11397 matches found
h1-ctf: [H1-2006 2020] The Story of Making Bounty Hunters Happy
Disclaimer: I will try to make this post a fun read, given that whoever triagges will be probably going through similar write-ups again and again. The beginning: Being away from HackerOne over a month had made me rusty. Although the call to arms for Mr. Mickos and the community could not be left...
h1-ctf: [H1-2006 2020] CTF Writeup!
The Beginning ===================== The scope of the H1-2006 CTF was .bountypay.h1ctf.com. After opening https://bountypay.h1ctf.com, I noticed that on the top left of the screen there was a dropdown with two login pages: one for Customers https://app.bountypay.h1ctf.com/ and one for Staff...
CentOS: Security Advisory for emacs-git (CESA-2020:2337)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
EulerOS 2.0 SP5 : git (EulerOS-SA-2020-1598)
According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This...
CentOS 7 : git (RHSA-2020:2337)
The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2337 advisory. - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is...
emacs, git, gitk, gitweb, perl security update
CentOS Errata and Security Advisory CESA-2020:2337 An update for git is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
snyk-broker information disclosure vulnerability (CNVD-2020-54144)
snyk-broker is a proxy program for access between snyk.io and Git repositories. A security vulnerability exists in snyk-broker version 4.72.0 and later fixed in version 4.73.1. An attacker can exploit the vulnerability to read arbitrary files...
Scientific Linux Security Update : git on SL7.x x86_64 (20200529)
Security Fixes : - git: Crafted URL containing new lines, empty host or lacks a scheme can cause credential leak CVE-2020-11008 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid136991; scriptversion"1.3";...
pcapplusplus:FuzzTarget: Bad-cast to pcpp::IDnsResource from invalid vptr in pcpp::DnsLayer::~DnsLayer
Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=5187603245826048 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTarget Job Type: libfuzzerubsanpcapplusplus Platform Id: linux Crash Type: Bad-cast Crash Address: 0x00000263260...
git security update
1.8.3.1-23 - Prevent crafted URL containing new lines, empty host or lacks a scheme to cause credential leak. Resolves: CVE-2020-11008...
Oracle Linux 7 : git (ELSA-2020-2337)
The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-2337 advisory. 1.8.3.1-23 - Prevent crafted URL containing new lines, empty host or lacks a scheme to cause credential leak. Resolves: CVE-2020-11008 Tenable has extracted the...
Important: Red Hat Security Advisory: git security update
An update for git is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...
Node.js third-party modules: [commit-msg] RCE via insecure command formatting
I would like to report a RCE issue in the commit-msg module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: commit-msg version: 0.2.3 npm page: https://www.npmjs.com/package/commit-msg Module Description commit-msg is a customizable git commit message...
Huawei EulerOS: Security Advisory for git (EulerOS-SA-2020-1578)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
EulerOS 2.0 SP8 : git (EulerOS-SA-2020-1578)
According to the version of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bu...
Node.js third-party modules: [last-commit-log] Command Injection
I would like to report Command Injection in last-commit-log It allows execution of arbitrary commands Module module name: last-commit-log version: [email protected] npm page: https://www.npmjs.com/package/last-commit-log Module Description Node.js module to get the last git commit information...
SUSE SLES12 Security Update : git (SUSE-SU-2020:1295-1)
This update for git to 2.26.2 fixes the following issues : Security issue fixed : CVE-2020-11008: Specially crafted URLs may have tricked the credentials helper to providing credential information that is not appropriate for the protocol in use and host being contacted bsc1169936. Non-security...
About the security content of Xcode 11.5 - Apple Support
About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. Apple security documents reference...
About the security content of Xcode 11.5
About the security content of Xcode 11.5 This document describes the security content of Xcode 11.5 About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...
