11290 matches found
Malicious code in git-pl (npm)
The package git-pl was found to contain malicious code...
Malicious code in react-airbnb-prettier (npm)
The package react-airbnb-prettier was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 8dfaae080b90705a47740e1ced1edacf0110db947f0f26fdd35e2805a2886d37 This package installs a dependency hosted on a custom domain that...
MAL-2025-21456 Malicious code in git-ocr (npm)
The package git-ocr was found to contain malicious code...
MAL-2025-21454 Malicious code in git-lg (npm)
The package git-lg was found to contain malicious code...
MAL-2025-21458 Malicious code in git-ps (npm)
The package git-ps was found to contain malicious code...
MAL-2025-21457 Malicious code in git-pl (npm)
The package git-pl was found to contain malicious code...
MAL-2025-26779 Malicious code in mozaik-ext-git (npm)
The package mozaik-ext-git was found to contain malicious code...
git: Fix of CVE-2025-46835
CVE-2025-46835: fix vulnerability where Git GUI can create and overwrite arbitrary writable files...
CLSA-2025-1755184971 git: Fix of CVE-2025-46835
CVE-2025-46835: fix vulnerability where Git GUI can create and overwrite arbitrary writable files...
Oracle Linux 7 : git (ELSA-2025-11688)
The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-11688 advisory. 1.8.3.1-25.0.1 - Fixed CVE-2025-48384 Orabug: 38234220 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...
m00nl1ght-dev/steam-workshop-deploy: Exposure of Version-Control Repository to an Unauthorized Control Sphere and Insufficiently Protected Credentials
Summary The steam-workshop-deploy github action does not exclude the .git directory when packaging content for deployment and provides no built-in way to do so. If a .git folder exists in the target directory e.g., due to a local Git repo, custom project structure, or via the actions/checkout...
GHSA-X6GV-2RVH-QMP6 m00nl1ght-dev/steam-workshop-deploy: Exposure of Version-Control Repository to an Unauthorized Control Sphere and Insufficiently Protected Credentials
Summary The steam-workshop-deploy github action does not exclude the .git directory when packaging content for deployment and provides no built-in way to do so. If a .git folder exists in the target directory e.g., due to a local Git repo, custom project structure, or via the actions/checkout...
Heap-based Buffer Overflow
Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the ReadOneJNGImage function. An attacker can access data on the heap or cause memory corruption by tricking a user into processing a specially crafted image file. Remediation A fix was pushed into the...
Sensitive Data Exposure
@finos/git-proxy is vulnerable to sensitive data exposure. The vulnerability is due to improper validation of commits in the pack sent to GitHub, which allows an attacker to inject unreferenced commits containing sensitive data and retrieve them via direct commit URLs without appearing in the...
Improper Authorization
@finos/git-proxy is vulnerable to Improper Authorization. The vulnerability is due to improper validation of branch creation workflows due to the way GitProxy handles new branch creation, allowing attackers to bypass approval of prior commits on the parent branch...
Malicious File Parsing
@finos/git-proxy is vulnerable to malicious file parsing. The vulnerability is due to improper PACK signature detection in parsePush.ts, which allows an attacker to embed misleading signatures in commit content and craft packet structures to bypass approval or hide commits...
PT-2025-34541 · Github Actions · Boldestdungeon/Steam-Workshop-Deploy +1
Summary The steam-workshop-deploy github action does not exclude the .git directory when packaging content for deployment and provides no built-in way to do so. If a .git folder exists in the target directory e.g., due to a local Git repo, custom project structure, or via the actions/checkout...
CLSA-2025-1755008210 git: Fix of CVE-2025-46835
CVE-2025-46835: fix vulnerability where Git GUI can create and overwrite arbitrary writable files...
