Fallos del tipo CWE-78

4576 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2022-33204CRITICALFour OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-EPSS 4.3%CVE-2022-33206CRITICALFour OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-EPSS 4.3%CVE-2022-33207CRITICALFour OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-EPSS 4.3%CVE-2022-33205CRITICALFour OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-EPSS 4.3%CVE-2026-23515CRITICALRCE - Command Injection in Signal K set-system-time pluginEPSS 4.3%CVE-2025-6896MEDIUMD-Link DI-7300G+ wget_test.asp os command injectionEPSS 4.3%CVE-2013-10058HIGHLinksys Routers apply.cgi Remote Command InjectionEPSS 4.3%CVE-2026-48362CRITICALColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 4.3%CVE-2024-20399MEDIUMCisco NX-OS Software CLI Command Injection VulnerabilityEPSS 4.3%KEVCVE-2022-40222CRITICALAn OS command injection vulnerability exists in the m2m DELETE_FILE cmd functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A speciEPSS 4.3%CVE-2025-11491MEDIUMwonderwhy-er DesktopCommanderMCP command-manager.ts CommandManager os command injectionEPSS 4.3%CVE-2021-24684—PDF Light Viewer < 1.4.12 - Authenticated Command InjectionEPSS 4.3%CVE-2025-54406HIGHMultiple OS command injection vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted sEPSS 4.3%CVE-2025-54405HIGHMultiple OS command injection vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted sEPSS 4.3%CVE-2022-45717CRITICALIP-COM M50 V15.11.0.33(10768) was discovered to contain a command injection vulnerability via the usbPartitionName parameter in the formSetUEPSS 4.3%CVE-2022-50789HIGHSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via dns.phpEPSS 4.3%CVE-2022-45709CRITICALIP-COM M50 V15.11.0.33(10768) was discovered to contain multiple command injection vulnerabilities via the pEnable, pLevel, and pModule paraEPSS 4.3%CVE-2024-3193HIGHMailCleaner Admin Endpoints os command injectionEPSS 4.2%CVE-2019-17095HIGHBitdefender BOX 2 bootstrap download_image command injection vulnerabilityEPSS 4.2%CVE-2017-16608—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. AuthenticatiEPSS 4.2%