143 matches found
CentOS Linux 7 [TuxCare] Security Update: emacs-git-el / git-daemon / git-email / git-hg / git-p4 / git-svn / etc (CENTOS7:CLSA-2025:1752655814)
The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1752655814 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900...
Astra Linux – Vulnerability in python-pip
When installing a package from a Mercurial VCS URL e.g., “pip install hg+…” using pip before version 23.3, the specified Mercurial revision could be used to inject arbitrary configuration options into the “hg clone” call e.g., “--config”. Controlling the Mercurial configuration allows modifying t...
CVE-2026-67434
PHPCodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHPCodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running...
📄 Tenda HG7 / HG9 / HG10 Buffer Overflow
This Python script is a multi-mode framework targeting an alleged stack-based buffer overflow vulnerability in the /boaform/formDOMAINBLK endpoint of certain Tenda HG-series routers...
Command injection in libvcs and vcspull
The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...
PT-2026-53632
The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update repo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...
SUSE-SU-2026:1970-1 Security update for php-composer2
This update for php-composer2 fixes the following issues - CVE-2026-40176: command injection via malicious Perforce repository definition bsc1262254. - CVE-2026-40261: command injection via malicious Perforce source reference/url bsc1262255. Changes for php-composer2: - version update to 2.2.27...
EUVD-2018-19612
Malware in sbrugna...
EUVD-2025-22916
Malicious code in bioql PyPI...
EUVD-2022-1732
Malicious code in bioql PyPI...
EUVD-2022-1643
Malicious code in bioql PyPI...
EUVD-2022-0137
Malicious code in bioql PyPI...
EUVD-2022-0047
Malicious code in bioql PyPI...
JetBrains TeamCity Information Disclosure Vulnerability
JetBrains TeamCity is a Continuous Integration CI/CD tool developed by JetBrains, Inc. to automate the software build, test and deployment process. JetBrains TeamCity suffers from an information disclosure vulnerability that stems from an hg pull command line parameter resulting in an exposed...
CVE-2025-54538: Cleartext Storage of Sensitive Information
In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command...
Malicious code in hg-icons-2 (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...
MAL-2025-6095 Malicious code in hg-icons-2 (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...
Fedora 39 : composer (2024-bb55f8476a)
The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-bb55f8476a advisory. Version 2.7.7 2024-06-10 Security: Fixed command injection via malicious git branch name GHSA-47f6-5gq3-vx9c / CVE-2024-35241 Security: Fixed multip...
FreeBSD : Composer -- Multiple command injections via malicious git/hg branch names (5f608c68-276c-11ef-8caa-0897988a1c07)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 5f608c68-276c-11ef-8caa-0897988a1c07 advisory. Composer project reports: The status, reinstall and remove commands with packages installed fr...
CVE-2024-35242
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the composer install command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are availab...