11293 matches found
CVE-2022-36069
Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as git clone. These commands are constructed using user input e.g. the repository URL. When building the commands, Poetry correctly avoid...
PYSEC-2022-266
Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as git clone. These commands are constructed using user input e.g. the repository URL. When building the commands, Poetry correctly avoid...
UBUNTU-CVE-2022-36069
Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as git clone. These commands are constructed using user input e.g. the repository URL. When building the commands, Poetry correctly avoid...
CVE-2022-36069
Poetry (Python) is affected by CVE-2022-36069 where dependency handling from Git repositories can trigger arbitrary code execution if a repository URL or input starts with a dash, causing certain commands (e.g., git clone) to be parsed as options rather than positional arguments. The root cause i...
CVE-2022-36069
Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as git clone. These commands are constructed using user input e.g. the repository URL. When building the commands, Poetry correctly avoid...
CVE-2022-36069 Poetry Argument Injection vulnerability can lead to local Code Execution
Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as git clone. These commands are constructed using user input e.g. the repository URL. When building the commands, Poetry correctly avoid...
CVE-2022-36069 Poetry Argument Injection vulnerability can lead to local Code Execution
Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as git clone. These commands are constructed using user input e.g. the repository URL. When building the commands, Poetry correctly avoid...
CVE-2022-36070 Poetry's Untrusted Search Path can lead to Local Code Execution on Windows
Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. git config. These commands are being executed using the executable’s name and not its absolute path. This can lead to the execution of untrusted code due to th...
CVE-2022-36070
CVE-2022-36070 affects Poetry (Python dependency manager). When handling Git-based dependencies, Poetry runs commands by executable name (not absolute path), enabling Windows’ path resolution to execute untrusted binaries in the current directory. This can lead to Arbitrary Code Execution with lo...
CVE-2022-36070
Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. git config. These commands are being executed using the executable’s name and not its absolute path. This can lead to the execution of untrusted code due to th...
CVE-2022-36070 Poetry's Untrusted Search Path can lead to Local Code Execution on Windows
Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. git config. These commands are being executed using the executable’s name and not its absolute path. This can lead to the execution of untrusted code due to th...
CVE-2022-36070 Poetry's Untrusted Search Path can lead to Local Code Execution on Windows
Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. git config. These commands are being executed using the executable’s name and not its absolute path. This can lead to the execution of untrusted code due to th...
Amazon Linux 2022 : git, git-all, git-core (ALAS2022-2022-118)
It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-118 advisory. A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration...
The Bug Report – August 2022 Edition
The Bug Report — August 2022 Edition By Philippe Laulheret · September 7, 2022 Your Cybersecurity Comic Relief Figure 0: CVE-2022-38392 redefines “destructive interference” Why am I here? Indeed, why are we here? School is back in session, there’s a chill in the air that says fall is around the...
PT-2022-23156
Name of the Vulnerable Software and Affected Versions Poetry versions prior to 1.1.9 Poetry versions prior to 1.2.0b1 Description Poetry is a dependency manager for Python that uses various commands, such as git clone, when handling dependencies from a Git repository. The commands are constructed...
Amazon Linux 2022 : git, git-all, git-core (ALAS2022-2022-067)
It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-067 advisory. A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration...
Amazon Linux 2022 : fish (ALAS2022-2022-056)
It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-056 advisory. fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of gi...
USN-5216-1: hosted-git-info vulnerability
It was discovered that hosted-git-info incorrectly handled certain inputs. A remote attacker could use this to cause a denial of service...
