2091 matches found
Information Disclosure
github.com/gogits/gogs is vulnerable to arbitrary webhook retrieval. GetWebhookByID allows a user to access webhooks from other users' private repositories because it does not check the corresponding repoid when retreiving webhooks...
DEBIAN-CVE-2017-9780
In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for example setuid or world-writable. The files are deployed with those permissions, which would let a local attacker run the setuid executable or write to the...
Directory Traversal
github.com/docker/docker is vulnerable to path traversal attacks and spoofed repositories. These attacks are possible because Docker fails to correctly validate image IDs when using docker load or register communications...
Why Care About Data-Centric Security?
It’s no surprise that data breaches are evolving and becoming increasingly more complex. According to the Verizon 2017 Data Breach Investigation Report, data breaches are “complex affairs often involving some combination of human factors, hardware devices, exploited configurations or malicious...
Unauthorized Repository Forking
github.com/gogits/gogs is vulnerable to the unauthorized forking of repositories. A malicious user can change the ID number in the URL to fork a target repository...
HackerOne: A HackerOne employee's GitHub personal access token exposed in Travis CI build logs
Summary A HackerOne employee Reed Loden GitHub:reedloden exposed their personal access token twice in build logs of the rubysec/rubysec.github.io project: 1. 2015-12-10 2. 2016-03-01 Description The token has publicrepo scope, which means that it allows access to any public repos the owner accoun...
RedHat Update for subscription-manager RHSA-2017:0698-01
The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Simple OpenVPN Raspberry Pi Installer: piVPN
Simple OpenVPN Raspberry Pi Installer This is a set of shell scripts that serve to easily turn your Raspberry Pi TM into a VPN server using the free, open-source OpenVPN software. The master branch of this script installs and configures OpenVPN on Raspbian Jessie and has been tested on Ubuntu 14....
Code Reuse a Peril for Secure Software Development
The amount of insecure software tied to reused third-party libraries and lingering in applications long after patches have been deployed is staggering. It’s a habitual problem perpetuated by developers failing to vet third-party code for vulnerabilities, and some repositories taking a hands-off...
GitLab 任意用户 authentication tokens 泄漏导致远程代码执行漏洞
漏洞分析参考： http://paper.seebug.org/104/ The project export feature serializes the user objects of team members and stores it in the project.json file. This object contains the authenticationtoken for every user, meaning that an attacker can simply go ahead and create a project on GitLab.com, add one...
Command injection
git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone...
How to Manage RAID Disk Allocation on NetScaler SDX 14000/15000/16000/25000/26000 Series Platforms
NetScaler SDX 14000, 15000,16000, 25000 and 26000 series of platforms support RAID managed by the software. Multiple disks provide not only performance gains, but also enhanced reliability. Reliability is especially important for a NetScaler SDX appliance, because the appliance hosts a large numb...
[SECURITY] Fedora 24 Update: pagure-2.3.4-1.fc24
Pagure is a light-weight git-centered forge based on pygit2. Currently, Pagure offers a web-interface for git repositories, a ticket system and possibilities to create new projects, fork existing ones and create/merge pull-requests across or within projects...
[SECURITY] Fedora 24 Update: pulp-2.8.6-1.fc24
Pulp provides replication, access, and accounting for software repositories...
GitLab: Ability to access all user authentication tokens, leads to RCE
Vulnerability details The project export feature serializes the user objects of team members and stores it in the project.json file. This object contains the authenticationtoken for every user, meaning that an attacker can simply go ahead and create a project on GitLab.com, add one of the admins ...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 add new repository proxy connectors via the token parameter to admin/addProxyConnectorcommit.action, 2 new...
CVE-2015-7611
Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors...
Design/Logic Flaw
Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors...
