Fallos del tipo CWE-78

5061 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2025-59831HIGH`git-comiters` Command Injection vulnerabilityEPSS 4.2%CVE-2022-50795HIGHSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via traceroute.phpEPSS 4.2%CVE-2022-40189CRITICALApache Airlfow Pig Provider RCEEPSS 4.2%CVE-2023-6309MEDIUMmoses-smt mosesdecoder trans_result.php os command injectionEPSS 4.2%CVE-2012-10046CRITICALE-Mail Security Virtual Appliance learn-msg.cgi Command InjectionEPSS 4.1%CVE-2025-7097CRITICALComodo Internet Security Premium Manifest File cis_update_x64.xml os command injectionEPSS 4.1%CVE-2021-27476CRITICALRockwell Automation FactoryTalk AssetCentre OS Command InjectionEPSS 4.1%CVE-2026-8632HIGHHP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code ExecutionEPSS 4.1%CVE-2026-119742HIGHNagios XI < 2026R2 OS Command Injection via mibs.phpEPSS 4.1%CVE-2022-32586HIGHAn OS command injection vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, Inc. iota All-In-OEPSS 4.1%CVE-2019-14894HIGHA flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code executEPSS 4.1%CVE-2026-7096HIGHTenda HG3 formgponConf os command injectionEPSS 4.1%CVE-2026-108576CRITICALTOZED X300 IPPingDiagnostics process_ping os command injectionEPSS 4.1%CVE-2025-67840HIGHMultiple authenticated OS command injection vulnerabilities exist in the Cohesity (formerly Stone Ram) TranZman 4.0 Build 14614 through TZM_EPSS 4.1%CVE-2024-2812MEDIUMTenda AC15 WriteFacMac formWriteFacMac os command injectionEPSS 4.0%CVE-2011-10026CRITICALSpreecommerce < 0.50.x API RCEEPSS 4.0%CVE-2021-3584—A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration opEPSS 4.0%CVE-2025-11407MEDIUMD-Link DI-7001 MINI upgrade_filter.asp os command injectionEPSS 4.0%CVE-2024-14005CRITICALNagios XI < 2024R1.2 Command Injection via Docker WizardEPSS 4.0%CVE-2025-34284CRITICALNagios XI < 2024R2 Authenticated Command Injection via WinRM PluginEPSS 4.0%