CVE-2022-36069

Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as git clone. These commands are constructed using user input e.g. the repository URL. When building the commands, Poetry correctly avoid...

CVE-2022-36069 Poetry Argument Injection vulnerability can lead to local Code Execution

Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as git clone. These commands are constructed using user input e.g. the repository URL. When building the commands, Poetry correctly avoid...

CVE-2022-36069 Poetry Argument Injection vulnerability can lead to local Code Execution

Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as git clone. These commands are constructed using user input e.g. the repository URL. When building the commands, Poetry correctly avoid...

CVE-2022-36070

CVE-2022-36070 affects Poetry (Python dependency manager). When handling Git-based dependencies, Poetry runs commands by executable name (not absolute path), enabling Windows’ path resolution to execute untrusted binaries in the current directory. This can lead to Arbitrary Code Execution with lo...

CVE-2022-36070 Poetry's Untrusted Search Path can lead to Local Code Execution on Windows

Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. git config. These commands are being executed using the executable’s name and not its absolute path. This can lead to the execution of untrusted code due to th...

CVE-2022-36070

Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. git config. These commands are being executed using the executable’s name and not its absolute path. This can lead to the execution of untrusted code due to th...

CVE-2022-36070 Poetry's Untrusted Search Path can lead to Local Code Execution on Windows

Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. git config. These commands are being executed using the executable’s name and not its absolute path. This can lead to the execution of untrusted code due to th...

CVE-2022-36070 Poetry's Untrusted Search Path can lead to Local Code Execution on Windows

Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. git config. These commands are being executed using the executable’s name and not its absolute path. This can lead to the execution of untrusted code due to th...

Amazon Linux 2022 : git, git-all, git-core (ALAS2022-2022-118)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-118 advisory. A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration...

The Bug Report – August 2022 Edition

The Bug Report — August 2022 Edition By Philippe Laulheret · September 7, 2022 Your Cybersecurity Comic Relief Figure 0: CVE-2022-38392 redefines “destructive interference” Why am I here? Indeed, why are we here? School is back in session, there’s a chill in the air that says fall is around the...

PT-2022-23156

Name of the Vulnerable Software and Affected Versions Poetry versions prior to 1.1.9 Poetry versions prior to 1.2.0b1 Description Poetry is a dependency manager for Python that uses various commands, such as git clone, when handling dependencies from a Git repository. The commands are constructed...

Amazon Linux 2022 : git, git-all, git-core (ALAS2022-2022-067)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-067 advisory. A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration...

Amazon Linux 2022 : fish (ALAS2022-2022-056)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-056 advisory. fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of gi...

USN-5216-1: hosted-git-info vulnerability

It was discovered that hosted-git-info incorrectly handled certain inputs. A remote attacker could use this to cause a denial of service...

USN-5216-1 node-hosted-git-info vulnerability

It was discovered that hosted-git-info incorrectly handled certain inputs. A remote attacker could use this to cause a denial of service...

Exploit for OS Command Injection in Siemens Brownfield_Connectivity_Gateway

CVE-2022-1292 POC !POC Screenshothttps://user-images.github...

USN-5511-1: Git vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Description Carlo Marcelo Arenas Belón discovered that an issue related to CVE-2022-24765 still affected Git. An attacker could possibly use this issue to run arbitrary commands as administrator. CVE-2022-29187 Updat...

CVE-2022-38663

A flaw was found in the Jenkins Git plugin. The Git Plugin does not properly mask the credentials in the build log provided by the Git Username and Password gitUsernamePassword credentials binding. Usernames are masked instead of passwords in cases when usernames are not set to be treated as secr...

GHSA-JXMW-3GXF-FPRH Improper masking of credentials Jenkins in Git Plugin

Jenkins Git Plugin 4.11.4 and earlier does not properly mask i.e., replace with asterisks credentials in the build log provided by the Git Username and Password gitUsernamePassword credentials binding...

Improper masking of credentials Jenkins in Git Plugin

Jenkins Git Plugin 4.11.4 and earlier does not properly mask i.e., replace with asterisks credentials in the build log provided by the Git Username and Password gitUsernamePassword credentials binding...