CVSS: 4.3EPSS: 3%CPEs: 170EXPL: 3CVE-2010-3906 – gitWeb 1.7.3.3 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2010-3906
Cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) f and (2) fp parameters. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Gitweb v1.7.3.3 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de los parámetros (1) f y (2) fp. • https://www.exploit-db.com/exploits/15744 http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052518.html http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052782.html http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00004.html http://secunia.com/advisories/42645 http://secunia.com/advisories/42731 http://secunia.com/advisories/42743 http://secunia.com/advisories/43457 http://www.exploit-db.com/exploits/15744 http://www.mandriva.com/ • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2010-2542
https://notcve.org/view.php?id=CVE-2010-2542
Stack-based buffer overflow in the is_git_directory function in setup.c in Git before 1.7.2.1 allows local users to gain privileges via a long gitdir: field in a .git file in a working copy. Desbordamiento de búfer basado en pila en la función is_git_directory en setup.c en Git anterior v1.7.2.1 permite a usuarios locales obtener privilegios a través de un gitdir grande: campo en un fichero .git en una acción copia. • http://git.kernel.org/?p=git/git.git%3Ba=commit%3Bh=3c9d0414ed2db0167e6c828b547be8fc9f88fccc http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00004.html http://secunia.com/advisories/43457 http://www.kernel.org/pub/software/scm/git/docs/RelNotes-1.7.2.1.txt http://www.openwall.com/lists/oss-security/2010/07/22/1 http://www.openwall.com/lists/oss-security/2010/07/22/4 http://www.securityfocus.com/bid/41891 http://www.vupen.com/english/advisories/2011/0464 • CWE-787: Out-of-bounds Write •
CVSS: 5.0EPSS: 7%CPEs: 89EXPL: 1CVE-2009-2108 – Git 1.6.3 - Parameter Processing Remote Denial of Service
https://notcve.org/view.php?id=CVE-2009-2108
git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request containing extra unrecognized arguments. git-daemon en git v1.4.4.5 hasta v1.6.3 permite a atacantes remotos provocar una denegación de servicio (bucle infinito y agotamiento de CPU) a través de una una petición que contenga argumentos no reconocidos extra. • https://www.exploit-db.com/exploits/33036 http://article.gmane.org/gmane.comp.version-control.git/120733 http://osvdb.org/55034 http://secunia.com/advisories/35437 http://secunia.com/advisories/35730 http://security.gentoo.org/glsa/glsa-200907-05.xml http://thread.gmane.org/gmane.comp.version-control.git/120724 http://www.mandriva.com/security/advisories?name=MDVSA-2009:155 http://www.openwall.com/lists/oss-security/2009/06/12/1 http://www.securityfocus.com/bid/35338&# • CWE-399: Resource Management Errors •
CVSS: 4.6EPSS: 0%CPEs: 85EXPL: 0CVE-2008-5916
https://notcve.org/view.php?id=CVE-2008-5916
gitweb/gitweb.perl in gitweb in Git 1.6.x before 1.6.0.6, 1.5.6.x before 1.5.6.6, 1.5.5.x before 1.5.5.6, 1.5.4.x before 1.5.4.7, and other versions after 1.4.3 allows local repository owners to execute arbitrary commands by modifying the diff.external configuration variable and executing a crafted gitweb query. gitweb/gitweb.perl en gitweb en Git 1.6.x anteriores a v1.6.0.6, 1.5.6.x anteriores a v1.5.6.6, 1.5.5.x anteriores a v1.5.5.6, 1.5.4.x anteriores a v1.5.4.7, y otras versiones posteriores a v1.4.3 permite a los propietarios del repositorio ejecutar comandos de su elección por modificación de la configuración de la variable diff.external y ejecutando una consulta manipulada gitweb. • http://marc.info/?l=git&m=122975564100860&w=2 http://marc.info/?l=linux-kernel&m=122975564100863&w=2: http://osvdb.org/50918 http://secunia.com/advisories/33282 http://secunia.com/advisories/33964 http://secunia.com/advisories/34194 http://securityreason.com/securityalert/4922 http://www.gentoo.org/security/en/glsa/glsa-200903-15.xml http://www.openwall.com/lists/oss-security/2009/01/15/2 http://www.openwall.com/lists/oss-security/2009/01/20/2 http: • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 1%CPEs: 117EXPL: 0CVE-2008-5516 – gitWeb 1.x Remote Command Execution
https://notcve.org/view.php?id=CVE-2008-5516
The web interface in git (gitweb) 1.5.x before 1.5.5 allows remote attackers to execute arbitrary commands via shell metacharacters related to git_search. La interfaz web en git (gitweb) versiones 1.5.x anteriores a 1.5.5, permite a atacantes remotos ejecutar comandos arbitrarios mediante metacaracteres de shell relacionados con git_search. gitWeb version 1.x suffers from a remote command execution vulnerability. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512330 http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00002.html http://repo.or.cz/w/git.git?a=commitdiff%3Bh=c582abae http://secunia.com/advisories/33964 http://secunia.com/advisories/34194 http://securityreason.com/securityalert/4919 http://wiki.rpath.com/Advisories:rPSA-2009-0005 http://www.debian.org/security/2009/dsa-1708 http://www.gentoo.org/security/en/glsa/glsa-200903-15.xml http://www.openwall • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-264: Permissions, Privileges, and Access Controls •