CWE-77 在命令中使用的特殊元素转义处理不恰当(命令注入) 类弱点 1382 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-77即命令注入，属于输入验证缺陷。攻击者通过构造包含特殊字符的恶意输入，篡改后端系统命令，从而执行任意指令或获取敏感数据。开发者应避免直接拼接用户输入，需采用白名单过滤、参数化调用或安全API替代系统命令执行，确保输入被严格限制在预期范围内，从源头阻断注入风险。
prompt = "Explain the difference between {} and {}".format(arg1, arg2) result = invokeChatbot(prompt) resultHTML = encodeForHTML(result) print resultHTMLExplain the difference between CWE-77 and CWE-78my $arg = GetArgument("filename"); do_listing($arg); sub do_listing { my($fname) = @_; if (! validate_name($fname)) { print "Error: name is not well-formed!\n"; return; } # build command my $cmd = "/bin/ls -l $fname"; system($cmd); } sub validate_name { my($name) = @_; if ($name =~ /^[\w\-]+$/) { return(1); } else { return(0); } }if ($name =~ /^\w[\w\-]+$/) ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-10428 | WAVLINK多款产品 命令注入漏洞 — WN530H4 | 7.2 | High | 2024-10-27 |
| CVE-2024-10193 | WAVLINK WN530H4、WN530HG4和WN572HG3 命令注入漏洞 — WN530H4 | 4.7 | Medium | 2024-10-20 |
| CVE-2024-39563 | Juniper Networks Junos Space 命令注入漏洞 — Junos Space | 7.3 | High | 2024-10-11 |
| CVE-2024-9793 | Tenda AC1206 命令注入漏洞 — AC1206 | 6.3 | Medium | 2024-10-10 |
| CVE-2024-38817 | VMware NSX 安全漏洞 — VMware NSX, VMware Cloud Foundation | 6.7 | Medium | 2024-10-09 |
| CVE-2024-7840 | Progress Software Telerik Reporting 命令注入漏洞 — Telerik Reporting | 7.8 | High | 2024-10-09 |
| CVE-2024-43591 | Microsoft Azure Command Line Integration 命令注入漏洞 — Azure CLI | 8.7 | High | 2024-10-08 |
| CVE-2024-43497 | Microsoft DeepSpeed 命令注入漏洞 — DeepSpeed | 8.4 | High | 2024-10-08 |
| CVE-2024-43601 | Microsoft Visual Studio Code 命令注入漏洞 — Visual Studio Code for Linux | 7.8 | High | 2024-10-08 |
| CVE-2024-9380 | Ivanti CSA 安全漏洞 — CSA (Cloud Services Appliance) | 7.2 | High | 2024-10-08 |
| CVE-2024-47562 | Siemens SINEC Security Monitor 安全漏洞 — SINEC Security Monitor | 8.8 | High | 2024-10-08 |
| CVE-2024-20492 | Cisco Expressway Series 安全漏洞 — Cisco TelePresence Video Communication Server (VCS) Expressway | 6.0 | Medium | 2024-10-02 |
| CVE-2024-20432 | Cisco Nexus Dashboard 安全漏洞 — Cisco Data Center Network Manager | 9.9 | Critical | 2024-10-02 |
| CVE-2024-20365 | Cisco UCS B-Series Blade Servers、Cisco UCS Managed C-Series Rack Servers和Cisco UCS X-Series Modular System 安全漏洞 — Cisco Unified Computing System (Managed) | 6.5 | Medium | 2024-10-02 |
| CVE-2024-9145 | Wiz Code和Wiz (legacy) 安全漏洞 — Wiz Code Visual Studio Code extension | 7.8 | - | 2024-10-01 |
| CVE-2024-39577 | Dell SmartFabric OS10 命令注入漏洞 — SmartFabric OS10 Software | 7.1 | High | 2024-09-26 |
| CVE-2024-8405 | PaperCut NG/MF 安全漏洞 — PaperCut NG, PaperCut MF | 6.1 | Medium | 2024-09-26 |
| CVE-2024-7575 | Telerik UI 命令注入漏洞 — Telerik UI for WPF | 7.8 | High | 2024-09-25 |
| CVE-2024-7679 | Telerik UI 命令注入漏洞 — Telerik UI for WinForms | 7.8 | High | 2024-09-25 |
| CVE-2024-45066 | Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE 命令注入漏洞 — ProGauge MAGLINK LX CONSOLE | 10.0 | Critical | 2024-09-24 |
| CVE-2024-43693 | Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE 命令注入漏洞 — ProGauge MAGLINK LX CONSOLE | 10.0 | Critical | 2024-09-24 |
| CVE-2024-0005 | FlashArray和FlashBlade 安全漏洞 — FlashArray | 9.1 | Critical | 2024-09-23 |
| CVE-2024-45348 | Xiaomi AX9000 安全漏洞 — Xiaomi Router AX9000 | 6.4 | Medium | 2024-09-23 |
| CVE-2024-45682 | Millbeck Proroute H685t-w 命令注入漏洞 — Proroute H685t-w | 8.8 | High | 2024-09-17 |
| CVE-2024-8640 | GitLab 安全漏洞 — GitLab | 8.5 | High | 2024-09-12 |
| CVE-2024-45824 | Rockwell Automation FactoryTalk View Site Edition 安全漏洞 — FactoryTalk View Site Edition | 9.8 | Critical | 2024-09-12 |
| CVE-2024-38227 | Microsoft SharePoint 命令注入漏洞 — Microsoft SharePoint Enterprise Server 2016 | 7.2 | High | 2024-09-10 |
| CVE-2024-38228 | Microsoft SharePoint 命令注入漏洞 — Microsoft SharePoint Enterprise Server 2016 | 7.2 | High | 2024-09-10 |
| CVE-2024-33508 | Fortinet FortiClientEMS 命令注入漏洞 — FortiClientEMS | 6.9 | High | 2024-09-10 |
| CVE-2024-42427 | Dell ThinOS 安全漏洞 — Wyse Proprietary OS (Modern ThinOS) | 7.6 | High | 2024-09-10 |
CWE-77（在命令中使用的特殊元素转义处理不恰当(命令注入)） 是常见的弱点类别，本平台收录该类弱点关联的 1382 条 CVE 漏洞。