CVSS: 10.0EPSS: 32%CPEs: 1EXPL: 1CVE-2022-25860 – simple-git < 3.16.0 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2022-25860
24 Jan 2023 — Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221). Las versiones del paquete simple-git anteriores a la 3.16.0 son vulnerables a la ejecución remota de código (RCE) a través de los métodos clone(), pull(), push() y listRemote(), debido a una san... • https://github.com/steveukx/git-js/commit/ec97a39ab60b89e870c5170121cd9c1603cc1951 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.0EPSS: 1%CPEs: 2EXPL: 0CVE-2022-46648 – ruby-git: code injection vulnerability
https://notcve.org/view.php?id=CVE-2022-46648
17 Jan 2023 — ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318. Las versiones de ruby-git anteriores a la v1.13.0 permiten a un atacante remoto autenticado ejecutar un código Ruby arbitrario haciendo que un usuario cargue en el producto un repositorio que contiene un nombre de archivo especialmente manipulado. Esta vuln... • https://github.com/ruby-git/ruby-git • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2022-47318 – ruby-git: code injection vulnerability
https://notcve.org/view.php?id=CVE-2022-47318
17 Jan 2023 — ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648. Las versiones de ruby-git anteriores a v1.13.0 permiten a un atacante remoto autenticado ejecutar un código Ruby arbitrario haciendo que un usuario cargue en el producto un repositorio que contiene un nombre de archivo especialmente manipulado. Esta vulnera... • https://github.com/ruby-git/ruby-git • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 38%CPEs: 1EXPL: 2CVE-2022-25912 – Remote Code Execution (RCE)
https://notcve.org/view.php?id=CVE-2022-25912
05 Dec 2022 — The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306). El paquete simple-git anterior a 3.15.0 es vulnerable a la ejecución remota de código (RCE) cuando se habilita el protocolo de transporte ext, lo que lo hace explotable mediante el método clone(). Esta vulnerabi... • https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-28422 – Command Injection
https://notcve.org/view.php?id=CVE-2020-28422
25 Jul 2022 — All versions of package git-archive are vulnerable to Command Injection via the exports function. Todas las versiones del paquete git-archive son vulnerables a una inyección de comandos por medio de la función exports • https://security.snyk.io/vuln/SNYK-JS-GITARCHIVE-1050391 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 2CVE-2022-25900 – Command Injection
https://notcve.org/view.php?id=CVE-2022-25900
01 Jul 2022 — All versions of package git-clone are vulnerable to Command Injection due to insecure usage of the --upload-pack feature of git. Todas las versiones del paquete git-clone son vulnerables a una inyección de comandos debido al uso inseguro de la función --upload-pack de git • https://gist.github.com/lirantal/9441f3a1212728476f7a6caa4acb2ccc • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-40899
https://notcve.org/view.php?id=CVE-2021-40899
27 Jun 2022 — A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in repo-git-downloader v0.1.1 when downloading crafted invalid git repositories. Se ha detectado una vulnerabilidad de Denegación de Servicio por Expresiones Regulares (ReDOS) en repo-git-downloader versión v0.1.1, cuando son descargados repositorios git no válidos diseñados • https://github.com/yetingli/SaveResults/blob/main/js/repo-git-downloader.js • CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2022-24376 – Command Injection
https://notcve.org/view.php?id=CVE-2022-24376
10 Jun 2022 — All versions of package git-promise are vulnerable to Command Injection due to an inappropriate fix of a prior [vulnerability](https://security.snyk.io/vuln/SNYK-JS-GITPROMISE-567476) in this package. **Note:** Please note that the vulnerability will not be fixed. The README file was updated with a warning regarding this issue. Todas las versiones del paquete git-promise son vulnerables a una inyección de comandos debido a una corrección inapropiada de una [vulnerabilidad] anterior (https://security.snyk.io... • https://gist.github.com/lirantal/9da1fceb32f5279eb76a5fc1cb9707dd • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 9.8EPSS: 6%CPEs: 1EXPL: 2CVE-2022-24437 – Command Injection
https://notcve.org/view.php?id=CVE-2022-24437
01 May 2022 — The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection. El paquete git-pull-or-clone versiones anteriores a 2.0.2, es vulnerable a una inyección de comandos debido al uso de la función --... • https://gist.github.com/lirantal/327e9dd32686991b5a1fa6341aac2e7b • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 1CVE-2022-25866 – Command Injection
https://notcve.org/view.php?id=CVE-2022-25866
25 Apr 2022 — The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadable($url, array $refs = NULL) function, both the url and refs parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection. El paquete czproject/git-php versiones anteriores a 4.0.3, es vulnerable a una inyección de comandos por medio de una inyección de argumentos git. C... • https://github.com/czproject/git-php/commit/5e82d5479da5f16d37a915de4ec55e1ac78de733 • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •