CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-1000850 – retrofit: Directory traversal in RequestBuilder allows manipulation of resources
https://notcve.org/view.php?id=CVE-2018-1000850
Square Retrofit version versions from (including) 2.0 and 2.5.0 (excluding) contains a Directory Traversal vulnerability in RequestBuilder class, method addPathParameter that can result in By manipulating the URL an attacker could add or delete resources otherwise unavailable to her.. This attack appear to be exploitable via An attacker should have access to an encoded path parameter on POST, PUT or DELETE request.. This vulnerability appears to have been fixed in 2.5.0 and later. Square Retrofit, desde la versión 2.0 (incluida) y 2.5.0 (excluida), contiene una vulnerabilidad de salto de directorio en la clase RequestBuilder, método addPathParameter. Al manipular la URL, un atacante podría añadir o eliminar recursos que no estarían disponibles. • https://access.redhat.com/errata/RHSA-2019:3892 https://github.com/square/retrofit/blob/master/CHANGELOG.md https://github.com/square/retrofit/commit/b9a7f6ad72073ddd40254c0058710e87a073047d#diff-943ec7ed35e68201824904d1dc0ec982 https://ihacktoprotect.com/post/retrofit-path-traversal https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E https://lists.apache.org/thre • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1000844
https://notcve.org/view.php?id=CVE-2018-1000844
Square Open Source Retrofit version Prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contains a XML External Entity (XXE) vulnerability in JAXB that can result in An attacker could use this to remotely read files from the file system or to perform SSRF.. This vulnerability appears to have been fixed in After commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437. Square Open Source Retrofit, en versiones anteriores al commit con ID 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437, contiene una vulnerabilidad XEE (XML External Entity) en JAXB que puede resultar en que un atacante podría aprovecharla para leer archivos de forma remota desde el sistema de archivos o para realizar Server-Side Request Forgery (SSRF). La vulnerabilidad parece haber sido solucionada tras el commit con ID 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437. • https://github.com/square/retrofit/pull/2735 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.9EPSS: 0%CPEs: 6EXPL: 0CVE-2016-2402
https://notcve.org/view.php?id=CVE-2016-2402
OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate. OkHttp antes de 2.7.4 y 3.x antes de 3.1.2 permite que los atacantes man-in-the-middle eludan la fijación de certificados enviando una cadena de certificados con un CA no fijado confiable y el certificado fijado. • http://www.openwall.com/lists/oss-security/2016/02/10/8 http://www.openwall.com/lists/oss-security/2016/02/18/7 https://koz.io/pinning-cve-2016-2402 https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E https://publicobject.com/2016/02/11/okhttp-certificate-pinning-vulnerability • CWE-295: Improper Certificate Validation •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 1CVE-2015-8968
https://notcve.org/view.php?id=CVE-2015-8968
git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories. git-fastclone en versiones anteriores a 1.0.1 permite la ejecución de comandos shell arbitrarios desde .gitmodules. • http://www.securityfocus.com/bid/81433 https://github.com/square/git-fastclone/pull/2 https://hackerone.com/reports/104465 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 10.0EPSS: 3%CPEs: 1EXPL: 1CVE-2015-8969
https://notcve.org/view.php?id=CVE-2015-8969
git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to "cd " and "git clone " commands in the library. git-fastclone en versiones anteriores a 1.0.5 pasa cadenas modificables por el usuario directamente a un comando shell. Un atacante puede ejecutar comandos maliciosos modificando las cadenas que son pasadas como argumentos a comandos "cd " y "git clone " en la librería. • http://www.securityfocus.com/bid/81433 https://github.com/square/git-fastclone/pull/5 https://hackerone.com/reports/105190 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •