CVE-2024-4577

CVE-2024-4577 これはPHP CVE-2024-4577のPoCです。 はじめに デジタル環境におけるセキュリティはかつてないほど重要です。とはいえ、ウェブで最もよく使われるプログラミング言語の1つであるPHPに新たな脆弱性が発見され、その結果、数百万ものウェブサイトに目に見えない扉が開かれてしまったと想像してみてください。この脆弱性は CVE-2024-4577 として知られ、リモートの攻撃者が1CGIに引数を注入することで影響を受けるサーバー上で任意のコマンドを実行することを可能にします。この欠陥は、DEVCORE @d3vc0r3 のセキュリティ研究者 Orange...

CVE-2024-2961

CVE-2024-2961 CVE-2024–2961 セキュリティ問題緩和スクリプト 説明 このリポジトリには、GNU libc glibc バージョン 2.39 以前で特定されたバッファオーバーフローの脆弱性（CVE-2024-2961 として知られる）を確認および緩和する Bash スクリプトが含まれています。この脆弱性は、iconv 関数を使用してリクエストのエンコーディングを特定の中国語拡張エンコーディング（ISO-2022-CN-EXT）との間で変換する際に PHP に影響を与えます。悪用された場合、広範囲にわたる影響を与える可能性があります。 使用方法 前提条件...

CVE-2024-2961-Remote-File-Read

CVE-2024-2961 Lectura Remota de Archivos Este script demuestra cómo explotar una vulnerabilidad en sistemas que utilizan la biblioteca iconv cuando maneja incorrectamente las conversiones de codificación de caracteres, como se describe en CVE-2024-2961. Permite a un atacante leer archivos...

wasmtime 输入验证错误漏洞

Wasmtime is a lightweight WebAssembly runtime open source by the Bytecode Alliance. Versions of Wastime prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1 contained a vulnerability related to input validation errors. This vulnerability stemmed from the improper validation of the alignment of reallocated...

EUVD-2015-7422

Malware in sbrugna...

EUVD-2009-0919

Malware in sbrugna...

CVE-2024-45720 Apache Subversion: Command line argument injection on Windows platforms

On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables e.g., svn.exe, etc. may lead to unexpected command line argument interpretation, including argument injection and execution of other programs, if a specially crafted command line...

CVE-2024-45720

CVE-2024-45720 affects Subversion on Windows: a flawed “best fit” character encoding conversion of command-line arguments to svn.exe can cause misinterpretation of arguments, enabling argument injection and execution of other programs. Affected: all Subversion versions up to 1.14.3 on Windows; fi...

Exploit for OS Command Injection in Php

CVE-2024-4577 This is a PoC for PHP CVE-2024-4577. Introdu...

glibc: Out of bounds write in iconv may lead to remote code execution

An out-of-bounds write flaw was found in the ISO-2022-CN-EXT plugin for glibc's iconv library. When converting from UCS4 charset, adding certain escape charterers is required to indicate where the charset was changed to the library. During this process, iconv improperly checks the boundaries of...

SUSE CVE-2008-1036

The International Components for Unicode ICU library in Apple Mac OS X before 10.5.3, Red Hat Enterprise Linux 5, and other operating systems omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting XS...

SUSE CVE-2009-0922

PostgreSQL before 8.3.7, 8.2.13, 8.1.17, 8.0.21, and 7.4.25 allows remote authenticated users to cause a denial of service stack consumption and crash by triggering a failure in the conversion of a localized error message to a client-specified encoding, as demonstrated using mismatched encoding...

Denial Of Service (DoS)

postgresql is vulnerable to denial of service DoS. The vulnerability exists as a flaw was found in the way PostgreSQL handles encoding conversion. A remote, authenticated user could trigger an encoding conversion failure, possibly leading to a temporary denial of service...

Denial-of-Service (DoS)

libxml2.so is vulnerable to heap-based buffer overflow. The xmlParseXmlDecl function in parser.c allows context-dependent attackers to cause a denial of service condition when an encoding conversion failure occurs which causes the parser to extract more errors during the failure...

CVE-2015-7498

Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors related to extracting errors after an encoding conversion failure...

DEBIAN-CVE-2015-7498

Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors related to extracting errors after an encoding conversion failure...

CVE-2015-7498

Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors related to extracting errors after an encoding conversion failure...

CVE-2015-7498

Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors related to extracting errors after an encoding conversion failure...

OracleVM 3.3 : libxml2 (OVMSA-2015-0152)

The remote OracleVM system is missing necessary patches to address critical security updates : - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball - Fix a series of CVEs rhbz1286495 - CVE-2015-7941 Cleanup conditional section error handling -...

Updated libxml2 packages fix security vulnerabilities

Updated libxml2 packages fix security vulnerabilities: In libxml2 before 2.9.3, one case where when dealing with entities expansion, it failed to exit, leading to a denial of service CVE-2015-5312. In libxml2 before 2.9.3, it was possible to hit a negative offset in the name indexing used to...