146 matches found
CentOS Linux 7 [TuxCare] Security Update: emacs-git-el / git-daemon / git-email / git-hg / git-p4 / git-svn / etc (CENTOS7:CLSA-2025:1752655814)
The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1752655814 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900...
Astra Linux – Vulnerability in python-pip
When installing a package from a Mercurial VCS URL e.g., “pip install hg+…” using pip before version 23.3, the specified Mercurial revision could be used to inject arbitrary configuration options into the “hg clone” call e.g., “--config”. Controlling the Mercurial configuration allows modifying t...
Malicious code in hg-icons-2 (npm)
The package communicates with a domain associated with malicious activity. --- Credit: OpenSSF source...
CVE-2026-67434
PHPCodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHPCodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running...
HG Configuration - Detect
HG configuration was detected. !/usr/bin/env python3 -- coding: utf-8 -- """HG configuration was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HG Configuration - Detect', 'description': 'HG configuration...
📄 Tenda HG7 / HG9 / HG10 Buffer Overflow
This Python script is a multi-mode framework targeting an alleged stack-based buffer overflow vulnerability in the /boaform/formDOMAINBLK endpoint of certain Tenda HG-series routers...
Malware in @hg-aka-prml/tapas-common
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Command injection in libvcs and vcspull
The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...
PT-2026-53632
The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update repo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...
SUSE-SU-2026:1970-1 Security update for php-composer2
This update for php-composer2 fixes the following issues - CVE-2026-40176: command injection via malicious Perforce repository definition bsc1262254. - CVE-2026-40261: command injection via malicious Perforce source reference/url bsc1262255. Changes for php-composer2: - version update to 2.2.27...
EUVD-2018-19612
Malware in sbrugna...
EUVD-2022-0137
Malicious code in bioql PyPI...
EUVD-2022-0047
Malicious code in bioql PyPI...
EUVD-2022-1732
Malicious code in bioql PyPI...
EUVD-2022-1643
Malicious code in bioql PyPI...
EUVD-2025-22916
Malicious code in bioql PyPI...
JetBrains TeamCity Information Disclosure Vulnerability
JetBrains TeamCity is a Continuous Integration CI/CD tool developed by JetBrains, Inc. to automate the software build, test and deployment process. JetBrains TeamCity suffers from an information disclosure vulnerability that stems from an hg pull command line parameter resulting in an exposed...
CVE-2025-54538: Cleartext Storage of Sensitive Information
In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command...
