CVE-2020-27955

Git LFS 2.12.0 allows Remote Code Execution...

CVE-2020-27955

Git LFS on Windows is vulnerable to remote code execution when cloning a malicious repo, due to Go behavior that may execute a current-directory binary (git.bat/git.exe). The issue is a known incomplete fix for CVE-2020-27955 and is discussed across advisories (GHSA-CX3W-XQMC-84G5; GHSA-4G4P-42WC...

CVE-2020-27955

Git LFS 2.12.0 allows Remote Code Execution...

CVE-2020-27955: Uncontrolled Search Path Element

Git LFS 2.12.0 allows Remote Code Execution...

PT-2020-16878 · Github · Git +1

Name of the Vulnerable Software and Affected Versions: Git LFS versions 2.12.0 Git versions prior to 2.29.2 Description: The issue allows Remote Code Execution RCE on Windows systems when Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory. This occu...

git-lfs bug fix and enhancement update

An update is available for git-lfs. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Enterprise...

ALEA-2020:4829 git-lfs bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

git-lfs bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

FreeBSD : Gitlab -- Multiple vulnerabilities (174e466b-1d48-11eb-bd0f-001b217b3468)

Gitlab reports : Path Traversal in LFS Upload Path traversal allows saving packages in arbitrary location Kubernetes agent API leaks private repos Terraform state deletion API exposes object storage URL Stored-XSS in error message of build-dependencies Git credentials persisted on disk Potential...

PhishingKitTracker - Let's Track Phishing Kits To Give To Research Community Raw Material To Stud

An extensible and freshly updated collection of phishingkits for forensics and future analysis topped with simple stats Disclaimer This repository holds a collection of Phishing Kits used by criminals to steal user information. Almost every file into the raw folder is malicious so I strongly...

CVE-2020-10081

GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could potentially be used to incorrectly access LFS objects not owned by the user...

CVE-2020-10081

GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could potentially be used to incorrectly access LFS objects not owned by the user...

CVE-2020-10081

GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could potentially be used to incorrectly access LFS objects not owned by the user...

Design/Logic Flaw

GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could potentially be used to incorrectly access LFS objects not owned by the user...

CVE-2020-10081

GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could potentially be used to incorrectly access LFS objects not owned by the user...

CVE-2020-10081

GitLab before 12.8.2 has an Incorrect Access Control vulnerability where the LFS import process could allow a user to access LFS objects not owned by them. Affects GitLab self-hosted deployments prior to 12.8.2; root cause is access-control weakness in the LFS import path. CVSS (3.1) base score 6...

CVE-2020-10081

Removed by vendor...

CVE-2020-10081: Undefined Security Weakness

GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could potentially be used to incorrectly access LFS objects not owned by the user...

PT-2020-11906 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 12.8.2 Description: The issue is related to incorrect access control in the LFS import process, potentially allowing access to LFS objects not owned by the user. This was internally discovered. Recommendations: For...

Security update for haproxy (important)

openSUSE Security Update: Security update for haproxy Announcement ID: openSUSE-SU-2019:2645-1 Rating: important References: 1082318 1154980 1157712 1157714 Cross-References: CVE-2019-18277 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability and has three fixes is now...