Fallos del tipo CWE-78

5063 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2024-5297HIGHD-Link D-View executeWmicCmd Command Injection Remote Code Execution VulnerabilityEPSS 1.9%CVE-2010-10013CRITICALAjaXplorer < 2.6 checkInstall.php Unauthenticated RCEEPSS 1.9%CVE-2023-50382HIGHThree os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially craftedEPSS 1.9%CVE-2023-50383HIGHThree os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially craftedEPSS 1.9%CVE-2023-27917HIGHOS command injection vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker who can access Network MaintenanEPSS 1.9%CVE-2019-1010200—Voice Builder Prior to commit c145d4604df67e6fc625992412eef0bf9a85e26b and f6660e6d8f0d1d931359d591dbdec580fef36d36 is affected by: CWE-78: EPSS 1.9%CVE-2025-56096HIGHOS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request tEPSS 1.9%CVE-2022-1360HIGHCambium Networks cnMaestro OS Command InjectionEPSS 1.9%CVE-2021-32534CRITICALQSAN SANOS - Command InjectionEPSS 1.9%CVE-2021-32533CRITICALQSAN SANOS - Command InjectionEPSS 1.9%CVE-2009-20010CRITICALDogfood CRM spell.php RCEEPSS 1.9%CVE-2021-32830LOWThe @diez/generation npm package is a client for Diez. The locateFont method of @diez/generation has a command injection vulnerability. ClieEPSS 1.9%CVE-2026-1961HIGHForman: foreman: remote code execution via command injection in websocket proxyEPSS 1.9%CVE-2026-82636HIGHQubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled quEPSS 1.9%CVE-2022-43643HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers.EPSS 1.9%CVE-2026-12815MEDIUMcoollabsio coolify Image Name os command injectionEPSS 1.9%CVE-2026-6942CRITICALradare2-mcp <=1.6.0 OS Command Injection via Shell Metacharacter BypassEPSS 1.9%CVE-2021-36011HIGHAdobe Illustrator improper neutralization of special elements used in an OS commandEPSS 1.9%CVE-2025-61304CRITICALOS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address.EPSS 1.9%CVE-2022-20871MEDIUMCisco Secure Web Appliance Privilege Escalation VulnerabilityEPSS 1.9%