11396 matches found
CVE-2020-15272
In the git-tag-annotation-action open source GitHub Action before version 1.0.1, an attacker can execute arbitrary shell commands if they can control the value of the tag input or manage to alter the value of the GITHUBREF environment variable. The problem has been patched in version 1.0.1. If yo...
Design/Logic Flaw
In the git-tag-annotation-action open source GitHub Action before version 1.0.1, an attacker can execute arbitrary shell commands if they can control the value of the tag input or manage to alter the value of the GITHUBREF environment variable. The problem has been patched in version 1.0.1. If yo...
CVE-2020-15272 Shell-injection in git-tag-annotation GitHub action
In the git-tag-annotation-action open source GitHub Action before version 1.0.1, an attacker can execute arbitrary shell commands if they can control the value of the tag input or manage to alter the value of the GITHUBREF environment variable. The problem has been patched in version 1.0.1. If yo...
CVE-2020-15272
The CVE-2020-15272 entry concerns the git-tag-annotation-action (open source GitHub Action) prior to version 1.0.1. Affected logic allows an attacker to execute arbitrary shell commands if they control the tag input or can alter the GITHUB_REF environment variable. The issue is patched in version...
Debian DLA-2413-1 : phpmyadmin security update
Several vulnerabilities were found in package phpmyadmin. CVE-2019-19617 phpMyAdmin does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes /Footer.php. CVE-2020-26934 A vulnerability was discovered where an attacker can cause an XSS...
Remote Code Execution (RCE)
github.com/gogs/gogs is vulnerable to remote code execution RCE. The vulnerability exists through git hooks which are enabled by default...
Remote Code Execution (RCE)
github.com/go-gitea/gitea is vulnerable to remote code execution RCE. The vulnerability exists through git hooks which are enabled by default...
Gogs OS Command Injection Vulnerability
Gogs Go Git Service is a Go-based self-service Git hosting service , which supports creating and migrating public/private repositories , adding and removing repository collaborators and so on. An operating system command injection vulnerability exists in the git hook feature of Gogs versions 1.1....
TheCl0n3r - Tool To Download And Manage Your Git Repositories
TheCl0n3r will allow you to download and manage your git repositories. Preface About 90% of the penetration testing tools used in my experience can be found primarily on github. The aim of this was to make it easier to download, update and delete these git repositories. If moving to a new testing...
CVE-2020-14144
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLEGITHOOKS line i...
CVE-2020-14144
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLEGITHOOKS line i...
Privilege escalation
The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges. NOTE: because this is mentioned in the documentation but not in th...
Design/Logic Flaw
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLEGITHOOKS line i...
CVE-2020-15867
The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges. NOTE: because this is mentioned in the documentation but not in th...
CVE-2020-15867
Gogs 0.5.5–0.12.2 is vulnerable to authenticated remote code execution via the git hooks feature. The root cause is that privileged users can create git hooks (post-receive) and trigger code execution; non-admin users require explicit permission. The issue is exploitable through the web interface...
CVE-2020-14144
Gitea CVE-2020-14144 (and related CVE-2021-28378 context) reveals authenticated remote code execution via the git hooks feature in Gitea versions 1.1.0–1.12.5. The core issue is that the post-receive hook can execute arbitrary code when a user with privilege triggers it, enabling RCE on the serve...
CVE-2020-14144
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLEGITHOOKS line i...
CVE-2020-14144
DISPUTED The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLEGITHOO...
PT-2020-13891
Name of the Vulnerable Software and Affected Versions Gitea versions 1.1.0 through 1.12.5 Description The git hook feature in Gitea might allow for authenticated remote code execution in customer environments where the documentation was not understood. The vendor has indicated this is not a...