1045 matches found
Design/Logic Flaw
Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. In Hugo before version 0.79.1, if a malicious file with the same name exe or bat is...
CVE-2020-26284
Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. In Hugo before version 0.79.1, if a malicious file with the same name exe or bat is...
CVE-2020-26284 Hugo can execute a binary from the current directory on Windows
Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. In Hugo before version 0.79.1, if a malicious file with the same name exe or bat is...
CVE-2020-26284
CVE-2020-26284 affects Hugo (Go-based SSG) where, before v0.79.1, Hugo uses Go’s os/exec and will invoke a malicious executable if a file named after a common Windows binary (exe or bat) exists in the current working directory when Hugo runs. This can allow an attacker to execute arbitrary code o...
CVE-2020-26284
Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. In Hugo before version 0.79.1, if a malicious file with the same name exe or bat is...
CVE-2020-26284
Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. In Hugo before version 0.79.1, if a malicious file with the same name exe or bat is...
Gohugoio Hugo Operating System Command Injection Vulnerability
Gohugoio Hugo is a framework from the Gohugoio community based on the Go language for rapid generation of static sites. An operating system command injection vulnerability exists in Hugo versions prior to 0.79.1, which stems from the fact that if a malicious file exe or bat of the same name is...
CVE-2020-26284: Improper Neutralization of Special Elements used in an OS Command
Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. In Hugo before version 0.79.1, if a malicious file with the same name exe or bat is...
PT-2020-16403
Name of the Vulnerable Software and Affected Versions Hugo versions prior to 0.79.1 Description Hugo is a fast and Flexible Static Site Generator built in Go. It depends on Go's os/exec for certain features, such as rendering of Pandoc documents if these binaries are found in the system %PATH% on...
hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by CVE-2020-26215 via notebook (5.0.0)
notebook PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on notebook and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: CVE-2020-26215 Source advisory: OSV:PYSEC-2020-215...
hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by CVE-2020-26215 via notebook (5.0.0)
notebook PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on notebook and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: CVE-2020-26215 Source advisory: OSV:GHSA-C7VM-F5P4-8FQH...
hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by CVE-2020-25659 via cryptography (2.0.0)
cryptography PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: CVE-2020-25659 Source advisory: OSV:GHSA-HGGM-JPG3-V476...
hugo-info.de Cross Site Scripting vulnerability OBB-1429396
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by CVE-2020-6817 via bleach (2.0.0)
bleach PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: CVE-2020-6817 Source advisory: OSV:GHSA-VQHP-CXGC-6WMM...
hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by CVE-2020-6817 via bleach (2.0.0)
bleach PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: CVE-2020-6817 Source advisory: OSV:PYSEC-2020-340...
hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by CVE-2020-6802 via bleach (2.0.0)
bleach PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: CVE-2020-6802 Source advisory: OSV:PYSEC-2020-27...
hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by CVE-2020-6816 via bleach (2.0.0)
bleach PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: CVE-2020-6816 Source advisory: OSV:PYSEC-2020-28...
hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by CVE-2020-6816 via bleach (2.0.0)
bleach PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: CVE-2020-6816 Source advisory: OSV:GHSA-M6XF-FQ7Q-8743...
Fedora: Security Advisory for hugo (FEDORA-2020-bd764dd275)
The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora: Security Advisory for hugo (FEDORA-2020-279c61dd70)
The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...