EUVD-2023-12399

Malicious code in bioql PyPI...

CVE-2023-0337

CVE-2023-0337 is a reflected Cross-site Scripting (XSS) vulnerability in daloRADIUS (lirantal/daloradius) prior to the master-branch. Concrete detail: a PoC shows XSS in acct-maintenance-cleanup.php, enabling arbitrary JavaScript in the victim’s browser when a user interacts with manipulated inpu...

CVE-2023-0046

Improper Restriction of Names for Files and Other Resources in GitHub repository lirantal/daloradius prior to master-branch...

CVE-2023-0048

CVE-2023-0048 affects the daloradius project (lirantal/daloradius) with a code-injection vulnerability prior to the master branch. Root cause: insufficient input sanitization in configuration/update flows, notably where user-controlled data (e.g., email fields) can be written to PHP files and exe...

CVE-2023-0048 Code Injection in lirantal/daloradius

Code Injection in GitHub repository lirantal/daloradius prior to master-branch...

Command injection in git-clone

All versions of package git-clone are vulnerable to Command Injection due to insecure usage of the --upload-pack feature of git. Credits Credit to @lirantal for discovering this vulnerability...

GHSA-3X62-X456-Q2VM OS Command Injection in git-pull-or-clone

The package git-pull-or-clone before 2.0.2 is vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn. However, the outpath parameter passed to it may be a...

pullit vulnerable to command injection

Versions of pullit prior to 1.4.0 are vulnerable to Command Injection. The package does not validate input on git branch names and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system. Recommendation Upgrade to version 1.4.0 or later. Credits This...

GHSA-8PX5-63X9-5C7P pullit vulnerable to command injection

Versions of pullit prior to 1.4.0 are vulnerable to Command Injection. The package does not validate input on git branch names and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system. Recommendation Upgrade to version 1.4.0 or later. Credits This...