Man-In-The-Middle (MITM)

rust is vulnerable to Man-In-The-Middle MITM attacks. An attacker is able to perform man-in-the-middle MITM attacks because the library does not perform SSH host key verification when cloning indexes and dependencies via SSH...

CVE-2022-41953

Git GUI is a convenient graphical tool that comes with Git for Windows. Its target audience is users who are uncomfortable with using Git on the command-line. Git GUI has a function to clone repositories. Immediately after the local clone is available, Git GUI will automatically post-process it,...

CVE-2022-41953

CVE-2022-41953 affects Git GUI (Git for Windows). When cloning a repository with Git GUI, post-processing may run a spell checker binary named aspell.exe from the repository’s top-level directory due to Tcl on Windows searching the current directory first. If a malicious repo ships a crafted aspe...

CVE-2022-41953 Git clone remote code execution vulnerability in git-for-windows

Git GUI is a convenient graphical tool that comes with Git for Windows. Its target audience is users who are uncomfortable with using Git on the command-line. Git GUI has a function to clone repositories. Immediately after the local clone is available, Git GUI will automatically post-process it,...

PT-2023-1314

Name of the Vulnerable Software and Affected Versions Git GUI versions prior to 2.39.1 Description The issue is related to the Git GUI's function to clone repositories. Due to the design of Tcl on Windows, the search path for executables includes the current directory. This allows malicious...

CVE-2022-41953: Untrusted Search Path

Git GUI is a convenient graphical tool that comes with Git for Windows. Its target audience is users who are uncomfortable with using Git on the command-line. Git GUI has a function to clone repositories. Immediately after the local clone is available, Git GUI will automatically post-process it,...

isomorphic-git: Directory traversal via a crafted repository

A flaw was found in isomorphic-git. An attacker could cause a Directory Traversal via a crafted filepath in a repository being cloned...

PT-2023-1358

Name of the Vulnerable Software and Affected Versions Rust versions prior to 1.66.1 Description The issue is related to the Cargo package manager in Rust, which does not perform SSH host key verification when cloning indexes and dependencies via SSH. This allows an attacker to perform...

PT-2022-6465 · Rittal · Rittal Cmc Pu Iii

Name of the Vulnerable Software and Affected Versions: Rittal CMC III affected versions not specified Description: The issue is related to inadequate access control in the Rittal CMC III central control unit, which can be exploited by an attacker to gain unauthorized access to protected informati...

In Escher721Factory.createContract any address can be provided as _uri for cloning

Lines of code Vulnerability details Impact The Escher721Factory.createContract function accepts any address as the uri parameter. This parameter is used to clone the uri contract, the address of the new clone is then passed to the Escher721.initialize function. The contract should verify the...

GSD-2022-1007755 btrfs: zoned: clone zoned device info when cloning a device

btrfs: zoned: clone zoned device info when cloning a device This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.9 by commit...

PT-2022-34930 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.6 Description: The issue is related to the drbd component, where it only clones bio if a backing device is present. The actual impact and attack plausibility have not yet been proven. Recommendations: For...

fastest-json-copy 安全漏洞

fastest-json-copy is a library by Vadim Dalecky personal developer . It is used for JSON deep cloning implementations. A security vulnerability exists in fastest-json-copy version 1.0.1, which stems from an application not properly validating incoming JSON keys...

CVE-2022-39253

Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone where the source and target of the clone...

CVE-2022-39253 Git subject to exposure of sensitive information via local clone of symbolic links

Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone where the source and target of the clone...

CVE-2022-3283

A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 While cloning an issue with special crafted content added to the description could have been used ...

CVE-2022-3283: Uncontrolled Resource Consumption

A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 While cloning an issue with special crafted content added to the description could have been used ...

Prilex: the pricey prickle credit card complex

Prilex is a Brazilian threat actor that has evolved out of ATM-focused malware into modular point-of-sale malware. The group was behind one of the largest attacks on ATMs in the country, infecting and jackpotting more than 1,000 machines, while also cloning in excess of 28,000 credit cards that...

GSD-2022-1004591 netfilter: nft_set_pipapo: release elements in clone from abort path

netfilter: nftsetpipapo: release elements in clone from abort path This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.130 by commit...

Threat Source newsletter (June 30, 2022) — AI voice cloning is somehow more scary than deepfake videos

By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. We took a week off for summer vacation but are back in the thick of security things now. My first exposure to deepfake videos was when Jordan Peele worked with BuzzFeed News to produce this video of... This is only th...