CVE-2024-3817

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package...

CVE-2024-3817 HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package...

CVE-2024-3817

CVE-2024-3817: HashiCorp go-getter is vulnerable to argument injection when executing Git to discover remote branches. The description notes this affects the go-getter package (not the go-getter/v2 branch). The CVSS v3.1 base score is 9.8 (CRITICAL) with network attack vector, no privileges requi...

CVE-2024-3817 HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package...

CVE-2024-3817

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package...

CVE-2024-3817 HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package...

HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

Summary HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability, CVE-2024-3817, is fixed in go-getter 1.7.4. This vulnerability does not affect the go-getter/v2 branch and package. Background HashiCorp’s go-getter is a...

HashiCorp go-getter 安全漏洞

HashiCorp go-getter is a library for Go golang from HashiCorp, USA, used to download files or directories from various sources using URLs as the primary form of input. A security vulnerability exists in HashiCorp go-getter versions 1.5.9 through 1.7.3 that stems from vulnerability to parameter...

PT-2024-5223

Name of the Vulnerable Software and Affected Versions: go-getter versions prior to 1.7.4 go-getter/v2 branch and package are not affected Description: The go-getter library is vulnerable to argument injection when executing Git to discover remote branches. An attacker may format a Git URL in orde...

CVE-2024-3817: Improper Neutralization of Argument Delimiters in a Command

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package...

CVE-2023-34093

Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone Strapi developers, users, plugins can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the actual content types...

PT-2023-24666 · Strapi · Strapi

Name of the Vulnerable Software and Affected Versions: Strapi versions prior to 4.10.8 Description: The issue affects the handling of content types by Strapi, allowing anyone to make every attribute of a Content-Type public without knowing it. This can lead to sensitive information being exposed ...

CVE-2023-34093: Exposure of Sensitive Information to an Unauthorized Actor

Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone Strapi developers, users, plugins can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the actual content types...

kernel: ASoc: audio-graph-card2: Fix refcount leak bug in __graph_get_type()

In the Linux kernel, the following vulnerability has been resolved: ASoc: audio-graph-card2: Fix refcount leak bug in graphgettype We should call ofnodeput for the reference before its replacement as it returned by ofgetparent which has increased the refcount. Besides, we should also call ofnodep...

Cross-site Scripting (XSS) in DataObject Any Getter grid operator

Impact Stored cross site scripting vulnerability in operator any getter in dataobject grid configuration. Patches Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/6946f8a5a0a93b516c49f17a5b45044eebd73480.patch Workarounds Apply patch...

GHSA-6FVF-X8C6-2F6J Cross-site Scripting (XSS) in DataObject Any Getter grid operator

Impact Stored cross site scripting vulnerability in operator any getter in dataobject grid configuration. Patches Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/6946f8a5a0a93b516c49f17a5b45044eebd73480.patch Workarounds Apply patch...

Stored cross site scripting vulnerability in operator any getter in pimcore grid configuration

Description Stored cross site scripting vulnerability in operator any getter in pimcore grid configuration. Proof of Concept 1. Login to the demo account https://11.x-dev.pimcore.fun/admin/login 2. On left side menu go to document -- perspective -- cdp...

Go-Getter Vulnerable to Decompression Bombs

...

GO-2023-1578 Denial of service in github.com/hashicorp/go-getter/v2

HashiCorp go-getter is vulnerable to decompression bombs. This can lead to excessive memory consumption and denial-of-service attacks...

CVE-2023-0475

A flaw was found in the HashiCorp go-getter package. Affected versions of the HashiCorp go-getter package are vulnerable to a denial of service via a malicious compressed archive...