PT-2025-28863

Name of the Vulnerable Software and Affected Versions Gitk versions 2.41.0 through 2.43.6 Git versions 2.50.1-alt1 Description Gitk, a Tcl/Tk based Git history browser, contains a flaw where a crafted Git repository can be used to trick a user into executing arbitrary scripts with their user...

curl: Git repository found

Summary: Hello team , When i research I found domain vuln to downliad git repository and i will explain that. Steps To Reproduce: 1. Add DotGit extention on your browser 2. Now try to access to that domain https://curl.dev/ 3. You will show that extention is alert and can download that bucket...

Server Side Request Forgery (SSRF)

@backstage/plugin-scaffolder-node is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper handling of template functionality in the Backstage Scaffolder plugin, which allows Server-Side Template Injection SSTI to be exploited for Git config injection...

Gogs allows argument Injection when tagging new releases

Impact Unprivileged user accounts with at least one SSH key can read arbitrary files on the system. For instance, they could leak the configuration files that could contain database credentials database and security SECRETKEY. Attackers could also exfiltrate TLS certificates, other users'...

CVE-2024-54148 Gogs has a Path Traversal in file editing UI

Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. The vulnerability is fixed in 0.13.1...

Authentication Token Leakage

github.com/cli/cli is vulnerable to authentication token leakage. The vulnerability is due to improper handling of the credential.helper configuration when cloning repositories with git submodules hosted outside of GitHub.com and ghe.com, causing authentication tokens to be exposed...

[SECURITY] Fedora 41 Update: golang-github-chainguard-dev-git-urls-1.0.2-1.fc41

Git-urls parses git URLs...

git-bug-0.8.0+git.1733745604.d499b6e-1.1 on GA media (moderate)

git-bug-0.8.0+git.1733745604.d499b6e-1.1 on GA media Announcement ID: openSUSE-SU-2024:14592-1 Rating: moderate Cross-References: CVE-2024-45337 CVSS scores: CVE-2024-45337 SUSE : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Tumbleweed An update that solves one...

OPENSUSE-SU-2024:14592-1 git-bug-0.8.0+git.1733745604.d499b6e-1.1 on GA media

These are all security issues fixed in the git-bug-0.8.0+git.1733745604.d499b6e-1.1 package on the GA media of openSUSE Tumbleweed...

eza: Arbitrary Code Execution

Background eza is a modern, maintained replacement for ls, written in rust. Description A vulnerability has been discovered in eza. Please review the CVE identifier referenced below for details. Impact A buffer overflow vulnerability in eza allows local attackers to execute arbitrary code via the...

PT-2024-10078 · Drupal · Drupal Git Utilities

Name of the Vulnerable Software and Affected Versions: Drupal Git Utilities for Drupal versions . Description: The issue is related to insufficient protection of service data in the Git Utilities module for the Drupal CMS, which can be exploited by a remote attacker to gain read, modify, or delet...

Drupal Git Utilities for Drupal module * - Authenticated Other Vulnerability Type vulnerability

Authenticated Other Vulnerability Type vulnerability discovered by Drupal Security Site in WordPress Module Git Utilities for Drupal versions...

Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

OS command injection vulnerability in OpenSSH (CVE-2023-51385)

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or...

ruby:3.1 security update

ruby 3.1.5-145 - Fix REXML ReDoS vulnerability. CVE-2024-49761 Resolves: RHEL-68530 3.1.5-144 - Upgrade to Ruby 3.1.5. Resolves: RHEL-33978 - Fix buffer overread vulnerability in StringIO. Resolves: RHEL-34129 - Fix RCE vulnerability with .rdocoptions in RDoc. Resolves: RHEL-34121 - Fix arbitrary...

Security update for obs-scm-bridge

This update for obs-scm-bridge fixes the following issues: Updated to version 0.5.4: - CVE-2024-22038: Fixed DoS attacks, information leaks with crafted Git repositories bnc1230469 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate...

SUSE-SU-2024:4212-1 Security update for obs-scm-bridge

This update for obs-scm-bridge fixes the following issues: Updated to version 0.5.4: - CVE-2024-22038: Fixed DoS attacks, information leaks with crafted Git repositories bnc1230469...

GHSA-QMC2-JPR5-7RG9 Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery

Impact A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these...

Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery

Impact A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these...

CVE-2024-53983

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...