CVE-2023-42798

AutomataCI is exposed to a release-job issue in 1.4.1 and earlier where the release job can reset the repo root to the very first commit. A fix exists in version 1.5.0. The recommended workaround is to ensure the PROJECT_PATH_RELEASE (e.g., releases/) directory is manually and actually git-cloned...

CVE-2023-42798 AutomataCI Release Job Can Revert Repo to First Commit

AutomataCI is a template git repository equipped with a native built-in semi-autonomous CI tools. An issue in versions 1.4.1 and below can let a release job reset the git root repository to the first commit. Version 1.5.0 has a patch for this issue. As a workaround, make sure the PROJECTPATHRELEA...

CVE-2023-42798 AutomataCI Release Job Can Revert Repo to First Commit

AutomataCI is a template git repository equipped with a native built-in semi-autonomous CI tools. An issue in versions 1.4.1 and below can let a release job reset the git root repository to the first commit. Version 1.5.0 has a patch for this issue. As a workaround, make sure the PROJECTPATHRELEA...

CVE-2023-42798

AutomataCI is a template git repository equipped with a native built-in semi-autonomous CI tools. An issue in versions 1.4.1 and below can let a release job reset the git root repository to the first commit. Version 1.5.0 has a patch for this issue. As a workaround, make sure the PROJECTPATHRELEA...

PT-2023-28585 · Unknown · Automataci

Name of the Vulnerable Software and Affected Versions: AutomataCI versions 1.4.1 and below Description: An issue in AutomataCI can let a release job reset the git root repository to the first commit. This is a concern for versions prior to 1.5.0. To mitigate this, ensure the PROJECT PATH RELEASE...

AutomataCI Input Validation Error Vulnerability

AutomataCI is a template git repository by the individual developer HollowayKeanHo. An input validation error vulnerability exists in AutomataCI 1.4.1 and earlier versions, which stems from allowing the release job function to reset the git root repository...

CVE-2023-42798: Improper Input Validation

AutomataCI is a template git repository equipped with a native built-in semi-autonomous CI tools. An issue in versions 1.4.1 and below can let a release job reset the git root repository to the first commit. Version 1.5.0 has a patch for this issue. As a workaround, make sure the PROJECTPATHRELEA...

Arbitrary File Overwrite

org.eclipse.jgit is vulnerable to Arbitrary File Overwrite. The vulnerability is due to a symbolic link present in a specially crafted git repository which can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive filesystem...

Arbitrary Argument Injection

blamer is vulnerable to Arbitrary Argument Injection. The vulnerability is due to blameByFile API not properly sanitizing the user input and validating the give file path. This can be exploited by the attacker by using he double-dash POSIX character -- to pass malicious command line arguments to...

blamer vulnerable to Arbitrary Argument Injection via the blameByFile() API

Versions of the blamer package before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the...

GHSA-6F9P-G466-F8V8 blamer vulnerable to Arbitrary Argument Injection via the blameByFile() API

Versions of the blamer package before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the...

CVE-2023-26143

Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the...

CVE-2023-26143

Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the...

CVE-2023-26143

Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the...

CVE-2023-26143

Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the...

CVE-2023-26143: Improper Neutralization of Argument Delimiters in a Command

Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the...

org.apache.sshd:sshd-git (0.12.0), org.eclipse.jgit:org.eclipse.jgit.ant (3.4.0.201405281120-rc2) +9 more potentially affected by CVE-2023-4759 via org.eclipse.jgit:org.eclipse.jgit (3.4.0.201405281120-rc2)

org.eclipse.jgit:org.eclipse.jgit MAVEN version 3.4.0.201405281120-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jgit:org.eclipse.jgit and may be impacted: - org.apache.sshd:sshd-git 0.12.0 - org.eclipse.jgit:org.eclipse.jgit.ant...

com.github.putpixel:git-file-loader (>=1.4, <=1.5), com.intershop.gradle.buildinfo:com.intershop.gradle.buildinfo.gradle.plugin (>=1.0.2-local, <=1.0.3) +51 more potentially affected by CVE-2023-4759 via org.eclipse.jgit:org.eclipse.jgit (4.2.0.201601211800-r)

org.eclipse.jgit:org.eclipse.jgit MAVEN version 4.2.0.201601211800-r is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jgit:org.eclipse.jgit and may be impacted: - com.github.putpixel:git-file-loader =1.4, =1.0.2-local, =1.0.0, =1.2.1, =2.0.6...

Arbitrary File Overwrite in Eclipse JGit

Arbitrary File Overwrite in Eclipse JGit = 6.6.0 In Eclipse JGit, all versions = 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive...

CVE-2023-4759

Arbitrary File Overwrite in Eclipse JGit = 6.6.0 In Eclipse JGit, all versions = 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive...