Security update for git (moderate)

openSUSE Security Update: Security update for git Announcement ID: openSUSE-SU-2020:0598-1 Rating: moderate References: 1063412 1095218 1095219 1110949 1112230 1114225 1132350 1149792 1156651 1158785 1158787 1158788 1158789 1158790 1158791 1158792 1158793 1158795 1167890 1168930 1169605 1169786...

Duplicate Page and Post < 2.5.7 & WP Post Page Clone < 1.1 - SQL Injections due to Duplicated Snippets

SQL Injections in the Duplicate Post, WP Post Page Clone, Duplicate Page and Post plugins, due to using the snippet piece of code. The issue in the duplicate-post was already added, at https://wpvulndb.com/vulnerabilities/9251...

WordPress WP Post Page Clone plugin <= 1.0 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability found by Antony Garand Sucuri in WordPress WP Post Page Clone plugin versions = 1.0. Solution Update the WordPress WP Post Page Clone plugin to the latest available version at least 1.1...

CVE-2020-11008

Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260GHSA-qm7j-c969-7j4q. The fix for that bug still left the door open for an exploit where some credential is leaked but...

CVE-2020-11008

Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260GHSA-qm7j-c969-7j4q. The fix for that bug still left the door open for an exploit where some credential is leaked but...

GitLab: Injection of `http.<url>.*` git config settings leading to SSRF

Summary When import a repo with credentials via a URL, gitaly generates the git clone command with a -c flag to add the Authorization header: https://gitlab.com/gitlab-org/gitaly/-/blob/master/internal/service/repository/createfromurl.goL37 go flags = appendflags, git.ValueFlagName: "-c", Value:...

CVE-2020-11008: Improper Input Validation

Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260GHSA-qm7j-c969-7j4q. The fix for that bug still left the door open for an exploit where some credential is leaked but...

PT-2020-2070

Name of the Vulnerable Software and Affected Versions Git versions prior to 2.26.2 Git versions prior to 2.25.4 Git versions prior to 2.24.3 Git versions prior to 2.23.3 Git versions prior to 2.22.4 Git versions prior to 2.21.3 Git versions prior to 2.20.4 Git versions prior to 2.19.5 Git version...

How to enable Fast Clone functionality with Veeam Availability for Nutanix Mine

End-of-Life Product Nutanix Mine with Veeam reached End-of-Life on 2026-04-30. As of this date, all support services for this product are unavailable. For more information, see the Nutanix EOL Announcement Bulletin - Nutanix Mine, released 2025-04-30. Challenge Fast Clone is the Veeam Backup &...

CVE-2020-5260

Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system...

CVE-2020-11673

An issue was discovered in the Responsive Poll through 1.3.4 for Wordpress. It allows an unauthenticated user to manipulate polls, e.g., delete, clone, or view a hidden poll. This is due to the usage of the callback wpajaxnopriv function in Includes/Total-Soft-Poll-Ajax.php for sensitive operatio...

Denial Of Service (DoS)

kernel is vulnerable to denial of service. A deficiency in the clone system call when called with the CLONEPARENT flag permits the caller the parent process to indicate an arbitrary signal it wants to receive when its child process exits. This could lead to a denial of service of the parent proce...

Microsoft VSCode Python Extension - Code Execution Exploit

VSCode Python Extension Code Execution This repository contains the Proof-of-Concept of a code execution vulnerability discovered in the Visual Studio Code Python extension. TL;DR: VScode may use code from a virtualenv found in the project folders without asking the user, for things such as...

Manually moving backup files between Scale-Out Backup Repository extents

Extent Rebalance is Now Built-In to Veeam Backup & Replication This article was written prior to the release of Veeam Backup & Replication 12. While the procedure may still work in Veeam Backup & Replication 12 and higher, we strongly advise you to instead consider using the built-in rebalancing...

[SECURITY] Fedora 31 Update: nodejs-mixin-deep-1.3.2-1.fc31

Deeply mix the properties of objects into the first object. Like merge-deep, but doesn't clone...

git: arbitrary code execution via .gitmodules

An option injection flaw has been discovered in git when it recursively clones a repository with sub-modules. A remote attacker may configure a malicious repository and trick a user into recursively cloning it, thus executing arbitrary commands on the victim's machine...

CVE-2013-4583

Removed by vendor...

PT-2020-7505

Name of the Vulnerable Software and Affected Versions: GitLab versions 5.0 through 5.4.2 GitLab Community Edition versions 5.0 through 6.2.4 GitLab Enterprise Edition versions 5.0 through 6.2.1 gitlab-shell versions prior to 1.7.8 Description: The issue allows remote authenticated users to gain...

CVE-2013-4583: Improper Privilege Management

The parsecmd function in lib/gitlabshell.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote authenticated users to gain privileges and clone arbitrary repositories...

Node.js third-party modules: [klona] Prototype pollution

I would like to report Prototype pollution in klona It allows adding arbitrary property to Prototype while deep cloning an object Module module name: klona version: Hunter's comments and funny memes goes here F690469 Impact Denial of Service and possible Remote code execution by overriding object...