32161 matches found
GitProxy Hidden Commits Injection
Summary An attacker can inject extra commits into the pack sent to GitHub, commits that aren’t pointed to by any branch. Although these “hidden” commits never show up in the repository’s visible history, GitHub still serves them at their direct commit URLs. This lets an attacker exfiltrate...
GHSA-V98G-8RQX-G93G GitProxy Hidden Commits Injection
Summary An attacker can inject extra commits into the pack sent to GitHub, commits that aren’t pointed to by any branch. Although these “hidden” commits never show up in the repository’s visible history, GitHub still serves them at their direct commit URLs. This lets an attacker exfiltrate...
CVE-2025-54528
In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow...
CVE-2025-54586
creationtimestamp| type| source ---|---|--- 2025-07-30 15:27:15+00:00| published-proof-of-concept| https://github.com/finos/git-proxy/security/advisories/GHSA-v98g-8rqx-g93g...
CVE-2025-54430
dedupe is a python library that uses machine learning to perform fuzzy matching, deduplication and entity resolution quickly on structured data. Before commit 3f61e79, a critical severity vulnerability has been identified within the .github/workflows/benchmark-bot.yml workflow, where a issuecomme...
CVE-2025-54430 dedupe is vulnerable to secret exfiltration via `issue_comment`
dedupe is a python library that uses machine learning to perform fuzzy matching, deduplication and entity resolution quickly on structured data. Before commit 3f61e79, a critical severity vulnerability has been identified within the .github/workflows/benchmark-bot.yml workflow, where a issuecomme...
GHSA-72FF-RQXP-4HRH
creationtimestamp| type| source ---|---|--- 2025-07-30 01:53:20+00:00| seen| https://gist.github.com/ZupeiNie/6f65e564f2067b876321d3dfdbb76569...
CVE-2025-45767
creationtimestamp| type| source ---|---|--- 2025-07-30 01:49:33+00:00| seen| https://gist.github.com/ZupeiNie/705a606fbb99f3bb8c9b51e5bc13c91d...
JetBrains TeamCity Cross-Site Request Forgery Vulnerability
JetBrains TeamCity is a Continuous Integration CI/CD tool developed by JetBrains, Inc. to automate the software build, test and deployment process. JetBrains TeamCity suffers from a cross-site request forgery vulnerability that stems from a security flaw in the GitHub application connection...
Dedupe Python Library 操作系统命令注入漏洞
Dedupe Python Library is an open source Python library for accurate and scalable fuzzy matching, de-duplication from Dedupe.io. Dedupe Python Library suffers from an operating system command injection vulnerability that stems from issuecomment triggering the execution of untrusted code in the...
GO-2025-3818 Mattermost has Insufficiently Protected Credentials in github.com/mattermost/mattermost-server
Mattermost has Insufficiently Protected Credentials in github.com/mattermost/mattermost-server...
GO-2025-3819 Mattermost Missing Authentication for Critical Function in github.com/mattermost/mattermost-server
Mattermost Missing Authentication for Critical Function in github.com/mattermost/mattermost-server...
GO-2025-3820 Mattermost Path Traversal vulnerability in github.com/mattermost/mattermost-server
Mattermost Path Traversal vulnerability in github.com/mattermost/mattermost-server...
GO-2025-3826 Possible ORM Leak Vulnerability in the Harbor in github.com/goharbor/harbor
Possible ORM Leak Vulnerability in the Harbor in github.com/goharbor/harbor. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2025-3827 eKuiper API endpoints handling SQL queries with user-controlled table names. in github.com/lf-edge/ekuiper
eKuiper API endpoints handling SQL queries with user-controlled table names. in github.com/lf-edge/ekuiper...
GHSA-QXP5-GWG8-XV66
creationtimestamp| type| source ---|---|--- 2025-07-28 21:50:46+00:00| seen| https://gist.github.com/puerco/0e45f7acdb725a96b024bfea9e9225de...
GO-2025-3810 Chall-Manager's scenario decoding process does not check for zip bombs in github.com/ctfer-io/chall-manager
Chall-Manager's scenario decoding process does not check for zip bombs in github.com/ctfer-io/chall-manager...
GO-2025-3808 Chall-Manager is vulnerable to Path Traversal when extracting/decoding a zip archive in github.com/ctfer-io/chall-manager
Chall-Manager is vulnerable to Path Traversal when extracting/decoding a zip archive in github.com/ctfer-io/chall-manager...
GO-2025-3805 Juju allows arbitrary executable uploads via authenticated endpoint without authorization in github.com/juju/juju
Juju allows arbitrary executable uploads via authenticated endpoint without authorization in github.com/juju/juju. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...