CVE-2024-47611 XZ Utils on Microsoft Windows platform are vulnerable to argument injection

XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows MinGW-w64 or MSVC, the command line tools from XZ Utils 5.6.2 and older have a command line argument injection vulnerability. If a command line contains Unicode characters for exampl...

CVE-2024-8067

In versions of Helix Core prior to 2024.1 Patch 2 2024.1/2655224 a Windows ANSI API Unicode "best fit" argument injection was identified...

Perforce Helix Core 安全漏洞

Perforce Helix Core is a scalable and secure version control system from Perforce. A security vulnerability exists in Perforce Helix Core prior to version 2024.1 Patch 2, which stems from the best fit parameter containing a parameter injection vulnerability...

CVE-2024-8067

CVE-2024-8067 affects Perforce Helix Core prior to 2024.1 Patch 2 (2024.1/2655224). The issue is a Windows ANSI API Unicode “best fit” argument injection in Helix Core, caused by the best fit parameter handling. Public sources consistently describe this as a parameter injection vulnerability that...

CVE-2024-8067 Unicode "best fit" argument injection

In versions of Helix Core prior to 2024.1 Patch 2 2024.1/2655224 a Windows ANSI API Unicode "best fit" argument injection was identified...

PT-2024-38783 · Perforce · Helix Core

Name of the Vulnerable Software and Affected Versions: Helix Core versions prior to 2024.1 Patch 2 Description: A Windows ANSI API Unicode "best fit" argument injection issue was identified. Recommendations: For versions prior to 2024.1 Patch 2, update to 2024.1 Patch 2 or later to resolve the...

PT-2024-22092

Name of the Vulnerable Software and Affected Versions AirPods versions prior to Firmware Update 6A326 AirPods versions prior to Firmware Update 6F8 Beats versions prior to Firmware Update 6F8 AirPods 2nd generation and later AirPods Pro all models AirPods Max Powerbeats Pro Beats Fit Pro...

curl: Incorrect Encoding Conversion in hostname results in indeterminate SSRF vulnerabilities

Vulnerability description not provided...

curl: Unicode-to-ASCII conversion on Windows can lead to argument injection and more

Vulnerability description not provided...

Exploit for OS Command Injection in Php

CVE-2024-4577 This is a PoC for PHP CVE-2024-4577. Introdu...

CVE-2024-4577

In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may...

AZL-42424 CVE-2024-4577 affecting package php for versions less than 8.1.29-1

In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may...

AZL-42433 CVE-2024-4577 affecting package php for versions less than 8.3.8-1

In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may...

CVE-2024-4577

In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use “Best-Fit” behavior to replace characters in command line given to Win32 API functions. PHP CGI module may...

PHP OS Command Injection Vulnerability

PHP is a scripting language that executes on the server side. PHP suffers from an operating system command injection vulnerability that arises when, under certain conditions, the Windows system replaces characters on the command line with the "Best-Fit" behavior, which may cause the PHP CGI modul...

pro-fit-tech.co.uk Cross Site Scripting vulnerability OBB-3907477

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

fit-kids.jp Cross Site Scripting vulnerability OBB-3906921

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

View transitions: Handling aspect ratio changes

This post assumes some knowledge of view transitions. If you're looking for a from-scratch intro to the feature, see this article. When folks ask me for help with view transition animations that "don't quite look right", it's usually because the content changes aspect ratio. Here's how to handle...

diyhomefit.co.uk Cross Site Scripting vulnerability OBB-3834017

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-39902

A software vulnerability has been identified in the U-Boot Secondary Program Loader SPL before 2023.07 on select NXP i.MX 8M family processors. Under certain conditions, a crafted Flattened Image Tree FIT format structure can be used to overwrite SPL memory, allowing unauthenticated software to...