CVE-2024-6886

A flaw was found in Gitea. This issue may allow cross-site scripting XSS due to improper input sanitization, which can allow an attacker to inject a malicious script into web pages viewed by other users. Mitigation Red Hat has investigated whether a possible mitigation exists for this issue, and...

Gitea Cross-site Scripting Vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0...

CVE-2024-6886 Inproper Sanitation of field leading to stored XSS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0...

CVE-2024-6886 Inproper Sanitation of field leading to stored XSS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0...

CVE-2024-6886

Summary: CVE-2024-6886 is a stored XSS vulnerability in Gitea 1.22.0 that allows authenticated attackers to inject JavaScript via repository descriptions, which is stored on the server and executed in other users’ sessions. The Nuclei template, Exploit-DB entry, and OSV entries confirm the issue ...

CVE-2024-6886 Inproper Sanitation of field leading to stored XSS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0...

CBL Mariner 2.0 Security Update: terraform (CVE-2024-6257)

The version of terraform installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-6257 advisory. - HashiCorp's go-getter library can be coerced into executing Git update on an existing maliciously modified...

Security Bulletin: IBM Storage Ceph is vulnerable to OS Command Injection in Grafana (CVE-2022-25912, CVE-2022-25860, CVE-2022-25908)

Summary Simple Git is used by IBM Storage Ceph in Grafana for Metrics. This bulletin identifies the steps to take to address the vulnerability in IBM Storage Ceph. CVE-2022-25912, CVE-2022-25860, CVE-2022-25908. Vulnerability Details CVEID:CVE-2022-25912 DESCRIPTION: Node.js simple-git module cou...

HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation

...

Exploit for Heap-based Buffer Overflow in Microsoft

Firebeam CVE-2024-26229 plugin A small firebeam kaine's risc...

soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests

Impact Any servers using soft-serve server and git Patches 0.7.5 Workarounds None. References n/a. --- It is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve passes all...

GHSA-M445-W3XR-VP2F soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests

Impact Any servers using soft-serve server and git Patches 0.7.5 Workarounds None. References n/a. --- It is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve passes all...

CVE-2024-41956

Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve passes all environment variables given by...

CVE-2024-41956 Soft Serve allows arbitrary code execution by crafting git-lfs requests

Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve passes all environment variables given by...

CVE-2024-41956 Soft Serve allows arbitrary code execution by crafting git-lfs requests

Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve passes all environment variables given by...

CVE-2024-41956 Soft Serve allows arbitrary code execution by crafting git-lfs requests

Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve passes all environment variables given by...

CVE-2024-41956

The CVE-2024-41956 issue affects Soft Serve (a self-hostable Git server). It allows an attacker who can commit to a repository to execute arbitrary code by abusing environment variables passed to git subprocesses (notably LD_PRELOAD). This is possible because the server forwards client-provided e...

Soft Serve 安全漏洞

Soft Serve is a self-hostable command-line Git server from Charm Open Source. A security vulnerability exists in Soft Serve versions prior to 0.7.5 that stems from improper handling of environment variables. Users could execute arbitrary code via environment manipulation and Git while committing...

soft-serve -- Remote code execution vulnerability

soft-serve team reports: Arbitrary code execution by crafting git ssh requests It is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git...

Malicious code in kekepaketti-git (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fe3fe591280b7e540d3769aca60a5a18013d4081d1fc8006f5416636354c0097 The OpenSSF Package Analysis project identified 'kekepaketti-git' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...