GHSA-3872-F48P-PXQJ Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate

Impact Weblate didn't correctly sanitize some arguments passed to Git and Mercurial, which allowed changing their behavior in an unintended way. Patches The issues were fixed in the 4.11.1 release. The following commits are addressing it: 35d59f1f040541c358cece0a8d4a63183ca919b8...

CVE-2022-23915

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution...

PYSEC-2022-31

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution...

Remote code execution

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution...

PYSEC-2022-31

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution...

CVE-2022-23915

CVE-2022-23915 affects Weblate versions 0 through 4.11.0, allowing an authenticated user to trigger Remote Code Execution via argument injection when using Git or Mercurial repositories. The root cause is improper handling of arguments passed to VCS commands, enabling unintended behavior and comm...

CVE-2022-23915 Remote Code Execution (RCE)

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution...

CVE-2022-23915 Remote Code Execution (RCE)

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution...

CVE-2022-23915

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution...

PYSEC-2022-162

Weblate is a web based localization tool with tight version control integration. Prior to version 4.11.1, Weblate didn't properly sanitize some arguments passed to Git and Mercurial, allowing them to change their behavior in an unintended way. Instances where untrusted users cannot create new...

PYSEC-2022-162

Weblate is a web based localization tool with tight version control integration. Prior to version 4.11.1, Weblate didn't properly sanitize some arguments passed to Git and Mercurial, allowing them to change their behavior in an unintended way. Instances where untrusted users cannot create new...

PT-2022-16332 · Weblate · Weblate

Name of the Vulnerable Software and Affected Versions: Weblate versions 0 through 4.11.1 Description: The issue allows Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users can change the behavior of the application in an unintended way,...

PT-2022-16834 · Weblate · Weblate

Name of the Vulnerable Software and Affected Versions: Weblate versions prior to 4.11.1 Description: Weblate is a web-based localization tool with tight version control integration. Prior to version 4.11.1, Weblate didn't properly sanitize some arguments passed to Git and Mercurial, allowing them...

Command Injection

Overview cocoapods-downloader is an A small library for downloading files from remotes in a folder. Affected versions of this package are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocessoptions function and using git, both the git and branch...

CVE-2021-45864

tsMuxer git-c6a0277 was discovered to contain a segmentation fault via DTSStreamReader::findFrame in dtsStreamReader.cpp...

Design/Logic Flaw

tsMuxer git-c6a0277 was discovered to contain a segmentation fault via DTSStreamReader::findFrame in dtsStreamReader.cpp...

CVE-2021-45863

The CVE-2021-45863 entry concerns tsMuxer git-2678966, where a heap-based buffer overflow is triggered via HevcUnit::updateBits in hevc.cpp. Connected sources corroborate the vulnerability in the tsMuxer project, describing a heap overflow in the HevcUnit::updateBits path. The NVD entry lists imp...

CVE-2021-45860

CVE-2021-45860 affects tsMuxer (git-2678966) and is due to an integer overflow in DTSStreamReader::findFrame(). The vulnerability can be triggered by processing a crafted input file, leading to a Denial of Service (DoS). The provided sources corroborate the component (DTSStreamReader::findFrame),...

CVE-2021-45861

There is an Assertion num = INTBIT' failed at BitStreamReader::skipBits in /bitStream.h:132 of tsMuxer git-c6a0277...

Improper Preservation of Permissions

Git repository found Description: Git metadata directory .git was found in this folder. An attacker can extract sensitive information by requesting the hidden metadata directory that version control tool Git creates. The metadata directories are used for development purposes to keep track of...