CVE-2021-21300

CVE-2021-21300: Esecuzione di Codice Arbitrario tramite Git Hooks Maligni 📌 Riepilogo CVE-2021-21300 è una vulnerabilità critica in Git versioni dalla 2.14.2 alla 2.30.1 che consente agli attaccanti di eseguire codice arbitrario sulle macchine vittime sfruttando collegamenti simbolici e file syst...

CVE-2024-50379-POC

CVE-2024-50379 Exploitation und POC Dieses Repository enthält einen Proof of Concept POC für CVE-2024-50379 , eine Sicherheitslücke, die Apache Tomcat betrifft. Das Problem beinhaltet eine Time-of-Check-Time-of-Use TOCTOU Race-Condition , die zu Remote Code Execution RCE führen kann, insbesondere...

CVE-2024-32002

CVE-2024-32002: Explorando RCE no Git via git clone Este repositório contém um PoC para explorar a CVE-2024-32002, uma vulnerabilidade no Git que permite RCE durante uma operação git clone. Ao criar repositórios com submódulos de uma maneira específica, um atacante pode explorar o tratamento de...

CVE-2024-32002

CVE-2024-32002: Ausnutzung von Git RCE mittels git clone Dieses Repository enthält einen PoC zur Ausnutzung von CVE-2024-32002, einer Schwachstelle in Git, die RCE während eines git clone-Vorgangs ermöglicht. Durch das spezielle Erstellen von Repositories mit Submodulen kann ein Angreifer die...

rcetest

CVE-2024-32002: Sfruttare Git RCE tramite git clone Questo repository contiene un PoC per sfruttare CVE-2024-32002, una vulnerabilità in Git che consente RCE durante un'operazione git clone. Creando repository con sottomoduli in un modo specifico, un attaccante può sfruttare la gestione dei symli...

git_rce

Attacco di Remote Code Execution tramite git clone CVE-2024-32002 Contributore Jeongwoo Lee @Roronoawjd Contesto Questa vulnerabilità è una RCE Remote Code Execution che si verifica quando si clona un repository Git che contiene sottomoduli su file system che non fanno distinzione tra maiuscole e...

git_rce

CVE-2024-32002: Explorando RCE no Git via git clone Este repositório contém um PoC para explorar CVE-2024-32002, uma vulnerabilidade no Git que permite RCE durante uma operação git clone. Ao criar repositórios com submódulos de uma forma específica, um atacante pode explorar o tratamento de...

CVE-2021-21300

CVE-2021-21300 In diverse versioni di git, la gestione dei collegamenti simbolici non è rigorosa. Dopo aver caricato file su git da un filesystem case-sensitive ad esempio Linux, un host con filesystem case-insensitive ad esempio Windows che clona un repository malintenzionato può portare...

CVE-2024-32002-Reverse-Shell

CVE-2024-32002-Reverse-Shell Questo script dimostra come sfruttare la vulnerabilità CVE-2024-32002 per ottenere una reverse shell, fornendo accesso remoto al sistema affetto. Usatelo con cautela in ambienti controllati e solo a scopo educativo o di test di sicurezza. Pubblicazione del Blog Questo...

Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

Summary The default .htaccess shipped with Grav and the reference webserver-configs/htaccess.txt contains security rules that block direct HTTP access to sensitive file types .yaml, .yml, .php, .json, .twig, etc. under user/ and system/vendor/ directories. However, these rules lack the NC No Case...

GHSA-VWG3-W8W3-PC79 Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

Summary The default .htaccess shipped with Grav and the reference webserver-configs/htaccess.txt contains security rules that block direct HTTP access to sensitive file types .yaml, .yml, .php, .json, .twig, etc. under user/ and system/vendor/ directories. However, these rules lack the NC No Case...

CVE-2026-62673 Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache NC flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester ca...

CVE-2026-72836

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...

CVE-2026-72836

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...

PT-2026-72005

Name of the Vulnerable Software and Affected Versions FileBrowser versions prior to 2.63.19 Description An issue exists when the software is hosted on a case-insensitive filesystem, such as Windows/NTFS, and both Signup and CreateUserDir are enabled. The system fails to account for...

CVE-2026-54528

A flaw was found in JupyterLab Git, a Git extension for JupyterLab. This vulnerability allows an authenticated user on a case-insensitive filesystem to bypass administrator-configured excluded paths by varying the case of the URL path segment. This bypass enables the user to read file content, vi...

CVE-2026-54528

Summary of vulnerability (CVE-2026-54528): The jupyterlab-git extension for JupyterLab is affected prior to version 0.54.0. On case-insensitive filesystems (e.g., macOS APFS, Windows NTFS), the code path that enforces excluded_paths uses fnmatch.fnmatchcase(), which is case-sensitive and can be b...

GHSA-436Q-JWFR-RM2H jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

Summary jupyterlab-git 0.53.0 latest, 2026-04-30 uses fnmatch.fnmatchcase in GitHandler.prepare jupyterlabgit/handlers.py:91 to enforce the admin-configured excludedpaths security control. Because fnmatchcase is unconditionally case-sensitive, an authenticated user on a case-insensitive filesyste...

Security Bulletin:DevOps Test Embedded for Eclipse IDE is vulnerable to XXE injection & RCE due to use of JGit and EGit ( CVE-2023-4759 and CVE-2025-4949)

Summary Due to the use of JGit and EGit, DevOps Test Embedded for Eclipse contains vulnerabilities that could lead to unauthorized file access via XML External Entity XXE injection, and arbitrary file overwrites on case-insensitive filesystems that can lead to Remote Code Execution RCE. This only...

CVE-2026-23903

Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users are recommended to upgrade to version 2.0.7, which fixes the issue. The issue only effects static files. If static files are served from a case-insensitive filesystem, such ...