yolo-cage

yolo-cage: автономные агенты кодирования, которые не причиняют вреда Вы ответственный инженер. Вы бы ни за что не позволили ИИ безнаказанно хозяйничать в ваших самых чувствительных системах и кодовых базах. Именно поэтому вы никогда не отключаете защиту для такого инструмента, как Claude Code. Он...

cve-2024-32002-poc

💥 CVE-2024-32002 – PoC внедрения пути Git подмодуля Мотивация При решении машины Compiled на платформе Hack The Box я столкнулся с любопытным поведением, связанным с Git и подмодулями. При более глубоком исследовании я нашел эту отличную статью исследователя Амала Мурали, в которой подробно...

CVE-2018-11235

CVE-2018-11235 1. Подключитесь по ssh к вашему VPS. 2. Склонируйте этот репозиторий: git clone https://github.com/Rezy-Dev/CVE-2018-11235 cd CVE-2018-11235 3. Дайте exploit.sh права на выполнение x, затем запустите его: sudo chmod +x exploit.sh sudo ./exploit.sh Это загрузит apache2 и создаст...

CVE-2024-32002

CVE-2024-32002 1. Отредактируйте файл exploit.sh замените репозитории 2. запустите bash exploit.sh exploit.sh Вдохновлено - https://github.com/safebuffer/CVE-2024-32002 Сделано для CTF Уязвимые версии v2.45.0 v2.44.0 =v2.43.3 =v2.42.1 v2.41.0 =v2.40.1 =v2.39.3 Источник...

CVE-2023-51385_test

Проверка CVE-2023-51385 Сначала необходимо добавить в /.ssh/config следующее содержимое host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p В файле .gitmodules в операторе присутствует внедрение команд url = ssh://echo helloworld cve.txtfoo.example.com/bar После настройк...

CVE-2020-27955

Воспроизведение уязвимости CVE-2020-27955 1、На машине с Windows скачайте уязвимую версию Git-LFS Ссылка для загрузки: https://github.com/git-for-windows/git/releases/tag/v2.29.2.windows.1 2、На машине с Windows установите и добавьте в файл hosts следующую запись: 10.1.1.5 — это хост, на котором nc...

CVE-2020-27955-LFS-main

Git-lfs эксплойт удалённого выполнения кода RCE CVE-2020-27955 .bat / powershell версия Уязвимы: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken и др. Обнаружено Dawid Golunski https://legalhackers.com https://exploitbox.io Протестировано на Windows на: git...

BIT-PARSE-2021-47987 Parse Server - Arbitrary Code Execution via Malicious Version Tags

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with write access. No releases were published with these tags; a project was exposed only if it define...

CVE-2026-32604

CVE-2026-32604 - Spinnaker GitRepo 아티팩트 RCE CVE-2026-32604 - git/repo 아티팩트 유형을 통한 Spinnaker의 원격 코드 실행. 이것은 Spinnaker의 GitRepo 아티팩트 처리에서 발생하는 명령 주입 / 원격 코드 실행 취약점입니다. 취약한 기능은 git/repo 아티팩트의 version 필드를 통해 사용자가 제어하는 값이 적절히 정제되지 않은 채 명령 실행에 도달할 수 있도록 합니다. 취약한 엔드포인트는 다음과 같습니다: PUT /artifacts/fetch 중요...

OESA-2026-4069 git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: Processing an incomplete post-handshake message for a QUIC connection can cause a...

OESA-2026-4068 git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: Processing an incomplete post-handshake message for a QUIC connection can cause a...

OESA-2026-4067 git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: Processing an incomplete post-handshake message for a QUIC connection can cause a...

PT-2026-99007

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with write access. No releases were published with these tags; a project was exposed only if it define...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124495)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124495 advisory. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124485)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124485 advisory. If the PATH environment variable contains paths which are executables rather than just directories, passing certain strings to LookPath , ., and .., can result in th...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124492)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124492 advisory. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124486)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124486 advisory. When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information the ALPN protocols sent by the client which is not escaped...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124475)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124475 advisory. When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124473)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124473 advisory. Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion. Tenable has extracted the preceding description block...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124477)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124477 advisory. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. Tenable has extracted the preceding...