CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2014-6274 – S3 and Glacier remotes creds embedded in the git repo were not encrypted
https://notcve.org/view.php?id=CVE-2014-6274
26 Jun 2025 — git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the embedded AWS credentials were stored in the git repository in (effectively) plaintext, not encrypted as they were supposed to be. This issue affects git-annex: from 3.20121126 before 5.20140919. git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the embedded AWS credential... • https://git-annex.branchable.com/upgrades/insecure_embedded_creds • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12976
https://notcve.org/view.php?id=CVE-2017-12976
20 Aug 2017 — git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117. git-annex en versiones anteriores a la 6.20170818 permite que atacantes remotos ejecuten comandos arbitrarios mediante una URL ssh con un carácter de guion en el nombre de host, tal y como demuestra ssh://-eProxyCommand= URL, un... • http://source.git-annex.branchable.com/?p=source.git%3Ba=blob%3Bf=doc/bugs/dashed_ssh_hostname_security_hole.mdwn • CWE-20: Improper Input Validation •