CVE-2022-24376

CVE-2022-24376 (git-promise) is a command-injection vulnerability affecting all versions of the package due to an inappropriate fix of a prior issue. The available documents consistently state that there is no fixed version and that the README contains a warning about this vulnerability. The prac...

CVE-2022-24376 Command Injection

All versions of package git-promise are vulnerable to Command Injection due to an inappropriate fix of a prior vulnerability in this package. Note: Please note that the vulnerability will not be fixed. The README file was updated with a warning regarding this issue...

CVE-2022-24376

All versions of package git-promise are vulnerable to Command Injection due to an inappropriate fix of a prior vulnerability in this package. Note: Please note that the vulnerability will not be fixed. The README file was updated with a warning regarding this issue...

PT-2022-16654 · Unknown · Git-Promise

Name of the Vulnerable Software and Affected Versions: git-promise versions all Description: The issue is related to Command Injection due to an inappropriate fix of a prior vulnerability in the git-promise package. The README file was updated with a warning regarding this issue. It is noted that...

git-promise 参数注入漏洞

git-promise is a simple wrapper. Run any git command with a more intuitive syntax. A parameter injection vulnerability exists in all versions of git-promise due to the use of space-splitting in the logic used to separate command parameters in pull requests...

Amazon Linux AMI : git (ALAS-2022-1589)

The version of git installed on the remote host is prior to 2.36.1-1.75. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1589 advisory. A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system...

Design/Logic Flaw

Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 DisplayName does not filter characters input from users, which leads to an XSS vulnerability when directly displayed in the issue list. This issue has been resolved in commit 155cae1d which sanitizes DisplayName...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the g GitArtifactReader.Read API in git.go. This could allow arbitrary file reads if the GitArtifactReader is provided a pathname containing a symbolic link or an implicit directory name such as ... Details A...

Medium: git

Issue Overview: A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This allows the owner of the repository to cause arbitrary commands to be...

git -- Multiple vulnerabilities

This release contains 2 security fixes: CVE-2022-39253 When relying on the --local clone optimization, Git dereferences symbolic links in the source repository before creating hardlinks or copies of the dereferenced link in the destination repository. This can lead to surprising behavior where...

Path Traversal in Git HTTP endpoints in Gogs

Impact The malicious user is able to craft HTTP requests to access unauthorized Git directories. All installations with are affected. Patches Path cleaning has accommodated for Git HTTP endpoints. Users should upgrade to 0.12.9 or the latest 0.13.0+dev. Workarounds N/A References...

GHSA-6VCC-V9VW-G2X5 Path Traversal in Git HTTP endpoints in Gogs

Impact The malicious user is able to craft HTTP requests to access unauthorized Git directories. All installations with are affected. Patches Path cleaning has accommodated for Git HTTP endpoints. Users should upgrade to 0.12.9 or the latest 0.13.0+dev. Workarounds N/A References...

CVE-2022-31038 XSS vulnerability in repository issue list in Gogs

Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 DisplayName does not filter characters input from users, which leads to an XSS vulnerability when directly displayed in the issue list. This issue has been resolved in commit 155cae1d which sanitizes DisplayName...

CVE-2022-31038 XSS vulnerability in repository issue list in Gogs

Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 DisplayName does not filter characters input from users, which leads to an XSS vulnerability when directly displayed in the issue list. This issue has been resolved in commit 155cae1d which sanitizes DisplayName...

CVE-2022-31038 XSS vulnerability in repository issue list in Gogs

Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 DisplayName does not filter characters input from users, which leads to an XSS vulnerability when directly displayed in the issue list. This issue has been resolved in commit 155cae1d which sanitizes DisplayName...

Path Traversal in Git HTTP endpoints in Gogs

Impact The malicious user is able to craft HTTP requests to access unauthorized Git directories. All installations with are affected. Patches Path cleaning has accommodated for Git HTTP endpoints. Users should upgrade to 0.12.9 or the latest 0.13.0+dev. Workarounds N/A References...

PT-2022-14238 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: gogs/gogs versions prior to 0.12.9 Description: The issue allows a malicious user to update a crafted config file into the repository's .git directory, combined with crafted file deletion, to gain SSH access to the server. This affects all...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

Confluence RCE CVE-2022-26134 Exploit Detection Pre-requ...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

Confluence RCE CVE-2022-26134 Exploit Detection Pre-requ...

OS Command Injection

gitsome is vulnerable to os command injection. The vulnerability exists when initializing an unsupported git repository which allows an attacker to inject and execute arbitrary commands via crafted tag names of the repository...