EUVD-2011-3193

Malware in sbrugna...

Remote Code Execution (RCE)

scratch-vm is vulnerable to remote code executionRCE. It does not escape extension URL values in the function getExtensionIdForOpcode in serialization/sb3.js, allowing an attacker to inject characters and execute it as a worker...

GHSA-VC9J-FHVV-8VRF Remote Code Execution in scratch-vm

MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain characters, resulting in remote code execution because the URL's content is treated as a script and is executed as a worker. The responsible code...

DEBIAN-CVE-2016-3068

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository...

UBUNTU-CVE-2016-3068

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository...