11521 matches found
CVE-2021-29509
Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same...
Command injection in get-git-data
get-git-data through 1.3.1 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments provided to get-git-data...
GHSA-WJ6H-7CHW-X4H2 Command injection in get-git-data
get-git-data through 1.3.1 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments provided to get-git-data...
sizemometer (>=0.0.3, <=0.8.1) potentially affected by CVE-2020-7619 via get-git-data (>=1.0.3, <=1.3.1)
get-git-data NPM version =1.0.3, =0.0.3, =0.8.1 Source cves: CVE-2020-7619 Source advisory: OSV:GHSA-WJ6H-7CHW-X4H2...
OS Command Injection
git-parse is vulnerable to OS command injection. Untrusted input in gitDiff is passed into an exec function without validation, allowing an attacker to execute arbitrary OS commands on the host OS...
CVE-2018-1000182 affecting package git 2.23.3-1
CVE-2018-1000182 affecting package git 2.23.3-1. An upgraded version of the package is available that resolves this issue...
CVE-2018-1000110 affecting package git 2.23.3-1
CVE-2018-1000110 affecting package git 2.23.3-1. An upgraded version of the package is available that resolves this issue...
CVE-2010-2542 affecting package git 2.23.3-1
CVE-2010-2542 affecting package git 2.23.3-1. An upgraded version of the package is available that resolves this issue...
CVE-2020-2136 affecting package git 2.23.3-1
CVE-2020-2136 affecting package git 2.23.3-1. An upgraded version of the package is available that resolves this issue...
CVE-2019-1003010 affecting package git 2.23.3-1
CVE-2019-1003010 affecting package git 2.23.3-1. An upgraded version of the package is available that resolves this issue...
Regular Expression Denial of Service
Overview hosted-git-info before versions 2.8.9 and 3.0.8 are vulnerable to Regular Expression Denial of Service ReDoS via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity Recommendation Upgrade to...
Regular Expression Denial of Service in hosted-git-info
The npm package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service ReDoS via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity...
@fengshangwuqi/appkit (>=1.0.22, <=1.0.29), @koj/strapi (>=1.4.1, <=1.4.3) +30 more potentially affected by CVE-2021-23362 via hosted-git-info (>=3.0.0, <=3.0.7)
hosted-git-info NPM version =3.0.0, =1.0.22, =1.4.1, =0.1.0, =4.0.0, =1.0.0, =3.0.0, =0.0.0-2020520224551, =0.1.0, =0.0.0-2020520224551, =0.0.0-2020520224551, =0.1.0, =0.0.0-2020520224551, =0.1.0, =0.0.0-2020520224551, =0.1.0, =0.1.10 and more Source cves: CVE-2021-23362 Source advisory:...
GHSA-43F8-2H32-F4CJ Regular Expression Denial of Service in hosted-git-info
The npm package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service ReDoS via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity...
421752593pro (5.6.0), @concisejs/docz-theme-ext (>=0.0.1, <=0.0.3) +81 more potentially affected by CVE-2021-23362 via hosted-git-info (>=2.1.5, <=2.8.8)
hosted-git-info NPM version =2.1.5, =0.0.1, =0.1.0, =1.3.13, =3.0.0, =2.0.0, =1.16.0, =0.0.2, =2.3.1, =1.0.0, =1.0.0, =1.3.0, =1.3.16 and more Source cves: CVE-2021-23362 Source advisory: OSV:GHSA-43F8-2H32-F4CJ...
CVE-2021-26543
The "gitDiff" function in Wayfair git-parse =1.0.4 has a command injection vulnerability. Clients of the git-parse library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. The issue has been resolved in version 1.0.5...
CVE-2021-26543
The "gitDiff" function in Wayfair git-parse =1.0.4 has a command injection vulnerability. Clients of the git-parse library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. The issue has been resolved in version 1.0.5...
Command injection
The "gitDiff" function in Wayfair git-parse =1.0.4 has a command injection vulnerability. Clients of the git-parse library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. The issue has been resolved in version 1.0.5...
CVE-2021-26543
The "gitDiff" function in Wayfair git-parse =1.0.4 has a command injection vulnerability. Clients of the git-parse library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. The issue has been resolved in version 1.0.5...
