CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2022-31012 – Git for Windows' installer can be tricked into executing an untrusted binary
https://notcve.org/view.php?id=CVE-2022-31012
12 Jul 2022 — Git for Windows is a fork of Git that contains Windows-specific patches. This vulnerability in versions prior to 2.37.1 lets Git for Windows' installer execute a binary into `C:\mingw64\bin\git.exe` by mistake. This only happens upon a fresh install, not when upgrading Git for Windows. A patch is included in version 2.37.1. Two workarounds are available. • https://github.com/git-for-windows/git/releases/tag/v2.37.1.windows.1 • CWE-426: Untrusted Search Path •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-46101
https://notcve.org/view.php?id=CVE-2021-46101
31 Jan 2022 — In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run directly. En Git para windows versiones hasta 2.34.1, cuando es usado git pull para actualizar el almacén local, puede ejecutarse directamente git.cmd • https://github.com/0xADY/git_rce •
CVSS: 8.8EPSS: 55%CPEs: 17EXPL: 17CVE-2018-11235 – git: arbitrary code execution when recursively cloning a malicious repository
https://notcve.org/view.php?id=CVE-2018-11235
30 May 2018 — In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the int... • https://packetstorm.news/files/id/148010 • CWE-20: Improper Input Validation CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •