CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

43 matches found

NVD•added 2022/03/14 6:15 p.m.•12 views

CVE-2022-21187

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...

9.8CVSS0.0128EPSS

Exploits0References3

Github Security Blog•added 2020/09/04 5:31 p.m.•27 views

Command Injection in meta-git

All versions of meta-git are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an exec call, which may allow attackers to execute arbitrary code in the system. The clone command is vulnerable through the branch name. Recommendation No fix is currently...

6.3AI score

Exploits0References3Affected Software1

OSV•added 2020/09/04 5:31 p.m.•8 views

GHSA-QCFF-FFX3-M25C Command Injection in meta-git

8.1AI score

Exploits0References2

Node.js•added 2020/01/17 9:33 p.m.•14 views

Command Injection

Overview All versions of meta-git are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an exec call, which may allow attackers to execute arbitrary code in the system. The clone command is vulnerable through the branch name. Recommendation No fix is...

7.9AI score

Exploits0Affected Software1

UbuntuCve•added 2019/08/22 8:15 p.m.•43 views

CVE-2019-13139

In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command execution. An issue exists in the way "docker build" processes remote git URLs, and results in command injection into the underlying "git...

8.4CVSS7.3AI score0.00538EPSS

Exploits1References3

OSV•added 2017/10/05 1:29 a.m.•1 views

ALPINE-CVE-2017-1000117

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim...

8.8CVSS6.8AI score0.70245EPSS

Exploits9References1

CVE•added 2017/10/04 1:0 a.m.•301 views

CVE-2017-1000117

CVE-2017-1000117 is a command-injection vulnerability in Git caused by insufficient validation of ssh:// URL handling, enabling arbitrary code execution when a malicious URL is processed (e.g., via git clone --recurse-submodules or a crafted .gitmodules). The connected advisories confirm the issu...

8.8CVSS7.9AI score0.70245EPSS

Exploits9References12Affected Software1

PyPA•added 2016/04/13 4:59 p.m.•5 views

PYSEC-2016-29

The binary delta decoder in Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a 1 clone, 2 push, or 3 pull command, related to a a list sizing rounding error and b short records...

8.8CVSS8AI score0.05192EPSS

Exploits0References12Affected Software1

OSV•added 2015/03/31 2:59 p.m.•5 views

CVE-2014-9462