OS Command Injection

git-tags-remote is vulnerable to OS command injection. The vulnerability exists as it does not sanitize the value of repo in index.js, whose value is subsequently passed to an exec call...

curl: Connect-only connections can use the wrong connection

Summary: If a connect-only easy handle is not read from or written to, its connection can time out and be closed. If a new connection is created it can be allocated at the same address, causing the easy handle to use the new connection. This new connection may not be connected to the same server ...

False-positive validity for NFT1 genesis transactions in SLPJS

Impact In the npm package named "slpjs", versions prior to 0.27.4 are vulnerable to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the...

Amazon Linux AMI : git (ALAS-2020-1413)

The version of git installed on the remote host is prior to 2.18.4-2.71. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1413 advisory. Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host...

Command Injection in git-tags-remote

All versions of git-tags-remote are vulnerable to Command Injection. The package fails to sanitize the repository input and passes it directly to an exec call on the get function . This may allow attackers to execute arbitrary code in the system if the repo value passed to the function is...

GHSA-GM9X-Q798-HMR4 Command Injection in git-tags-remote

All versions of git-tags-remote are vulnerable to Command Injection. The package fails to sanitize the repository input and passes it directly to an exec call on the get function . This may allow attackers to execute arbitrary code in the system if the repo value passed to the function is...

Important: git

Issue Overview: Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260GHSA-qm7j-c969-7j4q. The fix for that bug still left the door open for an exploit where some credentia...

NewStart CGSL MAIN 6.01 : git Vulnerability (NS-SA-2020-0036)

The remote NewStart CGSL host, running version MAIN 6.01, has git packages installed that are affected by a vulnerability: - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to...

Lazymux - A Huge List Of Many Hacking Tools And PEN-TESTING Tools

Lazymux tools installer is very easy to use, only provided for lazy termux users; it's huge list of Many Hacking tools and PEN TESTING! NOTE: Am not Responsible of bad use of this project. Requirements • Linux environment • Python 2.x • git Installation and Using Lazymux git clone...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Gitlab

It is an open-source collection of pre-built vulnerable docker environments. The primary CVE ID present in the provided context is CVE-2016-9086. The target product/service or framework is GitLab. The vulnerability class/vector is not explicitly stated, but it is likely related to the mentioned...

git:fuzz-commit-graph: Crash with empty stacktrace

Project: https://github.com/git/git.git Detailed Report: https://oss-fuzz.com/testcase?key=5166823746830336 Project: git Fuzzing Engine: libFuzzer Fuzz Target: fuzz-commit-graph Job Type: libfuzzerasangit Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x61b000004000 Crash State: NULL...

Fedora 31 : coturn (2020-9eadf517de)

Coturn 4.5.1.3 ============== - merge PR 575: Fix rpm packaging - merge PR 576: Tell tar to not include the metadata into release - merge PR 574: Change Docker turnserver.conf to latest turnserver.conf - merge PR 566: Remove reference to SSLv3 - merge PR 579: Ignore MD5 for BoringSSL - merge PR...

Huawei EulerOS: Security Advisory for git (EulerOS-SA-2020-1714)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ZenTao Pro 8.8.2 - Command Injection Exploit

Exploit for php platform in category web applications Exploit Title: ZenTao Pro 8.8.2 - Command Injection Exploit Author: Daniel Monzón & Melvin Boers Vendor Homepage: https://www.zentao.pm/ Version: 8.8.2 Tested on: Windows 10 / WampServer Other versions like pro or enterprise edition could be...

EulerOS Virtualization 3.0.6.0 : git (EulerOS-SA-2020-1714)

According to the version of the git packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of service memory consumption via...

jenkins-git-plugin: stored cross-site scripting

Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cross-site scripting vulnerability...

Huawei EulerOS: Security Advisory for git (EulerOS-SA-2020-1694)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OS Command Injection

git-diff-apply is vulnerable to OS command injection. Lack of validation of untrusted input allows an attacker to inject arbitrary OS command via the affected parameter that is subsequently used in the diff function as a git command...

EulerOS Virtualization for ARM 64 3.0.6.0 : git (EulerOS-SA-2020-1694)

According to the versions of the git packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host...

git:fuzz-commit-graph: Crash in parse_commit_graph

Detailed Report: https://oss-fuzz.com/testcase?key=5174251396268032 Project: git Fuzzing Engine: honggfuzz Fuzz Target: fuzz-commit-graph Job Type: honggfuzzasangit Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7fffe173e000 Crash State: parsecommitgraph fuzz-commit-graph.c...