CVE-2017-18026

Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary commands through the Mercurial adapter via vectors involving a branch whose name begins with a --config...

CVE-2017-18026

CVE-2017-18026 affects Redmine: versions prior to 3.2.9, 3.3.x prior to 3.3.6, and 3.4.x prior to 3.4.4 fail to block the Mercurial hg flags --config and --debugger, enabling remote command execution via the Mercurial adapter when a branch name starts with --config= or --debugger=. Root cause is ...

CVE-2017-17536

Phabricator before 2017-11-10 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary code by using the web UI to browse a branch whose name begins with a --config= or --debugger= substring...