Sign in Sign up
JA · EN · FR
SecPulse

Cwe 78

🧬 CWE Related 2,028
slug: cwe-78

Explanation

CWE-78は「ユーザー入力をシェルコマンドの一部として使うとき、適切にエスケープせず、攻撃者がコマンドを追加実行できてしまう欠陥」のことです。 例えば `ping {ユーザー入力IP}` の {ユーザー入力IP} に `; rm -rf /` のような文字列を入れられると、サーバー上のファイルが削除されます。 対策は「シェル経由を避け、引数を配列として直接渡す (PHPなら escapeshellarg)」。
📌 Example
Shellshock (CVE-2014-6271): Bashの脆弱性で、Webサーバーへの普通のリクエスト経由で任意のシェルコマンドが実行できた歴史的な事件。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,028

Image ID Title
CVE-2022-44877 KEV [KEV] OS Command Injection in CWP Control Web Panel (CVE-2022-44877)
CVE-2022-37912 OS Command Injection in Sd Wan (CVE-2022-37912)
CVE-2022-37897 OS Command Injection in Sd Wan (CVE-2022-37897)
CVE-2022-37898 OS Command Injection in Sd Wan (CVE-2022-37898)
CVE-2022-37899 OS Command Injection in Sd Wan (CVE-2022-37899)
CVE-2022-37900 OS Command Injection in Sd Wan (CVE-2022-37900)
CVE-2022-37901 OS Command Injection in Sd Wan (CVE-2022-37901)
CVE-2022-37902 OS Command Injection in Sd Wan (CVE-2022-37902)
CVE-2022-33186 OS Command Injection in Brocade Fabric OS software (CVE-2022-33186)
CVE-2022-20934 Command Injection in Cisco Firepower Threat Defense (FTD) Software (CVE-2022-20934)
CVE-2022-36804 KEV [KEV] OS Command Injection in Atlassian Bitbucket Server and Data Center (CVE-2022-36804)
CVE-2022-30079 OS Command Injection in Netgear R6200 (CVE-2022-30079)
CVE-2022-26258 KEV [KEV] OS Command Injection in D-Link DIR-820L (CVE-2022-26258)
CVE-2018-6530 KEV [KEV] OS Command Injection in D-Link Multiple Routers (CVE-2018-6530)
CVE-2022-30078 OS Command Injection in NETGEAR R6200_V2 firmware (CVE-2022-30078)
CVE-2021-42232 OS Command Injection in /usr/bin/tddp (CVE-2021-42232)
CVE-2021-36667 OS Command Injection in Druva inSync 6.9.0 for MacOS (CVE-2021-36667)
CVE-2022-2068 OS Command Injection in Siemens Openssl (CVE-2022-2068)
CVE-2022-30023 OS Command Injection in Tenda ONT GPON AC1200 Dual band WiFi HG9 (CVE-2022-30023)
CVE-2021-42875 OS Command Injection in TOTOLINK EX1200T (CVE-2021-42875)
CVE-2021-42872 OS Command Injection in TOTOLINK EX1200T (CVE-2021-42872)
CVE-2020-25368 OS Command Injection in Dlink (CVE-2020-25368)
CVE-2020-21883 OS Command Injection in Unibox U-50 (CVE-2020-21883)
CVE-2021-28927 OS Command Injection in Microsoft Windows (CVE-2021-28927)
CVE-2019-18184 OS Command Injection in Crestron DMC-STRO (CVE-2019-18184)
CVE-2019-1971 OS Command Injection in Cisco Enterprise NFV Infrastructure Software (CVE-2019-1971)
CVE-2018-19949 KEV [KEV] Vulnerability in QNAP Network Attached Storage (NAS) (CVE-2018-19949)
CVE-2022-30525 KEV [KEV] OS Command Injection in Zyxel Multiple Firewalls (CVE-2022-30525)
CVE-2018-19908 OS Command Injection in MISP (CVE-2018-19908)
CVE-2022-27224 Command Injection in Galleon NTS-6002-GPS (CVE-2022-27224)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details