Command Injection

Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Command Injection via argument injection. When calling the .fetchremote, branch, handlerFn function, both the remote and branch parameters are...

@cronapp/devops (>=0.0.1, <=0.0.63), @k186/cli-service (>=2.0.8, <=4.2.0) +36 more potentially affected by CVE-2022-24433 via simple-git (>=3.0.3, <=3.2.6)

simple-git NPM version =3.0.3, =0.0.1, =2.0.8, =1.0.3, =2.0.8, =2.0.0, =2.0.0, =1.0.3, =1.0.3, =1.0.3, =1.0.3, =1.0.4, =1.0.7, =1.0.3, =1.0.3, =1.0.3, =4.2.0 and more Source cves: CVE-2022-24433 Source advisory: SNYK:JS-SIMPLEGIT-2421199...

PT-2022-16694 · Unknown · Simple-Git

Name of the Vulnerable Software and Affected Versions: simple-git versions prior to 3.3.0 Description: The issue allows for Command Injection via argument injection. When calling the fetch function with parameters remote, branch, and handlerFn, both the remote and branch parameters are passed to...

simple-git-hooks 参数注入漏洞

simple-git-hooks is an application. A simple git hooks manager for small projects A parameter injection vulnerability exists in simple-git-hooks, which stems from the fact that when the .fetchremote, branch, handlerFn function is called, both the remote and branch parameters are passed to the git...

Gogs 代码问题漏洞

Gogs Go Git Service is a Go-based self-service Git hosting service from the GOGS team that supports creating and migrating public/private repositories, adding and removing repository collaborators, and more. A security vulnerability exists in Gogs versions prior to 0.12.5, which stems from the la...

jenkins-2-plugins/git: stored XSS vulnerability

A stored cross-site scripting XSS vulnerability was found in the Jenkins Git plugin. Due to not escaping the Git SHA-1 checksum parameters provided to commit notifications, an attacker is able to submit crafted commit notifications to the /git/notifyCommit endpoint...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.10.3 bug fix and security update

Red Hat OpenShift Container Platform release 4.10.3 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.10. Red Hat Product Security has rated this update as having a...

Exploit for OS Command Injection in Gitea

CVE-2020-14144 - GiTea authenticated RCE A script to explo...

PyShell - Multiplatform Python WebShell

PyShell is Multiplatform Python WebShell. This tool helps you to obtain a shell-like interface on a web server to be remotely accessed. Unlike other webshells, the main goal of the tool is to use as little code as possible on the server side, regardless of the language used or the operating syste...

CVE-2022-0869

Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3...

Duplicate Advisory: Command injection in Weblate

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3872-f48p-pxqj. This link is maintained to preserve external references. Original Description Weblate is a web based localization tool with tight version control integration. Prior to version 4.11.1, Weblate...

Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate

Impact Weblate didn't correctly sanitize some arguments passed to Git and Mercurial, which allowed changing their behavior in an unintended way. Patches The issues were fixed in the 4.11.1 release. The following commits are addressing it: 35d59f1f040541c358cece0a8d4a63183ca919b8...

GHSA-3872-F48P-PXQJ Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate

Impact Weblate didn't correctly sanitize some arguments passed to Git and Mercurial, which allowed changing their behavior in an unintended way. Patches The issues were fixed in the 4.11.1 release. The following commits are addressing it: 35d59f1f040541c358cece0a8d4a63183ca919b8...

CVE-2022-23915

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution...

PYSEC-2022-31

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution...

Remote code execution

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution...

PYSEC-2022-31

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution...

CVE-2022-23915

CVE-2022-23915 affects Weblate versions 0 through 4.11.0, allowing an authenticated user to trigger Remote Code Execution via argument injection when using Git or Mercurial repositories. The root cause is improper handling of arguments passed to VCS commands, enabling unintended behavior and comm...

CVE-2022-23915 Remote Code Execution (RCE)

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution...

CVE-2022-23915 Remote Code Execution (RCE)

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution RCE via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution...