CVSS: 6.0EPSS: 0%CPEs: 28EXPL: 0CVE-2012-4548
https://notcve.org/view.php?id=CVE-2012-4548
Argument injection vulnerability in syntax-highlighting.sh in cgit 9.0.3 and earlier allows remote authenticated users with permissions to add files to execute arbitrary commands via the --plug-in argument to the highlight command. Vulnerabilidad de inyección de argumentos en sintax-highlighting.sh en cgit v9.0.3 y anteriores permite a usuarios remotos autenticados con los permisos para añadir ficheros ejecutar código arbitrario a través del argumento --plug-in del comando resaltado. • http://git.zx2c4.com/cgit/commit/?id=7ea35f9f8ecf61ab42be9947aae1176ab6e089bd http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00022.html http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00004.html http://secunia.com/advisories/50734 http://secunia.com/advisories/51167 http://secunia.com/advisories/51222 http://www.openwall. •
CVSS: 6.5EPSS: 4%CPEs: 28EXPL: 0CVE-2012-4465
https://notcve.org/view.php?id=CVE-2012-4465
Heap-based buffer overflow in the substr function in parsing.c in cgit 0.9.0.3 and earlier allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via an empty username in the "Author" field in a commit. Desbordamiento de búfer basado en memoria dinámica en la función substr en parsing.c en cgit v0.9.0.3, permite a atacantes remotos provocar una denegación de servicio (caída) y posiblemente ejecutar código a través de un nombre vacío en el campo "Author" en una solicitud. • http://git.zx2c4.com/cgit/commit/?id=7757d1b046ecb67b830151d20715c658867df1ec http://hjemli.net/pipermail/cgit/2012-July/000652.html http://secunia.com/advisories/50734 http://www.openwall.com/lists/oss-security/2012/09/30/1 http://www.openwall.com/lists/oss-security/2012/10/03/7 http://www.securityfocus.com/bid/55724 https://bugzilla.redhat.com/show_bug.cgi?id=820733 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 3.5EPSS: 0%CPEs: 27EXPL: 0CVE-2011-2711
https://notcve.org/view.php?id=CVE-2011-2711
Cross-site scripting (XSS) vulnerability in the print_fileinfo function in ui-diff.c in cgit 0.9.0.2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the filename associated with the rename hint. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la función print_fileinfo de ui-diff.c de cgit v0.9.0.2 y anteriores, permite a usuarios autenticados en remoto inyectar secuencias de comandos web o HTML de su elección a través del nombre de fichero asociado con el campo de renombrar. • http://hjemli.net/git/cgit/commit/?h=stable&id=bebe89d7c11a92bf206bf6e528c51ffa8ecbc0d5 http://hjemli.net/pipermail/cgit/2011-July/000276.html http://secunia.com/advisories/45358 http://secunia.com/advisories/45541 http://www.openwall.com/lists/oss-security/2011/07/22/2 http://www.openwall.com/lists/oss-security/2011/07/22/6 http://www.openwall.com/lists/oss-security/2011/07/22/7 http://www.openwall.com/lists/oss-security/2011/07/24/3 http://www.openwall.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •