Fallos del tipo CWE-78

4582 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2017-10951—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interactiEPSS 4.0%CVE-2026-2155HIGHD-Link DIR-823X Configuration set_dmz sub_4208A0 os command injectionEPSS 4.0%CVE-2024-2353HIGHTotolink X6000R shttpd cstecgi.cgi setDiagnosisCfg os command injectionEPSS 4.0%CVE-2023-6320CRITICALCommand injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpointEPSS 3.9%CVE-2025-9026MEDIUMD-Link DIR-860L Simple Service Discovery Protocol cgibin ssdpcgi_main os command injectionEPSS 3.9%CVE-2026-2175HIGHD-Link DIR-823X set_upnp sub_420618 os command injectionEPSS 3.9%CVE-2026-16492MEDIUMumijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injectionEPSS 3.9%CVE-2026-95675CRITICALD-Link DAP-1360 6.14 Unauthenticated RCE via Web Management InterfaceEPSS 3.9%CVE-2019-3920—The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to authenticated command injection via crafted HTTPEPSS 3.9%CVE-2019-3919—The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to command injection via crafted HTTP request sent EPSS 3.9%CVE-2020-3430HIGHCisco Jabber for Windows Protocol Handler Command Injection VulnerabilityEPSS 3.9%CVE-2024-51228MEDIUMAn issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1EPSS 3.9%CVE-2022-21668HIGHPipenv's requirements.txt parsing allows malicious index url in commentsEPSS 3.9%CVE-2024-2854MEDIUMTenda AC18 setsambacfg formSetSambaConf os command injectionEPSS 3.9%CVE-2022-32586HIGHAn OS command injection vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, Inc. iota All-In-OEPSS 3.9%CVE-2021-21888CRITICALAn OS command injection vulnerability exists in the Web Manager SslGenerateCertificate functionality of Lantronix PremierWave 2050 8.9.0.0R4EPSS 3.9%CVE-2021-3584—A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration opEPSS 3.9%CVE-2018-19007—In Geutebrueck GmbH E2 Camera Series versions prior to 1.12.0.25 the DDNS configuration (in the Network Configuration panel) is vulnerable tEPSS 3.9%CVE-2016-15047HIGHAVTECH CloudSetup.cgi Authenticated Command InjectionEPSS 3.9%CVE-2025-66209CRITICALCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database BackupEPSS 3.9%