37 matches found
ROS-20240626-10
A vulnerability in the getUnpushedChanges function of the dependency manager for PHP Composer is related to the use of the status and reinstall commands. status, reinstall and remove commands. Exploitation of the vulnerability could allow an attacker, acting remotely, to execute arbitrary command...
OPENSUSE-SU-2024:14040-1 php-composer2-2.7.7-1.1 on GA media
These are all security issues fixed in the php-composer2-2.7.7-1.1 package on the GA media of openSUSE Tumbleweed...
ROS-20240329-03
Vulnerability in InstalledVersions.php and install.php scripts of dependency manager for PHP Composer is related to the inclusion of functions from an invalid controlled scope. with the inclusion of functions from an invalid controlled scope. Exploitation of the vulnerability could allow an...
Enumerate PHP Composer Packages (Windows)
Binary data phpcomposerenumwin.nbin...
Enumerate PHP Composer Packages (Linux / Unix)
Binary data phpcomposerenumnix.nbin...
SUSE-SU-2024:0592-1 Security update for php-composer2
This update for php-composer2 fixes the following issues: - CVE-2024-24821: Fixed potential arbitrary code execution when Composer is invoked within a directory with tampered files bsc1219757...
Ubuntu 16.04 ESM / 18.04 LTS : Nette vulnerability (USN-5983-1)
The remote Ubuntu 16.04 ESM / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5983-1 advisory. Cyku Hong discovered that Nette was not properly handling and validating data used for code generation. A remote attacker could possibly use this issu...
SUSE-SU-2022:3020-1 Security update for php-composer2
This update for php-composer2 fixes the following issues: - CVE-2022-24828: Fixed a code injection issue that affected integrators using specific APIs to read untrusted input files bsc1198494...
openSUSE 15 Security Update : php-composer (openSUSE-SU-2022:0132-1)
The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0132-1 advisory. - Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install...
OPENSUSE-SU-2022:0132-1 Security update for php-composer
This update for php-composer fixes the following issues: php-composer was updated to version 1.10.26: Security: Fixed command injection vulnerability in HgDriver/GitDriver: CVE-2022-24828 boo1198494 Update to version 1.10.25 Fix regression with PHP 8.1.0 and 8.1.1 Update to version 1.10.24 Fixed...
Security update for php-composer (important)
openSUSE Security Update: Security update for php-composer Announcement ID: openSUSE-SU-2022:0132-1 Rating: important References: 1198494 Cross-References: CVE-2021-41116 CVE-2022-24828 CVSS scores: CVE-2021-41116 NVD : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-24828 NVD : 8.8...
openSUSE 15 Security Update : php-composer (openSUSE-SU-2021:1289-1)
The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:1289-1 advisory. - Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not...
openSUSE: Security Advisory for php-composer (openSUSE-SU-2021:1289-1)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
OPENSUSE-SU-2021:1289-1 Security update for php-composer
This update for php-composer fixes the following issues: - Require php-mbstring as requested in boo1187416 - Version 1.10.22 Security: Fixed command injection vulnerability in HgDriver/HgDownloader and hardened other VCS drivers and downloaders GHSA-h5h8-pc6h-jvvx / CVE-2021-29472, boo1185376 -...
Security update for php-composer (important)
openSUSE Security Update: Security update for php-composer Announcement ID: openSUSE-SU-2021:1289-1 Rating: important References: 1185376 1187416 Cross-References: CVE-2021-29472 CVSS scores: CVE-2021-29472 NVD : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15...
A New PHP Composer Bug Could Enable Widespread Supply-Chain Attacks
The maintainers of Composer, a package manager for PHP, have shipped an update to address a critical vulnerability that could have allowed an attacker to execute arbitrary commands and "backdoor every PHP package," resulting in a supply-chain attack. Tracked as CVE-2021-29472, the security issue...
