503 matches found
CVE-2025-31722
CVE-2025-31722 — RCE su Jenkins Templating Engine Solo a scopo didattico e di ricerca sulla sicurezza autorizzata. Descrizione Vulnerabilità di bypass della sandbox nel plugin Jenkins Templating Engine JTE = 2.5.3 che consente a un utente con privilegi bassi di eseguire codice arbitrario sul serv...
CVE-2025-64424-Coolify-
Coolify CVE-2025-64424 RCE Vulnerability Lab Piano di lezione: Red74-Coolio-CVE-2025-64424 Disclaimer: Questo repository contiene una versione deliberatamente vulnerabile di Coolify ed è destinato a scopi educativi, ambienti CTF e formazione sulla cybersecurity. Non distribuirlo in un ambiente di...
DiffCatcher
Supporta lo Sviluppo Se questo progetto aiuta il tuo lavoro, supporta la manutenzione continua e le nuove funzionalità. Portafoglio per Donazioni ETH 0x11282eE5726B3370c8B480e321b3B2aA13686582 Scansiona il QR code o copia l'indirizzo del portafoglio sopra. Uno strumento CLI in Rust che scopre...
bash-cve-2014-6271-fixes
CVE-2014-6271 patches per bash Il post originale sulla mailing list consente di scaricare le patch solo tramite HTTP non autenticato. Sigh Ho scaricato queste patch via HTTP e le ho inserite in un repository git che puoi recuperare via HTTPS e verificare in modo indipendente. Non ho verificato se...
trivy v0.75.0
📖 Documentation Trivy pronunciation is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues. Targets what Trivy can scan: Container Image Filesystem Git Repository remote Virtual Machine Image Kubernetes...
[SECURITY] Fedora 45 Update: GitPython-3.1.62-1.fc45
GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...
CVE-2026-91773 Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks
Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames...
[SECURITY] Fedora 44 Update: GitPython-3.1.62-1.fc44
GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...
CVE-2026-85674
aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...
CVE-2026-85674 aider 0.86.2 Remote Code Execution via .aider.conf.yml
aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...
[SECURITY] Fedora 44 Update: GitPython-3.1.60-1.fc44
GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...
[SECURITY] Fedora 43 Update: GitPython-3.1.59-1.fc43
GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...
CVE-2026-44517
Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left ...
CVE-2026-44517
Buildah (OCI image building tool) versions 1.38.1 through 1.43.2 and 1.44.0 are vulnerable to a build context breakout . The root cause is that TempDirForURL in define/types.go fails to securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory/stdinTo...
CVE-2026-44517
Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left ...
CVE-2026-44517 Buildah: Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive
Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left ...
CVE-2026-44517: Improper Limitation of a Pathname to a Restricted Directory
Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left ...
CVE-2026-76222
GitPython (versions before 3.1.58) fails to sanitize submodule names read from .gitmodules files, enabling path traversal during submodule initialization. An attacker can craft a malicious repository with traversal sequences (e.g., ../) in submodule names, causing GitPython to create attacker-con...