CVE-2024-53858 Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cli

The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several gh commands...

CVE-2024-53858

CVE-2024-53858 affects the gh CLI (GitHub CLI) and can leak authentication tokens when cloning repositories that contain git submodules hosted outside GitHub.com/ghe.com. The root cause is that certain gh commands (e.g., gh repo clone, gh repo fork, gh pr checkout) invoke git in a way that retrie...

CVE-2024-53858 Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cli

The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several gh commands...

PT-2024-35955

Name of the Vulnerable Software and Affected Versions: GitHub CLI versions prior to 2.63.0 Description: A security issue has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. This...

kernel: mptcp: fix double-free on socket dismantle

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix double-free on socket dismantle when MPTCP server accepts an incoming connection, it clones its listener socket. However, the pointer to 'inetopt' for the new socket has the same value as the original one: as a...

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird relates to the execution of operations beyond the buffer in memory, which allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird relates to the issue of operations occurring outside of the buffer in memory during object cloning. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibili...

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird relates to the execution of operations beyond the buffer in memory, which allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird relates to the issue of operations occurring outside of the buffer in memory during object cloning. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibili...

CVE-2024-51990

jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause jj to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to upgrade should avoid cloning repos from...

Researchers Uncover Python Package Targeting Crypto Wallets with Malicious Code

Cybersecurity researchers have discovered a new malicious Python package that masquerades as a cryptocurrency trading tool but harbors functionality designed to steal sensitive data and drain assets from victims' crypto wallets. The package, named "CryptoAITools," is said to have been distributed...

The vulnerability of the Cloning component of the Oracle Global Lifecycle Management FMW Installer software platform allows a malicious individual to gain access to modify, add, and delete data.

The vulnerability of the Cloning component of the Oracle Global Lifecycle Management FMW Installer software platform is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker operating remotely to gain access to the ability to modify, add, or delete...

CVE-2024-21190

Vulnerability in the Oracle Global Lifecycle Management FMW Installer product of Oracle Fusion Middleware component: Cloning. The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SFTP to compromise Oracle...

firefox: thunderbird: Potential memory corruption may occur when cloning certain objects

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the issue as follows: It is currently unknown if this issue is exploitable, but a condition may arise where the structured clone of certain objects could lead to memory corruption...

firefox: thunderbird: Potential memory corruption may occur when cloning certain objects

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the issue as follows: It is currently unknown if this issue is exploitable, but a condition may arise where the structured clone of certain objects could lead to memory corruption...

CVE-2024-21190

CVE-2024-21190 affects Oracle Fusion Middleware’s Global Lifecycle Management FMW Installer (component: Cloning), with affected version 12.2.1.4.0. The vulnerability can be triggered by an unauthenticated attacker over SFTP, potentially leading to unauthorized create/delete/modify of data in the ...

firefox: thunderbird: Potential memory corruption may occur when cloning certain objects

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the issue as follows: It is currently unknown if this issue is exploitable, but a condition may arise where the structured clone of certain objects could lead to memory corruption...

firefox: thunderbird: Potential memory corruption may occur when cloning certain objects

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the issue as follows: It is currently unknown if this issue is exploitable, but a condition may arise where the structured clone of certain objects could lead to memory corruption...

firefox: thunderbird: Potential memory corruption may occur when cloning certain objects

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the issue as follows: It is currently unknown if this issue is exploitable, but a condition may arise where the structured clone of certain objects could lead to memory corruption...

firefox: thunderbird: Potential memory corruption may occur when cloning certain objects

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the issue as follows: It is currently unknown if this issue is exploitable, but a condition may arise where the structured clone of certain objects could lead to memory corruption...

GHSA-PR45-CG4X-FF4M ggit is vulnerable to Arbitrary Argument Injection via the clone() API

All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone API, which allows specifying the remote URL to clone and the file on disk to clone to. The library does not sanitize for user input or validate a given URL scheme, nor does it properly pass command-line...

eWeLink 安全漏洞

eWeLink is a smart home assistant from eWeLink, Inc. A security vulnerability exists in eWeLink version 2.0.0 and prior versions that stems from SSL Pinning bypassing certain hardware products, allowing a local attacker to decrypt TLS communications and extract secrets in order to clone the devic...