git-lfs Remote Code Execution Exploit

Proof of concept git-lfs remote code execution exploit written in Go. Affects Git, GitHub CLI, GitHub Desktop, Visual Studio, GitKraken, SmartGit, SourceTree, and more. / Go PoC exploit for git-lfs - Remote Code Execution RCE vulnerability CVE-2020-27955 git-lfs-RCE-exploit-CVE-2020-27955.go...

git-lfs Remote Code Execution

/ Go PoC exploit for git-lfs - Remote Code Execution RCE vulnerability CVE-2020-27955 git-lfs-RCE-exploit-CVE-2020-27955.go Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Affected RCE exploit: Git / GitHub CLI / GitHub Desktop / Visual Studio / GitKraken / SmartGit /...

CVE-2020-27955

Git LFS 2.12.0 allows Remote Code Execution...

CVE-2020-27955

Git LFS 2.12.0 allows Remote Code Execution...

Remote code execution

Git LFS 2.12.0 allows Remote Code Execution...

CVE-2020-27955

Git LFS 2.12.0 allows Remote Code Execution...

CVE-2020-27955

Git LFS 2.12.0 allows Remote Code Execution...

CVE-2020-27955

Git LFS 2.12.0 allows Remote Code Execution...

CVE-2020-27955

Git LFS on Windows is vulnerable to remote code execution when cloning a malicious repo, due to Go behavior that may execute a current-directory binary (git.bat/git.exe). The issue is a known incomplete fix for CVE-2020-27955 and is discussed across advisories (GHSA-CX3W-XQMC-84G5; GHSA-4G4P-42WC...

CVE-2020-27955

Git LFS 2.12.0 allows Remote Code Execution...

PT-2020-16878 · Github · Git +1

Name of the Vulnerable Software and Affected Versions: Git LFS versions 2.12.0 Git versions prior to 2.29.2 Description: The issue allows Remote Code Execution RCE on Windows systems when Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory. This occu...

git-lfs bug fix and enhancement update

An update is available for git-lfs. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Enterprise...

ALEA-2020:4829 git-lfs bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

git-lfs bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

FreeBSD : Gitlab -- Multiple vulnerabilities (174e466b-1d48-11eb-bd0f-001b217b3468)

Gitlab reports : Path Traversal in LFS Upload Path traversal allows saving packages in arbitrary location Kubernetes agent API leaks private repos Terraform state deletion API exposes object storage URL Stored-XSS in error message of build-dependencies Git credentials persisted on disk Potential...

PhishingKitTracker - Let's Track Phishing Kits To Give To Research Community Raw Material To Stud

An extensible and freshly updated collection of phishingkits for forensics and future analysis topped with simple stats Disclaimer This repository holds a collection of Phishing Kits used by criminals to steal user information. Almost every file into the raw folder is malicious so I strongly...

CVE-2020-10081

GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could potentially be used to incorrectly access LFS objects not owned by the user...

CVE-2020-10081

GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could potentially be used to incorrectly access LFS objects not owned by the user...

Design/Logic Flaw

GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could potentially be used to incorrectly access LFS objects not owned by the user...

CVE-2020-10081

GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could potentially be used to incorrectly access LFS objects not owned by the user...