CVSS: 9.0EPSS: 1%CPEs: 5EXPL: 0CVE-2023-43655 – Remote Code Execution via web-accessible composer.phar
https://notcve.org/view.php?id=CVE-2023-43655
29 Sep 2023 — Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is no... • https://github.com/composer/composer/commit/4fce14795aba98e40b6c4f5047305aba17a6120d • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 10.0EPSS: 0%CPEs: 11EXPL: 1CVE-2015-8371
https://notcve.org/view.php?id=CVE-2015-8371
21 Sep 2023 — Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache key is derived from the package name, the dist type, and certain other data from the package repository (which may simply be a commit hash, and thus can be found by an attacker). Versions through 1.0.0-alpha11 are affected, and 1.0.0 is unaffected. • https://flyingmana.de/blog_en/2016/02/14/composer_cache_injection_vulnerability_cve_2015_8371.html • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-1596 – tagDiv Composer < 4.0 - Reflected Cross-site Scripting
https://notcve.org/view.php?id=CVE-2023-1596
17 Apr 2023 — The tagDiv Composer WordPress plugin before 4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘td_video_url’ parameter in versions up to, but not including, 4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ... • https://wpscan.com/vulnerability/cada9be9-522a-4ce8-847d-c8fff2ddcc07 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0CVE-2022-24828 – Missing input validation can lead to command execution in composer
https://notcve.org/view.php?id=CVE-2022-24828
13 Apr 2022 — Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulnerability on packagist.org for example where the composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercurial via the `$file` argument, or git via the `$identifier` argument if you allow arbitrary data there (Packagis... • https://github.com/composer/composer/commit/2c40c53637c5c7e43fff7c09d3d324d632734709 • CWE-20: Improper Input Validation CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-41116 – Command injection in composer on Windows
https://notcve.org/view.php?id=CVE-2021-41116
05 Oct 2021 — Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue. • https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aa • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 8.8EPSS: 6%CPEs: 6EXPL: 1CVE-2021-29472 – Missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composer
https://notcve.org/view.php?id=CVE-2021-29472
27 Apr 2021 — Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow code to be executed in the HgDriver if hg/Mercurial is installed on the system. The impact to Composer users directly is limited as the composer.json file is typically under their own control and source download URLs can only be supplied by third party Composer repositories they explicitly trust to download and... • https://blog.sonarsource.com/php-supply-chain-attack-on-composer • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •