[SECURITY] Fedora 33 Update: ghc-cmark-gfm-0.2.2-1.fc33

This package provides Haskell bindings for , the reference parser for , a fully specified variant of Markdown. It includes sour ces for libcmark-gfm 0.29.0.gfm.0 and does not require prior installation of the C library...

Huawei EulerOS: Security Advisory for git (EulerOS-SA-2020-2111)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP3 : git (EulerOS-SA-2020-2111)

According to the version of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git use...

An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to obtain a list of nodes and users.

...

Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation resulting in a stored cross-site scripting vulnerability.

...

A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier

...

Stack-based buffer overflow in the is_git_directory function in setup.c in Git before 1.7.2.1 allows local users to gain privileges via a long gitdir: field in a .git file in a working copy.

...

A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java, GitBlitRepositoryBrowser.java, Gitiles.java, TFS2013GitRepositoryBrowser.java, ViewGitWeb.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.

...

CVE-2020-15187

In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a local execution attack. To perform thi...

Arbitrary Code Execution

Git execute arbitrary commands via a tree containing a crafted .git/config file with 1 an ignorable Unicode codepoint, 2 a git1/config representation, or 3 mixed case that is improperly handled on a case-insensitive filesystem...

Security update for fossil (important)

openSUSE Security Update: Security update for fossil Announcement ID: openSUSE-SU-2020:1478-1 Rating: important References: 1047218 1175760 Cross-References: CVE-2020-24614 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 An upda...

PT-2020-14258 · Helm +2 · Helm +2

Name of the Vulnerable Software and Affected Versions: Helm versions prior to 2.16.11 Helm versions prior to 3.3.2 Description: A Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs...

Command injection

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not validating a Deploy-Token and allowed a disabled repository be accessible via a git command line...

CVE-2020-13316

CVE-2020-13316 affects GitLab versions before 13.1.10, 13.2.8, and 13.3.4. The root cause is that Deploy-Token validation was not performed, allowing access to a disabled repository via a git command line. The impact is exposure of otherwise inaccessible repositories, enabling an attacker with ne...

jenkins-git-plugin: stored cross-site scripting

Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cross-site scripting vulnerability...

GHSA-49MG-94FC-2FX6 Command Injection in npm-git-publish

All versions of npm-git-publish are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an execSync call, which may allow attackers to execute arbitrary code in the system. The publish function is vulnerable through the gitRemoteUrl variable...

Command Injection in npm-git-publish

All versions of npm-git-publish are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an execSync call, which may allow attackers to execute arbitrary code in the system. The publish function is vulnerable through the gitRemoteUrl variable...

Command Injection in meta-git

All versions of meta-git are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an exec call, which may allow attackers to execute arbitrary code in the system. The clone command is vulnerable through the branch name. Recommendation No fix is currently...

GHSA-QCFF-FFX3-M25C Command Injection in meta-git

All versions of meta-git are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an exec call, which may allow attackers to execute arbitrary code in the system. The clone command is vulnerable through the branch name. Recommendation No fix is currently...

meta (>=1.0.0, <=1.0.3), ownmeta (0.0.4) potentially affected by unknown CVE via meta-git (>=0.0.0, <=1.1.3)

meta-git NPM version =0.0.0, =1.0.0, =1.0.3 - ownmeta 0.0.4 Source cves: unknown CVE Source advisory: OSV:GHSA-QCFF-FFX3-M25C...