CVE-2024-53983 Server-side request forgery in Backstage Scaffolder plugin

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

CVE-2024-53983 Server-side request forgery in Backstage Scaffolder plugin

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

CVE-2024-53983

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

CVE-2024-53983 Server-side request forgery in Backstage Scaffolder plugin

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

CVE-2024-53983

The CVE concerns Backstage Scaffolder template handling where Server-Side Template Injection (SSTI) can be abused to inject Git config and capture privileged Git tokens used by the Backstage Scaffolder plugin. This enables unauthorized access to Git resources, with a medium impact per the Backsta...

CVE-2024-53983: Server-Side Request Forgery (SSRF)

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

Backstage Code Issues and Vulnerabilities

Backstage is a Backstage open source application. Backstage is an open platform for building developer portals. Backstage has a code issue vulnerability that stems from the ability to perform Git configuration injection using server-side template injection, allowing an attacker to capture...

CVE-2024-22038

Various problems in obs-scm-bridge allows attackers that create specially crafted git repositories to leak information of cause denial of service...

CVE-2024-22038 DoS attacks, information leaks etc. with crafted Git repositories in obs-scm-bridge

Various problems in obs-scm-bridge allows attackers that create specially crafted git repositories to leak information of cause denial of service...

CVE-2024-22038 DoS attacks, information leaks etc. with crafted Git repositories in obs-scm-bridge

Various problems in obs-scm-bridge allows attackers that create specially crafted git repositories to leak information of cause denial of service...

CVE-2024-22038: Improper Link Resolution Before File Access

Various problems in obs-scm-bridge allows attackers that create specially crafted git repositories to leak information of cause denial of service...

SUSE Manager post-link vulnerability

SUSE Manager is a Linux server management system from SUSE Germany. The system provides automated software management, system configuration and monitoring. SUSE Manager suffers from a back-link vulnerability that originates from an attacker who is allowed to create a specially crafted git...

AZL-53477 CVE-2024-53858 affecting package gh for versions less than 2.62.0-5

The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several gh commands...

CVE-2024-53858 Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cli

The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several gh commands...

CVE-2024-53858

The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing "git" submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several "gh" comman...

CVE-2024-53858

The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several gh commands...

CVE-2024-53858: Exposure of Sensitive Information to an Unauthorized Actor

The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several gh commands...

CVE-2024-43784

lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this vulnerability. When creating a new user with the same username as a deleted user, that user will inherit a...

CVE-2024-43784

CVE-2024-43784 affects lakeFS: when creating a new user with a username that previously belonged to a deleted user, the new user inherits all of the deleted user’s credentials. This is fixed in lakeFS release v1.33.0 and later. Affected users should upgrade to ≥1.33.0; if upgrading is not possibl...

SourceTree Code Execution

The vulnerability of the visual Git client SourceTree is related to incorrect code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...