Fallos del tipo CWE-78

4603 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2024-24623HIGHSoftaculous Webuzo FTP Management Command InjectionEPSS 1.9%CVE-2026-34796HIGHEndian Firewall /cgi-bin/logs_openvpn.cgi DATE Perl Command InjectionEPSS 1.9%CVE-2026-34794HIGHEndian Firewall /cgi-bin/logs_ids.cgi DATE Perl Command InjectionEPSS 1.9%CVE-2026-34792HIGHEndian Firewall /cgi-bin/logs_clamav.cgi DATE Perl Command InjectionEPSS 1.9%CVE-2026-34797HIGHEndian Firewall /cgi-bin/logs_smtp.cgi DATE Perl Command InjectionEPSS 1.9%CVE-2026-9773HIGHUnraid Web Server ToggleState Command Injection Remote Code Execution VulnerabilityEPSS 1.9%CVE-2026-9772HIGHUnraid Web Server FileUpload Command Injection Remote Code Execution VulnerabilityEPSS 1.9%CVE-2023-1997HIGHOS Command Injection vulnerability affecting SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023xEPSS 1.9%CVE-2020-5146—A vulnerability in SonicWall SMA100 appliance allow an authenticated management-user to perform OS command injection using HTTP POST parametEPSS 1.9%CVE-2024-31705CRITICALAn issue in Infotel Conseil GLPI v.10.X.X and after allows a remote attacker to execute arbitrary code via the insufficient validation of usEPSS 1.9%CVE-2026-77853HIGHImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in FF-RFI079I4 and FF-RFI078I4. A usEPSS 1.9%CVE-2023-36553CRITICALA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 5.4.0 and 5.3.0 tEPSS 1.9%CVE-2026-51190CRITICALThe "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: trueEPSS 1.9%CVE-2026-50874HIGHAn OS command injection vulnerability in the /manage/features/media component of kanishka-linux Reminiscence v0.3.0 allows attackers to execEPSS 1.9%CVE-2026-23520CRITICALArcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCEEPSS 1.9%CVE-2026-27487HIGHOpenClaw: Prevent shell injection in macOS keychain credential writeEPSS 1.9%CVE-2026-0756CRITICALgithub-kanban-mcp-server execAsync Command Injection Remote Code Execution VulnerabilityEPSS 1.9%CVE-2024-1115HIGHopenBI Setting.php dlfile os command injectionEPSS 1.9%CVE-2014-0593HIGHsed command injectionEPSS 1.9%CVE-2020-3371MEDIUMCisco Integrated Management Controller Command Injection VulnerabilityEPSS 1.9%