Command injection vulnerability in programing languages on Microsoft Windows operating system.
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-3566US | critical9.8 | — | ||
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific condit… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/WEB
- https://kb.cert.org/vuls/id/123335WEB
- https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-wayWEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-3566WEB
- https://www.cve.org/CVERecord?id=CVE-2024-1874WEB
- https://www.cve.org/CVERecord?id=CVE-2024-22423WEB
- https://www.cve.org/CVERecord?id=CVE-2024-24576WEB
- https://www.kb.cert.org/vuls/id/123335WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan