CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 2CVE-2022-25900 – Command Injection
https://notcve.org/view.php?id=CVE-2022-25900
01 Jul 2022 — All versions of package git-clone are vulnerable to Command Injection due to insecure usage of the --upload-pack feature of git. Todas las versiones del paquete git-clone son vulnerables a una inyección de comandos debido al uso inseguro de la función --upload-pack de git • https://gist.github.com/lirantal/9441f3a1212728476f7a6caa4acb2ccc • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-40899
https://notcve.org/view.php?id=CVE-2021-40899
27 Jun 2022 — A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in repo-git-downloader v0.1.1 when downloading crafted invalid git repositories. Se ha detectado una vulnerabilidad de Denegación de Servicio por Expresiones Regulares (ReDOS) en repo-git-downloader versión v0.1.1, cuando son descargados repositorios git no válidos diseñados • https://github.com/yetingli/SaveResults/blob/main/js/repo-git-downloader.js • CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2022-24376 – Command Injection
https://notcve.org/view.php?id=CVE-2022-24376
10 Jun 2022 — All versions of package git-promise are vulnerable to Command Injection due to an inappropriate fix of a prior [vulnerability](https://security.snyk.io/vuln/SNYK-JS-GITPROMISE-567476) in this package. **Note:** Please note that the vulnerability will not be fixed. The README file was updated with a warning regarding this issue. Todas las versiones del paquete git-promise son vulnerables a una inyección de comandos debido a una corrección inapropiada de una [vulnerabilidad] anterior (https://security.snyk.io... • https://gist.github.com/lirantal/9da1fceb32f5279eb76a5fc1cb9707dd • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 9.8EPSS: 6%CPEs: 1EXPL: 2CVE-2022-24437 – Command Injection
https://notcve.org/view.php?id=CVE-2022-24437
01 May 2022 — The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection. El paquete git-pull-or-clone versiones anteriores a 2.0.2, es vulnerable a una inyección de comandos debido al uso de la función --... • https://gist.github.com/lirantal/327e9dd32686991b5a1fa6341aac2e7b • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 1CVE-2022-25866 – Command Injection
https://notcve.org/view.php?id=CVE-2022-25866
25 Apr 2022 — The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadable($url, array $refs = NULL) function, both the url and refs parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection. El paquete czproject/git-php versiones anteriores a 4.0.3, es vulnerable a una inyección de comandos por medio de una inyección de argumentos git. C... • https://github.com/czproject/git-php/commit/5e82d5479da5f16d37a915de4ec55e1ac78de733 • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 1CVE-2022-1440 – Command Injection vulnerability in git-interface@2.1.1 in yarkeev/git-interface
https://notcve.org/view.php?id=CVE-2022-1440
22 Apr 2022 — Command Injection vulnerability in git-interface@2.1.1 in GitHub repository yarkeev/git-interface prior to 2.1.2. If both are provided by user input, then the use of a `--upload-pack` command-line argument feature of git is also supported for `git clone`, which would then allow for any operating system command to be spawned by the attacker. Una vulnerabilidad de inyección de comandos en git-interface@2.1.1 en el repositorio de GitHub yarkeev/git-interface versiones anteriores a 2.1.2. Si ambos son proporcio... • https://github.com/yarkeev/git-interface/commit/f828aa790016fee3aa667f7b44cf94bf0aa8c60d • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24826 – Git LFS can execute a binary from the current directory on Windows
https://notcve.org/view.php?id=CVE-2022-24826
19 Apr 2022 — On Windows, if Git LFS operates on a malicious repository with a `..exe` file as well as a file named `git.exe`, and `git.exe` is not found in `PATH`, the `..exe` program will be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems. Similarly, if the malicious repository contains files named `..exe` and `cygpath.exe`, and `cygpath.exe` is not found in `PATH`, the `..exe` program will be executed when certain Git LFS commands are run. More generally, if the current w... • https://github.com/git-lfs/git-lfs/releases • CWE-426: Untrusted Search Path •
CVSS: 9.8EPSS: 1%CPEs: 6EXPL: 1CVE-2022-25648 – Command Injection
https://notcve.org/view.php?id=CVE-2022-25648
19 Apr 2022 — The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection. El paquete git versiones anteriores a 1.11.0, es vulnerable a una inyección de comandos por medio de una inyección de argumentos git. Cuando es llamada a la función fetch(remote = "origin"... • https://github.com/ruby-git/ruby-git/pull/569 • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2022-24767
https://notcve.org/view.php?id=CVE-2022-24767
12 Apr 2022 — GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account. GitHub: El desinstalador de Git para Windows es vulnerable al secuestro de DLL cuando se ejecuta bajo la cuenta de usuario SYSTEM • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-24767 • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2022-24765 – Uncontrolled search for the Git directory in Git for Windows
https://notcve.org/view.php?id=CVE-2022-24765
12 Apr 2022 — Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\.git`, which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory. Git would then respect any config in said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. • http://seclists.org/fulldisclosure/2022/May/31 • CWE-427: Uncontrolled Search Path Element •