CVE-2022-29810

CVE-2022-29810 affects the HashiCorp go-getter library, where versions before 1.5.11 fail to redact an SSH private key in a URL query parameter. In practice, this can lead to exposure of SSH credentials in logs or error messages, potentially readable by local users with access to the logfile. Con...

CVE-2022-29810

The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter...

CVE-2022-29810

The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter...

PT-2022-19843 · Hashicorp · Go-Getter

Name of the Vulnerable Software and Affected Versions: Hashicorp go-getter library versions prior to 1.5.11 Description: The issue concerns the Hashicorp go-getter library, where SSH credentials could be written into its logfile. This exposes sensitive credentials to local users who have the...

Hashicorp go-getter 日志信息泄露漏洞

Hashicorp go-getter is a library for Go golang that is used to download files or directories from various sources using URLs as the primary form of input. A log information disclosure vulnerability exists in Hashicorp go-getter version 1.5.11, which stems from the ability of the go-getter library...

Command Injection

Overview github.com/hashicorp/go-getter is a Package for downloading things from a string URL using a variety of protocols. Affected versions of this package are vulnerable to Command Injection via hg argument injection. When calling the newgogetter.HgGetter.get function, the dst parameter is...

Race Condition

github.com/hashicorp/nomad is vulnerable to race condition. The vulnerability exists in getClient function of getter.go which allows Nomad client agent to download the wrong artifact into the wrong destination which causes a race condition...

Nomad Artifact Download Race Condition

Summary Nomad and Nomad Enterprise “Nomad” artifact download functionality had a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. This vulnerability, CVE-2022-24686, was fixed in Nomad 1.0.18, 1.1.12, and 1.2.6. Background Nomad uses th...

Prototype Pollution

Overview Prototype pollution vulnerability in ‘set-getter’ version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution. Recommendation Upgrade to version 0.1.1 or later References - CVE - GitHub Advisory...

CVE-2021-25949

Prototype pollution vulnerability in 'set-getter' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25949

Prototype pollution vulnerability in 'set-getter' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution...

Remote code execution

Prototype pollution vulnerability in 'set-getter' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25949

Prototype pollution vulnerability in 'set-getter' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25949

CVE-2021-25949 is a prototype pollution flaw in the npm package set-getter (v0.1.0) that can cause denial of service and may lead to remote code execution. The vulnerability is documented across multiple sources, which indicate the affected component and a fix path: upgrade to set-getter v0.1.1 o...

set-getter 安全漏洞

set-getter is a software package. A security vulnerability exists in set-getter 0.1.0 that can be exploited by an attacker to cause a denial of service and potentially lead to remote code execution...

UBUNTU-CVE-2021-28878

In the standard library in Rust before 1.52.0, the Zip implementation calls iteratorgetunchecked more than once for the same index under certain conditions when nextback and next are used together. This bug could lead to a memory safety violation due to an unmet safety requirement for the...

Vulnerability of the /processReportGetter.php component of the KTS “Mayak” system, which allows a hacker to gain access to and read arbitrary files.

The vulnerability of the /processReportGetter.php component of the KTS “Mayak” is related to errors in the logic of the web application’s operation. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to and read arbitrary files...

WebKit JIT - ByteCodeParser::handleIntrinsicCall Type Confusion

WebKit JIT - ByteCodeParser::handleIntrinsicCall Type Confusion / case ArrayPushIntrinsic: ... if staticcastargumentCountIncludingThis = MINSPARSEARRAYINDEX return false; ArrayMode arrayMode = getArrayModemcurrentInstructionOPCODELENGTHopcall - 2.u.arrayProfile, Array::Write; ... This code always...

CVE-2018-6064

Type Confusion in the implementation of defineGetter in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

UBUNTU-CVE-2018-4200

An issue was discovered in certain Apple products. iOS before 11.3.1 is affected. Safari before 11.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote...