CVE-2025-12472

The CVE-2025-12472 vulnerability affects Looker LookML projects where an attacker with a Looker Developer role can trigger a race condition during Git directory deletion, potentially allowing arbitrary command execution on Looker instances. Public disclosures from NVD/Looker/RH ENISA indicate Loo...

CVE-2025-12472 Remote Code Execution in Looker due to Improperly Validated Directory Deletion

An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for...

MAL-2025-191158 Malicious code in CodeInKlingon.git-worktree-menu (VSCode:https://open-vsx.org)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 68ef1fadb311fcf38b0a3d9f7e7845c12f201bfdab9556387e9a8b052cec8ee5 This extension is malicious. When installed it runs an info stealer that exfiltrates user data including credentials and cryptocurrency...

PT-2025-47449

An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for...

Google Cloud Looker 安全漏洞

Google Cloud Looker is an online tool from Google USA for transforming data into customizable and informative reports and dashboards. A security vulnerability exists in Google Cloud Looker that stems from the Looker Developer role that can manipulate LookML projects to take advantage of competing...

CVE-2025-12472: Concurrent Execution using Shared Resource with Improper Synchronization

An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for...

KLA90930 OSI vulnerability in Git for Windows

Information disclosure vulnerability was found in Git for Windows. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories Git for Windows 2.52.0 Exploitation Public exploits exist for this vulnerability. Related products Git-for-Windows CVE list...

CVE-2025-13209

CVE-2025-13209 affects bestfeng oa_git_free up to version 9.5. The vulnerability lies in the updateWriteBack function (file yimioa-oa9.5/server/c-flow/src/main/java/com/cloudweb/oa/controller/WorkflowPredefineController.java), where manipulation of the writeProp argument can trigger an XML Extern...

PT-2025-47061

Name of the Vulnerable Software and Affected Versions bestfeng oa git free versions up to 9.5 Description A flaw exists in bestfeng oa git free up to version 9.5. The issue is related to the manipulation of the writeProp argument within the updateWriteBack function located in the file...

oa_git_free 代码问题漏洞

bestfeng oagitfree line cloud process engine is an enterprise automation process platform from China Cloud OA bestfeng company. A code issue vulnerability exists in oagitfree 9.5 and earlier versions, which originates from the parameter in the file...

HSEC-2023-0011 git-annex GPG decryption attack via compromised remote

git-annex GPG decryption attack via compromised remote A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's GPG key. This attack could be used to expose encrypted data that was never stored in git-annex. Daniel Dent discovered this...

HSEC-2023-0009 git-annex command injection via malicious SSH hostname

git-annex command injection via malicious SSH hostname git-annex was vulnerable to the same class of security hole as git's CVE-2017-1000117. In several cases, git-annex parses a repository URL, and uses it to generate a ssh command, with the hostname to ssh to coming from the URL. If the hostnam...

HSEC-2023-0013 git-annex plaintext storage of embedded credentials on encrypted remotes

git-annex plaintext storage of embedded credentials on encrypted remotes git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the embedded AWS credentials were stored in the Git repository in effectively...

HSEC-2023-0012 git-annex checksum exposure to encrypted special remotes

git-annex checksum exposure to encrypted special remotes A bug exposed the checksum of annexed files to encrypted special remotes, which are not supposed to have access to the checksum of the un-encrypted file. This only occurred when resuming uploads to the encrypted special remote, so it is...

[SECURITY] Fedora 42 Update: gitleaks-8.29.0-1.fc42

Scan git repos or files for secrets using regex and entropy...

Argument Injection

@conventional-changelog/git-client is vulnerable to Argument Injection. The vulnerability is due to improper handling of user-controlled parameters in the getTags API, due to the library failing to sanitize input, allowing attackers to inject arbitrary git arguments such as --output= and overwrit...

Photon OS 5.0: Git PHSA-2025-5.0-0672

An update of the git package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0672. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid27531...

[SECURITY] Fedora 43 Update: forgejo-13.0.2-1.fc43

Forgejo pronounced /for=CB=88d=CD=A1=CA=92e.jo/ is a lightweight software f orge. Use it to host git repositories, track their issues and allow people to contribute to them!...

EulerOS 2.0 SP12 : git (EulerOS-SA-2025-2323)

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command...

EulerOS 2.0 SP12 : git (EulerOS-SA-2025-2354)

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command...