Chrome for Android Update

Hi, everyone! We've just released Chrome 86 86.0.4240.99 for Android: it'll become available on Google Play over the next few weeks. This release includes Security, stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let u...

Sensitive data exposure in NATS

Preview versions of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server; for one package, this includes TLS private credentials. The connection configuration options in these JavaScript-based implementations were...

Gitea Git Hooks Remote Code Execution

This module leverages an insecure setting to get remote code execution on the target OS in the context of the user running Gitea. This is possible when the current user is allowed to create git hooks, which is the default for administrative users. For non-administrative users, the permission need...

Gogs Git Hooks Remote Code Execution

This module leverages an insecure setting to get remote code execution on the target OS in the context of the user running Gogs. This is possible when the current user is allowed to create git hooks, which is the default for administrative users. For non-administrative users, the permission needs...

[SECURITY] Fedora 31 Update: ghc-cmark-gfm-0.2.2-1.fc31

This package provides Haskell bindings for , the reference parser for , a fully specified variant of Markdown. It includes sour ces for libcmark-gfm 0.29.0.gfm.0 and does not require prior installation of the C library...

[SECURITY] Fedora 33 Update: gitit-0.13.0.0-4.fc33

Gitit is a wiki backed by a git, darcs, or mercurial filestore. Pages and uploaded files can be modified either directly via the VCS's command-line t ools or through the wiki's web interface. Pandoc is used for markup processing, so pages may be written in extended markdown, reStructuredText,...

[SECURITY] Fedora 33 Update: ghc-cmark-gfm-0.2.2-1.fc33

This package provides Haskell bindings for , the reference parser for , a fully specified variant of Markdown. It includes sour ces for libcmark-gfm 0.29.0.gfm.0 and does not require prior installation of the C library...

Huawei EulerOS: Security Advisory for git (EulerOS-SA-2020-2111)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP3 : git (EulerOS-SA-2020-2111)

According to the version of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git use...

Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation resulting in a stored cross-site scripting vulnerability.

...

An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to obtain a list of nodes and users.

...

A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier

...

Stack-based buffer overflow in the is_git_directory function in setup.c in Git before 1.7.2.1 allows local users to gain privileges via a long gitdir: field in a .git file in a working copy.

...

A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java, GitBlitRepositoryBrowser.java, Gitiles.java, TFS2013GitRepositoryBrowser.java, ViewGitWeb.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.

...

CVE-2020-15187

In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a local execution attack. To perform thi...

Arbitrary Code Execution

Git execute arbitrary commands via a tree containing a crafted .git/config file with 1 an ignorable Unicode codepoint, 2 a git1/config representation, or 3 mixed case that is improperly handled on a case-insensitive filesystem...

Security update for fossil (important)

openSUSE Security Update: Security update for fossil Announcement ID: openSUSE-SU-2020:1478-1 Rating: important References: 1047218 1175760 Cross-References: CVE-2020-24614 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 An upda...

PT-2020-14258 · Helm +2 · Helm +2

Name of the Vulnerable Software and Affected Versions: Helm versions prior to 2.16.11 Helm versions prior to 3.3.2 Description: A Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs...

Command injection

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not validating a Deploy-Token and allowed a disabled repository be accessible via a git command line...

CVE-2020-13316

CVE-2020-13316 affects GitLab versions before 13.1.10, 13.2.8, and 13.3.4. The root cause is that Deploy-Token validation was not performed, allowing access to a disabled repository via a git command line. The impact is exposure of otherwise inaccessible repositories, enabling an attacker with ne...