207 matches found
cve-2020-27955
cve-2020-27955 cve-2020-27955 复现 1. 创建github仓库 2. git clone https://github.com/attacker/poc.git . 3. echo calc.exe git.cmd 4. git lfs track “.dat” 5. echo “Junk” large.dat 6. git add -A 7. git commit -m “POC” 8. git push -u origin master -f...
CVE-2018-11235
CVE-2018-11235 Creación automática de repositorio git malicioso para explotar CVE-2018-11235, una ejecución remota de código usando submódulos de Git. Publicación en el blog: https://devblogs.microsoft.com/devops/announcing-the-may-2018-git-security-vulnerability/...
CVE-2025-65964-Exploit
复现步骤 首先准备一个包含恶意文件的仓库 mkdir n8n-rce-poc && cd n8n-rce-poc git init git remote add origin mkdir evilhooks echo '!/bin/sh' evilhooks/pre-commit echo 'touch /tmp/pwnedsuccess' evilhooks/pre-commit chmod +x evilhooks/pre-commit git add evilhooks/pre-commit git update-index --chmod=+x...
repo
Repositorio malicioso para CVE-2025-65964...
CVE-2018-11235
CVE-2018-11235 1. 通过 ssh 连接到你的 VPS。 2. 克隆此仓库： git clone https://github.com/Rezy-Dev/CVE-2018-11235 cd CVE-2018-11235 3. 为 exploit.sh 添加执行 x 权限，然后运行它： sudo chmod +x exploit.sh sudo ./exploit.sh 它会下载 apache2 并为我们构建恶意仓库。 4. 完成后，我们可以使用链接 http://vps-ip/malicious.git 作为 git 仓库。 5. 当受害者像下面这样克隆时： git clo...
CVE-2020-27955
CVE-2020-27955漏洞复现 1、win机下载有漏洞的版本Git-LFS 下载地址：https://github.com/git-for-windows/git/releases/tag/v2.29.2.windows.1 2、win机安装，添加如下信息host文件,10.1.1.5即是nc监听8888的主机（可自行替换） 10.1.1.5 abcall.xyz 3、10.1.1.5主机，nc启监听口8888 ┌──root㉿hostname- └─ nc Cmd line: -l -p 8888 4、win机cmd命令行输入 git clone...
WSO2-2020-0731
WSO2-2020-0731: vulnerabilidades XXE y XSS en WSO2 Carbon Se han identificado potenciales XXE y XSS en múltiples productos WSO2. Divulgación del proveedor: La divulgación y el parche del proveedor para esta vulnerabilidad se pueden encontrar aquí. ¿Por qué no hay CVE? Ni yo ni el proveedor...
cve-2025-62726-malicious-repo
Este repositorio no tiene un README...
clone_and_pwn
Encabezados Título del Exploit: Clone and Pwn Fecha: 4 de junio de 2018 Autor del Exploit: Alejandro Caceres Página del proveedor: https://git-scm.com/ Enlace del software: https://git-scm.com/downloads Versión: se ejecuta código arbitrario en versiones del cliente git anteriores a 2.13.7, 2.14.x...
CVE-2026-19592
The OpenAI Codex CLI (versions 0.102.0 through 0.130.0) and Codex Desktop (macOS versions 260202.0859 through 26.513.31313; Windows versions 26.304.38 through 26.513.40821 and Microsoft Store package 26.304.38.0 through 26.513.4821.0) are vulnerable to remote code execution via the GitSpawn flaw....
CVE-2026-48122 Workspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extension
Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler Gemfile used at startup. A malicious...
CVE-2026-47763
A flaw was found in pdm, a Python package and dependency manager. This vulnerability allows a local attacker to overwrite arbitrary files on the system. By crafting a malicious repository with symlinks for project-local configuration files, a local user performing pdm operations could inadvertent...
CVE-2026-67623
Technical details about CVE-2026-67623 are not publicly available in the provided documents. No vendor, product versions, affected components, or remediation are specified here. Monitor for updates in future connected documents.
CVE-2026-47211
CVE-2026-47211 affects Ouroboros (local-first runtime for AI coding agents). Prior to version 0.39.0, loading the project-local .env could cause arbitrary code execution when a user runs Ouroboros commands in a cloned malicious repository; execution-affecting variables like OUROBOROS_CLI_PATH and...
CVE-2026-47211
Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code executi...
CVE-2026-47211 Ouroboros: Remote Code Execution via Untrusted Project-Directory .env
Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code executi...
CVE-2026-47211 Ouroboros: Remote Code Execution via Untrusted Project-Directory .env
Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code executi...
CVE-2026-9856 Path Traversal in huggingface/transformers
A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...
Race Condition
n8n is vulnerable to Race Condition. The vulnerability is due to a race condition in the Git node's clone operation that allows an authenticated attacker to replace a validated directory with a symlink, plant a malicious repository as a custom node, and achieve arbitrary code execution when the...
