CVE-2026-70357

The Gitea repository migration functionality is vulnerable to a Server-Side Request Forgery (SSRF) via DNS rebinding . While Gitea validates the migration hostname against network allow and block lists, the Git subprocess independently resolves the hostname during the Git clone operation . An att...

CVE-2026-70357 Gitea repository migration SSRF through DNS rebinding

Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently resolves the hostname when connecting. An attacker who can start a migration and control the destination's DNS can change the address between...

CVE-2026-70357 Gitea repository migration SSRF through DNS rebinding

Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently resolves the hostname when connecting. An attacker who can start a migration and control the destination's DNS can change the address between...

PT-2026-107186

Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently resolves the hostname when connecting. An attacker who can start a migration and control the destination's DNS can change the address between...

CVE-2024-32002

CVE-2024-32002: استغلال تنفيذ الأوامر عن بُعد في Git عبر git clone يحتوي هذا المستودع على إثبات مفهوم لاستغلال CVE-2024-32002، وهي ثغرة أمنية في Git تسمح بتنفيذ الأوامر عن بُعد أثناء عملية git clone. من خلال إنشاء مستودعات تحتوي على وحدات فرعية بطريقة محددة، يمكن للمهاجم استغلال معالجة الروابط...

CVE-2024-32002

CVE-2024-32002: Exploitation de la RCE de Git via git clone Ce dépôt contient un PoC pour l'exploitation de CVE-2024-32002, une vulnérabilité dans Git qui permet une RCE lors d'une opération git clone. En créant des dépôts avec des sous-modules d'une manière spécifique, un attaquant peut exploite...

CVE-2023-51385_test

Validation de CVE-2023-51385 Tout d'abord, ajoutez le contenu suivant dans /.ssh/config : host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Il existe une injection de commande dans la déclaration du fichier .gitmodules : url = ssh://echo helloworld...

git_rce

هجوم تنفيذ التعليمات البرمجية عن بُعد عبر git clone CVE-2024-32002 المساهمون 이정우@Roronoawjd شرح الخلفية هذه الثغرة هي ثغرة RCE Remote Code Execution تحدث عند استنساخ مستودع git يحتوي على وحدات فرعية في أنظمة ملفات لا تميز بين الأحرف الكبيرة والصغيرة مثل Windows و MacOS. RCE هي ثغرة تنفيذ تعليمات...

rcetest

CVE-2024-32002 : Exploitation d'une RCE Git via git clone Ce dépôt contient une preuve de concept PoC pour l'exploitation de CVE-2024-32002, une vulnérabilité dans Git qui permet une exécution de code à distance RCE lors d'une opération git clone. En créant des dépôts avec des sous-modules d'une...

SUSE SLES15 Security Update : ansible-core (SUSE-SU-2026:4154-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4154-1 advisory. - CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone bsc1272369. Tenable has extracted the...

Security update for ansible-core

This update for ansible-core fixes the following issues: CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone bsc1272369. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2026:4154-1 Security update for ansible-core

This update for ansible-core fixes the following issues: - CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone bsc1272369...

openSUSE 16 Security Update : ansible-core (openSUSE-SU-2026:21828-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21828-1 advisory. - CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone bsc1272369. Tenable has extracted the preceding...

Security update for ansible-core (important)

openSUSE security update: security update for ansible-core ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21828-1 Rating: important References: bsc1272369 Cross-References: CVE-2026-11332 CVE-2026-16493 CVSS scores: CVE-2026-11332 SUSE : 7.8...

SUSE-SU-2026:23724-1 Security update for ansible-core

This update for ansible-core fixes the following issues: - CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone bsc1272369...

OPENSUSE-SU-2026:21828-1 Security update for ansible-core

This update for ansible-core fixes the following issues: - CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone bsc1272369...

ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for CVE-2026-11332)

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for CVE-2026-11332)

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for CVE-2026-11332)

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: rubygem-bundler (UTSA-2024-005586)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-005586 advisory. Bundler is a package for managing application dependencies in Ruby. In bundler versions before 2.2.33, when working with untrusted and apparently harmless Gemfile's,...