CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 1CVE-2021-23664 – Server-side Request Forgery (SSRF)
https://notcve.org/view.php?id=CVE-2021-23664
21 Jan 2022 — The package @isomorphic-git/cors-proxy before 2.7.1 are vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and validation of the redirection action in middleware.js. El paquete @isomorphic-git/cors-proxy versiones anteriores a 2.7.1 es vulnerable a un ataque de tipo Server-side Request Forgery (SSRF) debido a una falta de saneo y comprobación de la acción de redireccionamiento en middleware.js • https://github.com/isomorphic-git/cors-proxy/commit/1b1c91e71d946544d97ccc7cf0ac62b859e03311 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2021-30483 – isomorphic-git: Directory traversal via a crafted repository
https://notcve.org/view.php?id=CVE-2021-30483
27 Jul 2021 — isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository. isomorphic-git versiones anteriores a 1.8.2, permite un Salto de Directorio por medio de un repositorio diseñado A flaw was found in isomorphic-git. An attacker could cause a Directory Traversal via a crafted filepath in a repository being cloned. The ovirt-engine package provides the Red Hat Virtualization Manager, a centralized management platform that allows system administrators to view and manage virtual machines. The Mana... • https://github.com/isomorphic-git/isomorphic-git/pull/1339 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •