CVE-2024-24570 Statamic account takeover via XSS and password reset link

Statamic is a Laravel and Git powered CMS. HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects the front-end forms with asset fields without any mime type validation, asset fields in the control panel, and asset browser in the control panel...

CVE-2024-24570

Statamic CMS is affected by a cross-site scripting vulnerability (CVE-2024-24570) where HTML files disguised as JPEGs could be uploaded via front-end asset fields, control-panel asset fields, and the asset browser. The root cause is improper mime-type validation, enabling XSS execution by authent...

OS Command Injection

OpenSSH is susceptible to an OS command injection flaw because it fails to adequately validate user names or host names that include shell metacharacters. This flaw enables attackers to exploit these names through an expansion token in certain scenarios, such as when a submodule in an untrusted G...

Arbitrary File Read

Jenkins Git server Plugin is vulnerable to Information Disclosure. The vulnerability is caused due to a lack of proper input validation in the Git Server Plugin's command parser feature. This allows an attacker with Overall/Read permission to read content from arbitrary files on the Jenkins...

Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

...

Maliciously crafted Git server replies can cause DoS on go-git clients

...

EulerOS 2.0 SP11 : gdb (EulerOS-SA-2024-1104)

According to the versions of the gdb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - GNU gdb GDB 13.0.50.20220805-git was discovered to contain a heap use after free via the function addpeexportedsym at /gdb/coff-pe-read.c...

CVE-2024-23899

A flaw was found in the Git Server Plugin for Jenkins. This issue could allow an attacker to read the first two lines of arbitrary files on the server's file system...

git: data exfiltration with maliciously crafted repository

A vulnerability was found in Git. Using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source $GITDIR/objects directory contains symbolic links CVE-2022-39253, the objects...

git: git apply: a path outside the working tree can be overwritten with crafted input

A vulnerability was found in Git. This security issue occurs when feeding a crafted input to "git apply." A path outside the working tree can be overwritten by the user running "git apply."...

Moderate: Red Hat Security Advisory: git security update

An update for git is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

git: git shell function that splits command arguments can lead to arbitrary heap writes.

Git is an open source, scalable, distributed revision control system. git shell is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the...

git: Bypass of safe.directory protections

A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This issue allows the owner of the repository to cause arbitrary commands to be executed by...

RHEL 8 : git (RHSA-2024:0407)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0407 advisory. Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a...

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (>=2.8, <=2.9), org.waveywaves.jenkins.plugins:tekton-client (1.1.0) potentially affected by CVE-2024-23899 via org.jenkins-ci.plugins:git-server (1.7)

org.jenkins-ci.plugins:git-server MAVEN version 1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-server and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-cps-global-lib =2.8, =2.9 -...

Arbitrary file read vulnerability in Git server Plugin can lead to RCE

Jenkins Git server Plugin uses the args4j library to parse command arguments and options on the Jenkins controller when processing Git commands received via SSH. This command parser has a feature that replaces an @ character followed by a file path in an argument with the file’s contents...

GHSA-VPH5-2Q33-7R9H Arbitrary file read vulnerability in Git server Plugin can lead to RCE

Jenkins Git server Plugin uses the args4j library to parse command arguments and options on the Jenkins controller when processing Git commands received via SSH. This command parser has a feature that replaces an @ character followed by a file path in an argument with the file’s contents...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6) +37 more potentially affected by CVE-2024-23899 via org.jenkins-ci.plugins:git-server (1.5)

org.jenkins-ci.plugins:git-server MAVEN version 1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-server and may be impacted: - com.btc.ep:btc-embeddedplatform =1.9.2-beta, =1.3.0, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2,...

org.biouno:uno-choice (>=1.5-alpha-1, <=1.5.3), org.jenkins-ci.plugins:scriptler (2.9) potentially affected by CVE-2024-23899 via org.jenkins-ci.plugins:git-server (1.6)

org.jenkins-ci.plugins:git-server MAVEN version 1.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-server and may be impacted: - org.biouno:uno-choice =1.5-alpha-1, =1.5.3 - org.jenkins-ci.plugins:scriptler 2.9 Source cves:...

org.jenkins-ci.plugins:templating-engine (>=2.3, <=2.5.3) potentially affected by CVE-2024-23899 via org.jenkins-ci.plugins:git-server (1.9)

org.jenkins-ci.plugins:git-server MAVEN version 1.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-server and may be impacted: - org.jenkins-ci.plugins:templating-engine =2.3, =2.5.3 Source cves: CVE-2024-23899 Source...