cve-2024-32002-submodule-rce

CVE-2024-32002 RCE Submodule Un sottomodulo per dimostrare CVE-2024-32002. Dimostra l'esecuzione remota di codice RCE caricando un hook di commit dannoso nella directory .git del repository principale. Vedi cve-2024-32002-poc-rce per il POC funzionante che utilizza questo repository. Cosa contien...

CVE-2024-32002

GIT RCE CVE-2024-32002 Descrizione | CVE-2024-32002 | https://www.tarlogic.com/blog/cve-2024-32002-vulnerability-git/ | Exploit | Per prima cosa devi creare i repository "calledrepo" e "commandrepo" su git. | La vittima eseguirà successivamente la clonazione di calledrepo con "git clone --recursi...

hook

hook Submodul für gitrce: https://github.com/EQSTSeminar/gitrce Angriffsszenario kali192.168.216.129 --Gibt Remote-Repository-Adresse-- Win192.168.216.130 kali192.168.216.129 --Git clone && Hook-Skriptpost-checkout-Ausführung-- Win192.168.216.130 Haftungsausschluss Dieses Repository ist nicht als...

CVE-2024-32002-EXP

CVE-2024-32002-EXP root@kitploit: !/bin/bash Imposta le opzioni di configurazione Git git config --global protocol.file.allow always git config --global core.symlinks true Evita messaggi di avviso imposta il ramo predefinito su main git config --global init.defaultBranch main Definisci il percors...

CVE-2024-32002-Exploit

root@kitploit: !/bin/bash git init hook cd hook mkdir -p y/hooks cat y/hooks/post-checkout dotgit.txt git hash-object -w --stdin dot-git.hash printf "120000 %s 0\ta\n" "$cat dot-git.hash" index.info git update-index --index-info index.info git commit -m "add-symlink" git remote add origin...

CVE-2025-48384

CVE-2025-48384 PoC Avisos Este repositório foi criado para fins educacionais de segurança. Por favor, não o utilize para fins maliciosos. Esta vulnerabilidade requer que o nome do diretório contenha \r, portanto, sistemas Linux/Unix são os afetados. Abaixo estão as versões do Git afetadas: v2.43....

CVE-2025-48384-submodule

CVE-2025-48384 Submodule Questo submodule contiene un hook post-checkout malevolo a scopo dimostrativo...

CVE-2024-32002

CVE-2024-32002 Uma prova de conceito simples que executa a Calculadora exemplo apenas para macOS. Ao usar o comando git clone --recursive, este repositório também puxará https://github.com/markuta/hooky, que contém um script post-checkout. Baseado principalmente no arquivo t7406-submodule-update....

hooky

hooky Dieses Repository ist ein Submodul für https://github.com/markuta/CVE-2024-32002, das einen einfachen Hook enthält, der sich in y/hooks/post-checkout befindet, um den Taschenrechner auf macOS-Systemen zu öffnen: root@kitploit: open -a Calculator.app Weitere Informationen zur Schwachstelle...

CVE-2024-32002-poc

Script Bash: root@kitploit: !/bin/bash Imposta le opzioni di configurazione di Git git config --global protocol.file.allow always git config --global core.symlinks true Evita messaggi di avviso imposta il ramo predefinito su main git config --global init.defaultBranch main Definisci il percorso d...

git_rce

CVE-2024-32002 PoC 1. Devi configurare l'opzione dei link simbolici di git in questo modo: root@kitploit: git config --global core.symlinks true 2. Quindi sfrutta CVE-2024-32002 con il seguente comando: root@kitploit: git clone --recursive https://github.com/EQSTSeminar/gitrce.git Scenario di...

Linux Distros Unpatched Vulnerability : CVE-2026-73623

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command executio...

CVE-2026-73623

GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...

DEBIAN-CVE-2026-73623

GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...

CVE-2026-73623

GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...

UBUNTU-CVE-2026-73623

GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...

EUVD-2026-57792

GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...

CVE-2026-73623 GitPython before 3.1.54 Remote Code Execution via --template

GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...

CVE-2026-73623

GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...

Malicious code in mailconfirmer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfb184ffa15fd011b84658a6b5cd68582e78827258a8373f0da1ef34248bfb09 The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log demo messages. The real...