AZL-40052 CVE-2024-1874 affecting package php for versions less than 8.3.8-1

In PHP versions 8.1. before 8.1.28, 8.2. before 8.2.18, 8.3. before 8.3.5, when using procopen command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands ...

CVE-2024-1874 Command injection via array-ish $command parameter of proc_open()

In PHP versions 8.1. before 8.1.28, 8.2. before 8.2.18, 8.3. before 8.3.5, when using procopen command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands ...

CVE-2024-1874 Command injection via array-ish $command parameter of proc_open()

In PHP versions 8.1. before 8.1.28, 8.2. before 8.2.18, 8.3. before 8.3.5, when using procopen command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands ...

CVE-2024-1874 Command injection via array-ish $command parameter of proc_open()

In PHP versions 8.1. before 8.1.28, 8.2. before 8.2.18, 8.3. before 8.3.5, when using procopen command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands ...

CVE-2024-1874

This CVE affects PHP 8.1.x up to before 8.1.28, 8.2.x up to before 8.2.18, and 8.3.x up to before 8.3.5. The root cause is insufficient escaping when using proc_open() with array syntax, allowing a malicious user to pass arguments that can execute arbitrary commands in Windows shell. Impact is re...

CVE-2024-1874

In PHP versions 8.1. before 8.1.28, 8.2. before 8.2.18, 8.3. before 8.3.5, when using procopen command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands ...

PHP 安全漏洞

PHP is a scripting language in which PHP is executed server-side. A security vulnerability exists in PHP that originates when using the procopen command with array syntax, due to insufficient escaping, which allows a user to supply parameters to execute arbitrary commands in the Windows shell if...

CVE-2023-31702

SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to dump entire database and gain windows XP command shell to perform code execution on database server via GetUserCurrentPwd?UsrId=1...

The vulnerability of the Windows Shell component of Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the Windows Shell component in Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2022-30222

Windows Shell Remote Code Execution Vulnerability...

CVE-2022-30222

Windows Shell Remote Code Execution Vulnerability...

CVE-2022-30222

Windows Shell Remote Code Execution Vulnerability...

CVE-2022-30222 Windows Shell Remote Code Execution Vulnerability

...

CVE-2022-30222 Windows Shell Remote Code Execution Vulnerability

...

Microsoft Windows Shell 输入验证错误漏洞

The Microsoft Windows Shell is the graphical user interface for the Windows operating system from Microsoft, U.S.A. Easily recognizable elements of the Windows shell include features such as the desktop, the taskbar, the start menu, the task switcher, and autoplay. On some versions of Windows,...

March 9, 2021—KB5000844 (Monthly Rollup)

None None...

March 9, 2021—KB5000851 (Security-only update)

None None...

March 9, 2021—KB5000841 (Monthly Rollup)

None None...

October 13, 2020—KB4580327 (OS Build 10240.18725) - EXPIRED

None None...

The vulnerability of the Shell infrastructure component in Windows operating systems, which allows a hacker to increase their privileges

The vulnerability of the Shell infrastructure component in Windows operating systems is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to enhance their privileges through a specially created application...