OS Command Injection

git-diff-apply is vulnerable to OS command injection. Lack of validation and sanitization of the remoteUrl parameter allows an attacker to inject arbitrary OS command via the affected parameter that is subsequently used in utils.run as a git command...

CVE-2019-10776

In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2...

CVE-2019-10776

In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2...

CVE-2019-10776

CVE-2019-10776 affects the package git-diff-apply prior to v0.22.2. The vulnerability stems from unvalidated input in index.js where a run() command is constructed from a user-controlled remoteUrl, enabling OS command injection. Impact could include remote code execution if untrusted input is sup...

@choiceform/ui-foundation (>=0.16.3, <=0.16.6), @gulpjs/update-template (0.1.0) +15 more potentially affected by CVE-2019-10776 via git-diff-apply (>=0.0.5, <=0.22.1)

git-diff-apply NPM version =0.0.5, =0.16.3, =0.1.0, =0.1.0, =0.8.0, =0.1.9, =0.0.1, =0.7.1, =0.2.2, =0.2.3 - ember-precondition 0.2.0 - ember-promise-helpers 1.0.8 and more Source cves: CVE-2019-10776 Source advisory: MEND:CVE-2019-10776...

CVE-2019-10776

In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2...

CVE-2019-10776: Improper Neutralization of Special Elements used in an OS Command

In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2...

PT-2020-9128

Name of the Vulnerable Software and Affected Versions git-diff-apply versions prior to 0.22.2 Description The issue arises from the execution of the git command with a user-controlled variable called remoteUrl in the "index.js" file. This allows for potential exploitation. Recommendations For...

@choiceform/ui-foundation (>=0.16.3, <=0.16.6), @gulpjs/update-template (0.1.0) +15 more potentially affected by CVE-2019-10776 via git-diff-apply (>=0.0.5, <=0.22.1)

git-diff-apply NPM version =0.0.5, =0.16.3, =0.1.0, =0.1.0, =0.8.0, =0.1.9, =0.0.1, =0.7.1, =0.2.2, =0.2.3 - ember-precondition 0.2.0 - ember-promise-helpers 1.0.8 and more Source cves: CVE-2019-10776 Source advisory: SNYK:JS-GITDIFFAPPLY-540774...

Command Injection

Overview git-diff-apply is a package that can be used to reach an unrelated remote repository to apply a git diff. Affected versions of this package are vulnerable to Command Injection. In "index.js" file, line 240, the run command executes the git command with an user controlled variable called...

patch: OS shell command injection when processing crafted patch files

A flaw was found in GNU patch through version 2.7.6. An ed-style diff payload patch file with shell metacharacters can be used to inject OS shell commands into a system. The ed editor does not need to be present on the vulnerable system for this attack to function. The highest threat from this...

Regular Expression Denial Of Service (ReDoS)

diff is vulnerable to regular expression denial of service ReDoS. The vulnerability exists due to improper use of regular expression to parse data from the fileHeader parameter in parseFileHeader, allowing an attacker to cause a denial of service condition by submitting a malicious file header...

EulerOS 2.0 SP5 : patch (EulerOS-SA-2019-2219)

According to the versions of the patch package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - doedscript in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the same commit as for...

Important: Red Hat Security Advisory: patch security update

An update for patch is now available for Red Hat Enterprise Linux 7.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Important: Red Hat Security Advisory: patch security update

An update for patch is now available for Red Hat Enterprise Linux 7.5 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

DEBIAN-CVE-2019-12094

Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...

UBUNTU-CVE-2019-12094

Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...

CentOS Update for patch CESA-2019:2964 centos7

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS 7 : patch (CESA-2019:2964)

An update for patch is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2019-13638

A flaw was found in GNU patch through version 2.7.6. An ed-style diff payload patch file with shell metacharacters can be used to inject OS shell commands into a system. The ed editor does not need to be present on the vulnerable system for this attack to function. The highest threat from this...