11323 matches found
Denial of Service (DoS)
Overview pacote is a JavaScript package downloader Affected versions of this package are vulnerable to Denial of Service DoS via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement an...
Arbitrary Code Execution
github.com/github/git-sizer is vulnerable to Arbitrary Code Execution. The vulnerability is due to the misconfiguration of the system's PATH environment variable, which can allow malicious executables to be inadvertently run when commands are executed if the current directory is placed before the...
MAL-2024-12303 Malicious code in maliciouspackage (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 d0e8a8d581266436f0546b5039ee82ab734d45f8489e281322dd871124dad9ce Clearly a demo malicious package, attempting to exfiltrate a token from the git config --- Category: PROBABLYPENTEST - Packages looking like typical pentest...
Malicious code in maliciouspackage (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 d0e8a8d581266436f0546b5039ee82ab734d45f8489e281322dd871124dad9ce Clearly a demo malicious package, attempting to exfiltrate a token from the git config --- Category: PROBABLYPENTEST - Packages looking like typical pentest...
Arbitrary Argument Injection
ggit is vulnerable to Arbitrary Argument Injection. The vulnerability is due to the failure to sanitize user input and improper handling of command-line flags and doesn't validate the URL scheme or properly pass arguments to the git binary using the necessary -- POSIX characters, allowing attacke...
The vulnerability of AI software platforms based on Git for collaborative code development on GitLab allows attackers to compromise data integrity.
The vulnerability of AI-based software platforms built on Git for collaborative code development on GitLab is related to the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows a malicious actor to compromise the integrity of data...
The vulnerability of the application programming interface of the software platform based on Git for collaborative code development on GitLab allows a perpetrator to trigger a service failure.
The vulnerability of the application programming interface of a Git-based software platform for collaborative code development on GitLab is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...
@belym.a.2105/publish-please (>=2.4.0-alpha.0, <=2.4.1), @digitalnative/standard-protocol-sdk (>=0.0.190, <=0.0.195) +48 more potentially affected by CVE-2024-21533 via ggit (>=2.0.0, <=2.4.12)
ggit NPM version =2.0.0, =2.4.0-alpha.0, =0.0.190, =1.1.2, =0.1.0, =4.1.6, =0.1.0, =0.1.0, =0.0.1, =1.7.3, =1.0.0, =0.13.4, =1.9.1, =1.0.0, =1.21.0, =1.23.3 and more Source cves: CVE-2024-21533 Source advisory: OSV:GHSA-PR45-CG4X-FF4M...
GHSA-62CX-5XJ4-WFM4 ggit is vulnerable to Command Injection via the fetchTags(branch) API
All versions of the package ggit are vulnerable to Command Injection via the fetchTagsbranch API, which allows user input to specify the branch to be fetched and then concatenates this string along with a git command which is then passed to the unsafe exec Node.js child process API...
CVE-2024-21533
All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone API, which allows specifying the remote URL to clone and the file on disk to clone to. The library does not sanitize for user input or validate a given URL scheme, nor does it properly pass command-line...
CVE-2024-21533
All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone API, which allows specifying the remote URL to clone and the file on disk to clone to. The library does not sanitize for user input or validate a given URL scheme, nor does it properly pass command-line...
CVE-2024-21533
All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone API, which allows specifying the remote URL to clone and the file on disk to clone to. The library does not sanitize for user input or validate a given URL scheme, nor does it properly pass command-line...
CVE-2024-21533
GGIT is affected across all versions by Arbitrary Argument Injection via the clone() API. The root cause is failure to sanitize user input and validate URL schemes, plus improper handling of git command-line flags (using -- to end options). Public details include a PoC from Snyk and a GitHub gist...
RHSA-2024:7701 Red Hat Security Advisory: git security update
Bulletin has no description...
Command Injection
git-shallow-clone is vulnerable to Command injection. The vulnerability is due to missing sanitization or mitigation flags in the process variable of the gitShallowClone function. which allows malicious inputs to be executed as system commands...
git: RCE while cloning local repos
A vulnerability was found in Git. This vulnerability can be exploited by an unauthenticated attacker who places a specialized repository on the target's local system. If the victim clones this repository, the attacker can execute arbitrary code...
Important: Red Hat Security Advisory: git security update
An update for git is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...
RHEL 8 : git (RHSA-2024:7701)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:7701 advisory. Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-serve...
GHSA-FM76-W8JW-XF8M @saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plugins using git source
Summary When creating a new plugin using the git source, the user-controlled value req.body.name is used to build the plugin directory where the location will be cloned. The API used to execute the git clone command with the user-controlled data is childprocess.execSync. Since the user-controlled...