Kubernetes 安全漏洞

Kubernetes K8s is an open source system for automating the deployment, scaling, and management of containerized applications from Kubernetes Open Source. A security vulnerability exists in Kubernetes that stems from allowing arbitrary commands to be executed via a specially crafted gitRepo volume...

GO-2024-3265 Git credentials are exposed in Atlantis logs in github.com/runatlantis/atlantis

Git credentials are exposed in Atlantis logs in github.com/runatlantis/atlantis...

CVE-2024-52600

Statamic CMS has a Path Traversal flaw in asset uploads. Before version 5.17.0, assets uploaded with crafted filenames could be placed outside the intended path, potentially affecting front-end asset forms and other upload points and possibly overwriting existing files. Traversal outside the asse...

CVE-2024-52600 Statamic CMS has Path Traversal in Asset Upload

Statmatic is a Laravel and Git powered content management system CMS. Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with assets fields and other plac...

CVE-2024-52600 Statamic CMS has Path Traversal in Asset Upload

Statmatic is a Laravel and Git powered content management system CMS. Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with assets fields and other plac...

CVE-2022-1884

A remote command execution vulnerability exists in gogs/gogs versions =0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the treepath parameter during file uploads. An attacker can set treepath=.git. to upload a file into the .git directory, allowing...

CVE-2022-1884 Remote Command Execution in gogs/gogs

A remote command execution vulnerability exists in gogs/gogs versions =0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the treepath parameter during file uploads. An attacker can set treepath=.git. to upload a file into the .git directory, allowing...

CVE-2022-1884: Improper Neutralization of Special Elements used in an OS Command

A remote command execution vulnerability exists in gogs/gogs versions =0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the treepath parameter during file uploads. An attacker can set treepath=.git. to upload a file into the .git directory, allowing...

Fedora 37 : git (2022-fb088df94c)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-fb088df94c advisory. Upstream update including security & bug fixes as well as feature enhancements. From the upstream release notes: CVE-2022-39253 -------------- When...

Fedora 41 : golang-github-git-5 (2024-7fecec055b)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-7fecec055b advisory. Automatic update for golang-github-git-5-5.12.0-1.fc41. Changelog Tue Apr 23 2024 Mikel Olasagasti Uranga - 5.12.0-1 - Update to 5.12.0 - Closes...

io.jenkins.plugins:secone-sca-sast-security-scanner (>=13.v31f269d5b_52f, <=45.v14200f5b_4b_33), org.6wind.jenkins:lockable-resources (1301.v0e3b_da_4b_4462) +5 more potentially affected by CVE-2024-52549 via org.jenkins-ci.plugins:script-security (1354.va_70a_fe478c7f)

org.jenkins-ci.plugins:script-security MAVEN version 1354.va70afe478c7f is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:secone-sca-sast-security-scanner =13.v31f269d5b52f,...

de.wellnerbou.jenkins:git-changelog (>=3.0, <=3.31) potentially affected by CVE-2024-52549 via org.jenkins-ci.plugins:script-security (1.46)

org.jenkins-ci.plugins:script-security MAVEN version 1.46 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - de.wellnerbou.jenkins:git-changelog =3.0, =3.31 Source cves: CVE-2024-52549 Source...

com.paul8620.jenkins.plugins:pipeline-aggregator-view (>=114.v98e9735f6193, <=119.v4b_ec11953552), com.tikalk.hudson.plugins:notification (1.18) +20 more potentially affected by CVE-2024-52549 via org.jenkins-ci.plugins:script-security (1341.va_2819b_414686)

org.jenkins-ci.plugins:script-security MAVEN version 1341.va2819b414686 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.paul8620.jenkins.plugins:pipeline-aggregator-view...

PT-2025-12126

Name of the Vulnerable Software and Affected Versions gradio-app/gradio version git 67e4044 Description A flaw in the implementation of the blocked path functionality allows for path traversal on Windows OS. The application fails to block access when using NTFS Alternate Data Streams ADS syntax,...

SUSE CVE-2024-51990

jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause jj to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to upgrade should avoid cloning repos from...

GHSA-88H5-6W7M-5W56 jj vulnerable to path traversal via crafted Git repositories

Impact Specially crafted Git repositories can cause jj to write files outside the clone. Patches Fixed in 0.23.0. Workarounds Not much other than to not clone repositories from untrusted sources. References Here's the original report from @joernchen: When cloning a crafted Git repository it is...

jj vulnerable to path traversal via crafted Git repositories

Impact Specially crafted Git repositories can cause jj to write files outside the clone. Patches Fixed in 0.23.0. Workarounds Not much other than to not clone repositories from untrusted sources. References Here's the original report from @joernchen: When cloning a crafted Git repository it is...

CVE-2024-51990

jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause jj to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to upgrade should avoid cloning repos from...

CVE-2024-51990 Path traversal via crafted Git repositories in jj

jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause jj to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to upgrade should avoid cloning repos from...

CVE-2024-51990 Path traversal via crafted Git repositories in jj

jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause jj to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to upgrade should avoid cloning repos from...