Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
git client vulnerabilities and exploits
(subscribe to this query)
7.5
CVSSv2
CVE-2014-9706
The build_index_from_tree function in index.py in Dulwich prior to 0.9.9 allows remote malicious users to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.
Debian Debian Linux 7.0
Dulwich Project Dulwich
NA
CVE-2023-26054
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions when the user sends a build request that contains a Git URL that contains credentials and the build creates a provenance attestation describ...
Mobyproject Buildkit
7.8
CVSSv2
CVE-2018-16875
The crypto/x509 package of Go prior to 1.10.6 and 1.11.x prior to 1.11.3 does not limit the amount of work performed for each chain verification, which might allow malicious users to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client cer...
Golang Go
Opensuse Leap 42.3
1 Github repository
7.5
CVSSv2
CVE-2020-4059
In mversion prior to 2.0.0, there is a command injection vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This vulnerability is patched by version 2.0.0. Previous releases are deprecated in np...
Mversion Project Mversion
7.5
CVSSv2
CVE-2015-0838
Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich prior to 0.9.9 allows remote malicious users to execute arbitrary code via a crafted pack file.
Debian Debian Linux 7.0
Dulwich Project Dulwich
6.8
CVSSv2
CVE-2018-16873
In Go prior to 1.10.6 and 1.11.x prior to 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vuln...
Golang Go
Opensuse Leap 42.3
Opensuse Leap 15.0
Opensuse Leap 15.1
Suse Linux Enterprise Server 12
Opensuse Backports Sle 15.0
Debian Debian Linux 9.0
1 Github repository
4.3
CVSSv2
CVE-2017-13098
BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a ...
Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api
NA
CVE-2023-47122
Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and before 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign cli...
Sigstore Gitsign
9.3
CVSSv2
CVE-2018-11776
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or...
Apache Struts
3 EDB exploits
44 Github repositories
3 Articles
6.8
CVSSv2
CVE-2018-16874
In Go prior to 1.10.6 and 1.11.x prior to 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is on...
Golang Go
Opensuse Leap 42.3
Opensuse Leap 15.0
Opensuse Leap 15.1
Suse Linux Enterprise Server 12
Opensuse Backports Sle 15.0
Debian Debian Linux 9.0
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-34377
CVE-2024-20859
CVE-2023-49606
inject
arbitrary
CVE-2024-33788
CVE-2024-30973
IDOR
CVE-2024-33907
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
NEXT »