cve-2020-27955

cve-2020-27955 cve-2020-27955 Riproduzione 1. Crea un repository GitHub 2. git clone https://github.com/attacker/poc.git . 3. echo calc.exe git.cmd 4. git lfs track “.dat” 5. echo “Junk” large.dat 6. git add -A 7. git commit -m “POC” 8. git push -u origin master -f...

CVE-2018-11235

CVE-2018-11235 Creazione automatica di repository Git dannosi per sfruttare CVE-2018-11235, un'esecuzione di codice remota tramite i sottomoduli Git. Post del blog: https://devblogs.microsoft.com/devops/announcing-the-may-2018-git-security-vulnerability/...

repo

Repo dannoso per CVE-2025-65964...

clone_and_pwn

Intestazioni Titolo Exploit: Clone and Pwn Data: 4 giugno 2018 Autore Exploit: Alejandro Caceres Homepage del Venditore: https://git-scm.com/ Link Software: https://git-scm.com/downloads Versione: codice arbitrario viene eseguito sulle versioni del client git precedenti a 2.13.7, 2.14.x precedent...

WSO2-2020-0731

WSO2-2020-0731: ثغرات XXE و XSS في WSO2 Carbon تم تحديد ثغرات XXE و XSS محتملة في العديد من منتجات WSO2. إفصاح البائع: يمكن العثور على إفصاح البائع وإصلاح هذه الثغرة هنا. لماذا لا يوجد CVE؟ لم يقم البائع ولا أنا بطلب CVE لهذه الثغرات. المتطلبات: تتطلب هذه الثغرة: إقناع مستخدم WSO2 شرعي بإضافة...

CVE-2020-27955

Reproduktion der Schwachstelle CVE-2020-27955 1. Auf dem Windows-Rechner die verwundbare Version von Git-LFS herunterladen. Download-Link: https://github.com/git-for-windows/git/releases/tag/v2.29.2.windows.1 2. Auf dem Windows-Rechner installieren und die folgenden Informationen zur Hosts-Datei...

cve-2025-62726-malicious-repo

इस रिपॉजिटरी में README नहीं है।...

CVE-2018-11235

CVE-2018-11235 1. ssh zu deinem VPS. 2. Klone dieses Repository: root@kitploit: git clone https://github.com/Rezy-Dev/CVE-2018-11235 cd CVE-2018-11235 3. Gib exploit.sh die Ausführungsberechtigung x und führe es aus: root@kitploit: sudo chmod +x exploit.sh sudo ./exploit.sh Es lädt apache2 herunt...

CVE-2025-65964-Exploit

Etapas de Reprodução Primeiro, prepare um repositório contendo um arquivo malicioso root@kitploit: mkdir n8n-rce-poc && cd n8n-rce-poc git init git remote add origin mkdir evilhooks echo '!/bin/sh' evilhooks/pre-commit echo 'touch /tmp/pwnedsuccess' evilhooks/pre-commit chmod +x...

CVE-2026-48122 Workspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extension

Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler Gemfile used at startup. A malicious...

CVE-2026-67623

Technical details about CVE-2026-67623 are not publicly available in the provided documents. No vendor, product versions, affected components, or remediation are specified here. Monitor for updates in future connected documents.

CVE-2026-47211

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code executi...

CVE-2026-47211

CVE-2026-47211 affects Ouroboros (local-first runtime for AI coding agents). Prior to version 0.39.0, loading the project-local .env could cause arbitrary code execution when a user runs Ouroboros commands in a cloned malicious repository; execution-affecting variables like OUROBOROS_CLI_PATH and...

CVE-2026-47211 Ouroboros: Remote Code Execution via Untrusted Project-Directory .env

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code executi...

CVE-2026-47211 Ouroboros: Remote Code Execution via Untrusted Project-Directory .env

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code executi...

CVE-2026-9856 Path Traversal in huggingface/transformers

A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...

EUVD-2026-40117

Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution...

CVE-2026-65598 n8n before 1.123.64 Remote Code Execution via Git Clone

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

CVE-2026-57860 ForgeCode Arbitrary Code Execution via Unvetted .mcp.json in Untrusted Repository

ForgeCode tailcallhq/forgecode, an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and...

GHSA-9HC2-HJX8-Q6PV TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution

Description TidGi Desktop through 0.13.0 contains a critical remote code execution vulnerability exploitable via a single Git repository import. The vulnerability leverages TiddlyWiki's module system, which automatically discovers and executes JavaScript code embedded in .tid files placed in the...