Security Bulletin: Multiple Vulnerabilities in IBM Concert Software

Summary Multiple vulnerabilities were addressed in IBM Concert Software version 2.3.1 Vulnerability Details CVEID:CVE-2023-5752 DESCRIPTION: When installing a package from a Mercurial VCS URL ie "pip install hg+..." with pip prior to v23.3, the specified Mercurial revision could be used to inject...

CVE-2022-21223

The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function when using hg, the url and/or revision, tag, branch is passed to the hg clone command in a way that additional flags can be set. The additional flags can...

Masterminds VCS 参数注入漏洞

VCS is used to manage VCS Repo through a common interface in Go. A security vulnerability exists in Masterminds VCS that stems from the presence of parameter injection in the software. The vulnerability is exploited by an attacker who executes hg with a parameter string passed to hg in such a way...