Atlassian Sourcetree for Windows Parameter Injection Vulnerability

Atlassian Sourcetree for Windows is a free Windows-based Git and Mercurial client tool from Atlassian Australia that manages repositories using a visual interface. A parameter injection vulnerability exists in Sourcetree for Windows. The vulnerability can be exploited by an attacker to execute co...

CVE-2018-13386

There was an argument injection vulnerability in Sourcetree for Windows via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. Versions of...

CVE-2018-13386

CVE-2018-13386 affects Sourcetree for Windows. The vulnerability is an argument injection via filenames in Mercurial repositories, exploitable by a user who can commit to a linked Mercurial repo, to gain code execution on the system. Affected versions are Sourcetree for Windows prior to 2.6.9. Re...

CVE-2018-13385

There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system. Versions of Sourcetree...

CVE-2018-13385

Sourcetree for macOS is affected in versions 1.0b2 through before 2.7.6 by an argument injection vulnerability via filenames in Mercurial repositories. An attacker who can commit to a linked Mercurial repo can exploit this to gain code execution on the host. Root cause: unsafe handling of reposit...

CVE-2018-0376

A vulnerability in the Policy Builder interface of Cisco Policy Suite before 18.2.0 could allow an unauthenticated, remote attacker to access the Policy Builder interface. The vulnerability is due to a lack of authentication. An attacker could exploit this vulnerability by accessing the Policy...

Gentoo Linux on Github hacked; repositories modified

By Waqas Another day, another data breach - This time, it is This is a post from HackRead.com Read the original post: Gentoo Linux on Github hacked; repositories modified...

Security Bulletin: Vulnerabilities in Subversion release shipped in Netcool/Impact (CVE-2013-1968)

Summary If you are using Subversion for version control in Netcool/Impact you may be affected by this vulnerability. Description is Subversion FSFS repositories can be corrupted by newline characters in filenames. More detail available at this link...

CVE-2018-11235

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because...

golang: arbitrary code execution during "go get" via C compiler options

An arbitrary command execution flaw was found in the way Go's "go get" command handled gcc and clang sensitive options during the build. A remote attacker capable of hosting malicious repositories could potentially use this flaw to cause arbitrary command execution on the client side...

Gitmails - An Information Gathering Tool To Colect Git Commit Emails In Version Control Host Services

An information gathering tool to colect git commit emails in version control host services. Overview Gitmails explores that git commits contains a name and an email configured by the author and that version control host services are being used to store a lot of projects. What Gitmails does is:...

Snallygaster - Tool To Scan For Secret Files On HTTP Servers

Snallygaster is a tool that looks for files accessible on web servers that shouldn't be public and can pose a security risk. Typical examples include publicly accessible git repositories, backup files potentially containing passwords or database dumps. In addition it contains a few checks for oth...

Fedora 27 : composer (2018-9d1ff4b802)

Version 1.6.4 - 2018-04-13 - Security fixes in some edge case scenarios, recommended update for all users - Fixed regression in version guessing of path repositories - Fixed removing aliased packages from the repository, which might resolve some odd update bugs - Fixed updating of package URLs fo...

Fedora 26 : composer (2018-8b35c531db)

Version 1.6.4 - 2018-04-13 - Security fixes in some edge case scenarios, recommended update for all users - Fixed regression in version guessing of path repositories - Fixed removing aliased packages from the repository, which might resolve some odd update bugs - Fixed updating of package URLs fo...

Git-All-Secrets - A Tool To Capture All The Git Secrets By Leveraging Multiple Open Source Git Searching Tools

git-all-secrets is a tool that can: Clone multiple public/private github repositories of an organization and scan them, Clone multiplepublic/private github repositories of a user that belongs to an organization and scan them, Clone a single public/private repository of an organization and scan it...

golang: arbitrary code execution during "go get" via C compiler options

An arbitrary command execution flaw was found in the way Go's "go get" command handled gcc and clang sensitive options during the build. A remote attacker capable of hosting malicious repositories could potentially use this flaw to cause arbitrary command execution on the client side...

golang: arbitrary code execution during "go get" or "go get -d"

An arbitrary command execution flaw was found in the way Go's "go get" command handled the checkout of source code repositories. A remote attacker capable of hosting malicious repositories could potentially use this flaw to cause arbitrary command execution on the client side...

All Aliases Have Failed

Challenge A Tenant's Backup Job or Backup Copy Job targeting a Cloud Repository fails with the following message: Target gate has rejected connection. Unable to establish target connection. All aliases have failed. The wording of the error might differ, but the root error "All Aliases Have Failed...

Code injection

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content...

CVE-2017-9269

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content...