Command injection in libvcs and vcspull

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...

Exploit for Path Traversal in Gogs

CVE-2025-8110 PoC Python proof-of-concept script for triggerin...

CVE-2022-21187

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...

PT-2022-14911

Name of the Vulnerable Software and Affected Versions libvcs versions prior to 0.11.1 Description The issue concerns Command Injection via argument injection. When the update repo function is called, specifically when using hg, the url parameter is passed to the hg clone command. This allows for...

PT-2015-5389

Name of the Vulnerable Software and Affected Versions RhodeCode versions prior to 2.2.7 Description The issue allows remote authenticated users to obtain sensitive information, including API keys, by exploiting certain API methods. Specifically, the "update repo", "get locks", and "get user group...

Fedora 8 : fedora-release-8-6.transition (2008-7747)

This fedora-release update introduces a new set of Fedora Updates and Updates Testing repo definitions. These new definitions point to new URLS for our update content signed with a new key. This update also provides Fedora 8 and 9's new package signing keys. This update is a transitional update t...