composer: Composer: Arbitrary code execution via malicious Perforce source URL

A flaw was found in Composer. A malicious dependency package from a custom Composer repository or an untrusted composer.lock file could exploit a vulnerability in how Composer handles Perforce source URLs. By setting source.type to perforce and source.url to an rsh: or jsh: P4PORT value, an...

Exploit for CVE-2026-84361

CVE-2026-84361: Composer’s P4PORT command execution PoC Engl...

CVE-2026-84361 Composer: Perforce source URL permits P4PORT `rsh:` command execution

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 clien...

CVE-2026-84361

Composer (PHP dependency manager) versions 1.0 through 2.2.30 and 2.10.3 are affected by a vulnerability in Composer\Util\Perforce . A malicious dependency package from a custom Composer repository or untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh:...

CVE-2026-84361 Composer: Perforce source URL permits P4PORT `rsh:` command execution

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 clien...

subversion: Fix of CVE-2017-9800

CVE-2017-9800: fix arbitrary code execution via crafted svn+ssh:// URLs by validating the decoded hostinfo and adding an end-of-options guard to the default svn+ssh and example rsh tunnel commands...

CLSA-2026-1777040144 subversion: Fix of CVE-2017-9800

CVE-2017-9800: fix arbitrary code execution via crafted svn+ssh:// URLs by validating the decoded hostinfo and adding an end-of-options guard to the default svn+ssh and example rsh tunnel commands...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002812)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002812 advisory. kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service memory corruption or possibly have unspecified other impact ...

CVE-2007-4006

Buffer overflow in Mike Dubman Windows RSH daemon rshd 1.7 has unknown impact and remote attack vectors, aka ZD-00000034. NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories....

EUVD-2000-1110

Malware in sbrugna...

EUVD-2004-0804

Malware in sbrugna...

EUVD-1999-1247

Malware in sbrugna...

EUVD-2001-1310

Malware in sbrugna...

EUVD-2000-0773

Malware in sbrugna...

EUVD-2006-0415

Malware in sbrugna...

EUVD-1999-1436

Malware in sbrugna...

EUVD-2001-1311

Malware in sbrugna...

EUVD-2018-0876

Malware in sbrugna...

EUVD-2004-0848

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2023-40303

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of setid family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd...