CVE-2022-21223 Command Injection

The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function when using hg, the url and/or revision, tag, branch is passed to the hg clone command in a way that additional flags can be set. The additional flags can...

CVE-2022-21223

CVE-2022-21223 affects cocoapods-downloader prior to 1.6.2. The flaw is a Command Injection in the download path when using hg, where the URL and/or revision/branch are passed to the hg clone command, allowing extra flags to be injected. Affected component: cocoapods-downloader (Ruby gem). Root c...

CVE-2022-24440

CVE-2022-24440 affects cocoapods-downloader: versions before 1.6.0, and 1.6.2 and before 1.6.3, are vulnerable to Command Injection via git argument injection in Pod::Downloader.preprocess_options, where git and branch are passed to git ls-remote enabling extra flags for injection. This could all...

CVE-2022-24440 Command Injection

The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocessoptions function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a...

CVE-2022-24440

The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocessoptions function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a...

CVE-2022-24440 Command Injection

The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocessoptions function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a...

CVE-2022-24440

The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocessoptions function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a...

CVE-2022-21223

The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function when using hg, the url and/or revision, tag, branch is passed to the hg clone command in a way that additional flags can be set. The additional flags can...

CVE-2022-24440: Improper Neutralization of Argument Delimiters in a Command

The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocessoptions function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a...

cocoapods-downloader 参数注入漏洞

cocoapods-downloader is a small library. It is used to download files from remotes in folders. A security vulnerability exists in cocoapods-downloader, which stems from git parameter injection. The following products and versions are affected: versions prior to 1.6.0, versions prior to 1.6.2, and...

PT-2022-16698

Name of the Vulnerable Software and Affected Versions cocoapods-downloader versions prior to 1.6.0 cocoapods-downloader versions 1.6.2 through 1.6.3 Description The issue concerns Command Injection via git argument injection. When the Pod::Downloader.preprocess options function is called and git ...

CVE-2022-21223: Improper Neutralization of Argument Delimiters in a Command

The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function when using hg, the url and/or revision, tag, branch is passed to the hg clone command in a way that additional flags can be set. The additional flags can...

cocoapods-downloader 参数注入漏洞

cocoapods-downloader is a small library. It is used to download files from remote controls in folders. cocoapods-downloader versions prior to 1.6.2 have a security vulnerability that stems from the presence of command injection in the hg parameter. An attacker calling the download function could...

PT-2022-14934

Name of the Vulnerable Software and Affected Versions cocoapods-downloader versions prior to 1.6.2 Description The issue allows for Command Injection via hg argument injection. When the download function is called using hg, the url and/or revision, tag, branch are passed to the hg clone command i...

Server-Side Request Forgery (SSRF)

Description youtube-downloader takes an URL from the url query parameter, passes it directly to curl and streams the response to the browser. This makes it vulnerable to an SSRF attack if someone passes an URL containing an internal hostname, as it will stream internal resources to the browser...

Command Injection

Overview cocoapods-downloader is an A small library for downloading files from remotes in a folder. Affected versions of this package are vulnerable to Command Injection via hg argument injection. When calling the download function when using hg, the url and/or revision, tag, branch is passed to...

Command Injection

Overview cocoapods-downloader is an A small library for downloading files from remotes in a folder. Affected versions of this package are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocessoptions function and using git, both the git and branch...

WordPress All in One Video Downloader plugin <= 1.0.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress All in One Video Downloader plugin versions = 1.0.2. Solution No patched version available...

WordPress All in One Video Downloader plugin <= 1.0.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress All in One Video Downloader plugin versions = 1.0.2. Solution No patched version available...

DDoS IRC Bot Malware Spreading Through Korean WebHard Platforms

An IRC Internet Relay Chat bot strain programmed in GoLang is being used to launch distributed denial-of-service DDoS attacks targeting users in Korea. "The malware is being distributed under the guise of adult games," researchers from AhnLab's Security Emergency-response Center ASEC said in a ne...