TelePresence Recording Server devices with software 1.6.x before 1.6.2 allows remote attackers to execute arbitrary commands via a request to TCP port 443, related to a "command injection vulne...Show more The CGI subsystem on Cisco TelePresence Recording Server devices with software 1.6.x before 1.6.2 allows remote attackers to execute arbitrary commands via a request to TCP port 443, related to a "command injection vulnerability," aka Bug ID CSCtf97221.Show less
CVE-2011-0381 1Cisco 1Telepresence Manager Apr 29, 2026 Feb 25, 2011 N/A· v4 N/A· v3 10.0 HIGH· v2 Cisco TelePresence Manager 1.2.x through 1.6.x allows remote attackers to perform unspecified actions and consequently execute arbitrary code via a crafted request to the Java RMI interface, related to a "command injecti...Show more Cisco TelePresence Manager 1.2.x through 1.6.x allows remote attackers to perform unspecified actions and consequently execute arbitrary code via a crafted request to the Java RMI interface, related to a "command injection vulnerability," aka Bug ID CSCtf97085.Show less
CVE-2011-0378 1Cisco 7Telepresence System 1000 Telepresence System 1100Telepresence System 1300 Series+4 more Apr 29, 2026 Feb 25, 2011 N/A· v4 N/A· v3 8.3 HIGH· v2 The XML-RPC implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote attackers to execute arbitrary commands via a TCP request, related to a "command injection vulnerability,"...Show more The XML-RPC implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote attackers to execute arbitrary commands via a TCP request, related to a "command injection vulnerability," aka Bug ID CSCtb52587.Show less
CVE-2011-0375 1Cisco 7Telepresence System 1000 Telepresence System 1100Telepresence System 1300 Series+4 more Apr 29, 2026 Feb 25, 2011 N/A· v4 N/A· v3 9.0 HIGH· v2 The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.6.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to "command injection vulne...Show more The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.6.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCth24671.Show less
CVE-2011-0374 1Cisco 7Telepresence System 1000 Telepresence System 1100Telepresence System 1300 Series+4 more Apr 29, 2026 Feb 25, 2011 N/A· v4 N/A· v3 9.0 HIGH· v2 The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to "command injection vulne...Show more The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCtb31659.Show less
CVE-2011-0373 1Cisco 7Telepresence System 1000 Telepresence System 1100Telepresence System 1300 Series+4 more Apr 29, 2026 Feb 25, 2011 N/A· v4 N/A· v3 9.0 HIGH· v2 The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to "command injection vulne...Show more The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCtb31685.Show less
CVE-2011-0372 1Cisco 7Telepresence System 1000 Telepresence System 1100Telepresence System 1300 Series+4 more Apr 29, 2026 Feb 25, 2011 N/A· v4 N/A· v3 10.0 HIGH· v2 The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote attackers to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities...Show more The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote attackers to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCtb31640.Show less

Previous 1...305306307 308 309 Next