Kubernetes 安全漏洞

Kubernetes K8s is an open source system for automating the deployment, scaling, and management of containerized applications from the Kubernetes open source. A security vulnerability exists in Kubernetes that stems from the use of the deprecated in-tree gitRepo volume feature, which could lead to...

curl: Git repository found

Summary: Hello team , When i research I found domain vuln to downliad git repository and i will explain that. Steps To Reproduce: 1. Add DotGit extention on your browser 2. Now try to access to that domain https://curl.dev/ 3. You will show that extention is alert and can download that bucket...

OS command injection vulnerability in OpenSSH (CVE-2023-51385)

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or...

SUSE Manager 后置链接漏洞

SUSE Manager is a Linux server management system from SUSE Germany. The system provides automated software management, system configuration and monitoring. SUSE Manager suffers from a back-link vulnerability that originates from an attacker who is allowed to create a specially crafted git...

AZL-53652 CVE-2024-10220 affecting package kubernetes for versions less than 1.28.4-14

The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2...

Kubernetes 安全漏洞

Kubernetes K8s is an open source system for automating the deployment, scaling, and management of containerized applications from Kubernetes Open Source. A security vulnerability exists in Kubernetes that stems from allowing arbitrary commands to be executed via a specially crafted gitRepo volume...

GHSA-88H5-6W7M-5W56 jj vulnerable to path traversal via crafted Git repositories

Impact Specially crafted Git repositories can cause jj to write files outside the clone. Patches Fixed in 0.23.0. Workarounds Not much other than to not clone repositories from untrusted sources. References Here's the original report from @joernchen: When cloning a crafted Git repository it is...

Jujutsu 路径遍历漏洞

Jujutsu is a powerful version control system for software projects from the individual developer Martin von Zweigbergk. A path traversal vulnerability previously existed in Jujutsu version 0.23.0, which stems from the fact that a specially crafted Git repository could cause jj to write files...

The vulnerability of the Gogs self-managed Git repository creation software lies in the possibility of manipulating arguments, allowing a hacker to execute arbitrary commands.

The vulnerability of the Gogs self-managed Git repository creation software is related to the implementation or modification of arguments. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary commands...

Information Disclosure

github.com/docker/docker is vulnerable to Information Disclosure. The vulnerability is due to the unexpected inclusion of arbitrary filesystem paths in the build context when exploited by a malicious Git repository. Attackers can use this to include sensitive files in the build context without th...

CVE-2024-29737 Apache StreamPark (incubating): maven build params could trigger remote command execution

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...

CVE-2024-29737

CVE-2024-29737 concerns a command-injection flaw in Apache StreamPark (Project module). The vulnerability arises from lax validation of build parameters in the Maven integration, allowing an authenticated user with system-level permissions to inject commands via the Build Argument (demonstrated b...

CVE-2024-29737 Apache StreamPark (incubating): maven build params could trigger remote command execution

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...

HuggingFace Git Repo Detection for Linux/UNIX

Binary data huggingfacegitdetectnix.nbin...

GO-2024-2934 Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder...

Minder Security Vulnerability

Minder is an open source platform that helps development teams and the open source community build more secure software and prove to others that the software they build is secure. A security vulnerability exists in versions prior to Minder v0.0.52 that stems from a maliciously configured Git...

BIT-COMPOSER-2024-35242 Composer vulnerable to command injection via malicious git/hg branch names

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the composer install command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are availab...

DEBIAN-CVE-2024-35242

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the composer install command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are availab...

EUVD-2024-2177

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the composer install command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are availab...

CVE-2024-35242

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the composer install command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are availab...