CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2013-7325
https://notcve.org/view.php?id=CVE-2013-7325
03 Dec 2019 — An issue exists in uscan in devscripts before 2.13.19, which could let a remote malicious user execute arbitrary code via a crafted tarball. Existe un problema en uscan en devscripts versiones anteriores a la versión 2.13.19, que podría permitir a un usuario malicioso remoto ejecutar código arbitrario por medio de un tarball especialmente diseñado. • http://www.openwall.com/lists/oss-security/2014/02/12/14 •
CVSS: 9.8EPSS: 1%CPEs: 3EXPL: 0CVE-2018-13043 – Ubuntu Security Notice USN-3704-1
https://notcve.org/view.php?id=CVE-2018-13043
01 Jul 2018 — scripts/grep-excuses.pl in Debian devscripts through 2.18.3 allows code execution through unsafe YAML loading because YAML::Syck is used without a configuration that prevents unintended blessing. scripts/grep-excuses.pl en Debian devscripts hasta la versión 2.18.3 permite la ejecución de código mediante la carga insegura de YAML debido a que YAML::Syck se emplea sin una configuración que evite una bendición no planeada. It was discovered that devscripts incorrectly handled certain YAML files. An attacker co... • https://bugs.debian.org/902409 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2015-5704
https://notcve.org/view.php?id=CVE-2015-5704
25 Sep 2017 — scripts/licensecheck.pl in devscripts before 2.15.7 allows local users to execute arbitrary shell commands. scripts/licensecheck.pl en devscripts en versiones anteriores a la 2.15.7 permite que los usuarios locales ejecuten comandos shell arbitrarios. • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163705.html • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2015-5705
https://notcve.org/view.php?id=CVE-2015-5705
06 Sep 2017 — Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and crafted filename. Una vulnerabilidad de inyección de argumentos en versiones anteriores a la 2.15.7 de devscripts permite a atacantes escribir en archivos arbitrarios utilizando un enlace simbólico y un nombre de archivo manipulados. • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163705.html • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 9.8EPSS: 2%CPEs: 9EXPL: 0CVE-2013-6888 – Debian Security Advisory 2836-1
https://notcve.org/view.php?id=CVE-2013-6888
06 Jan 2014 — Uscan in devscripts before 2.13.9 allows remote attackers to execute arbitrary code via a crafted tarball. Uscan en devscripts anteriores a 2.13.9 permite a atacantes remotos ejecutar código arbitrario a través de un tarball manipulado. Several vulnerabilities have been discovered in uscan, a tool to scan upstream sits for new releases of packages, which is part of the devscripts package. An attacker controlling a website from which uscan would attempt to download a source tarball could execute arbitrary co... • http://anonscm.debian.org/gitweb/?p=collab-maint/devscripts.git%3Ba=commitdiff%3Bh=02c6850d973e3e1246fde72edab27f03d63acc52 •
CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0CVE-2013-7050
https://notcve.org/view.php?id=CVE-2013-7050
13 Dec 2013 — The get_main_source_dir function in scripts/uscan.pl in devscripts before 2.13.8, when using USCAN_EXCLUSION, allows remote attackers to execute arbitrary commands via shell metacharacters in a directory name. La función get_main_source_dir en scripts/uscan.pl en devscripts anterior a 2.13.8, al utilizar USCAN_EXCLUSION, permite a atacantes remotos ejecutar comandos arbitrarios mediante metacaracteres de shell en un nombre de directorio. • http://anonscm.debian.org/gitweb/?p=collab-maint/devscripts.git%3Ba=commitdiff%3Bh=91f05b5 • CWE-94: Improper Control of Generation of Code ('Code Injection') •