Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 44

Export CSV
CVE-2018-11235

git: arbitrary code execution when recursively cloning a malicious repository

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.

CVSS 3.0 · 7.8 High EPSS 47.4% KEV · Not listed
Vendors
Canonical Debian Git-scm and 2 more
Products
Ubuntu Linux Debian Linux Git and 7 more
CVE-2018-11233

git: path sanity check in is_ntfs_dotgit() can read arbitrary memory

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory.

CVSS 3.0 · 7.5 High EPSS 4.3% KEV · Not listed
Vendors
Canonical Git-scm Redhat
Products
Ubuntu Linux Git Rhel Software Collections
CVE-2018-1000021

git: client prints server-sent ANSI escape codes to the terminal, allowing for unverified messages to potentially execute arbitrary commands

GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems including messing up terminal configuration to RCE. This attack appear to be exploitable via The user must interact with a malicious git server, (or have their traffic modified in a MITM attack).

CVSS 3.1 · 5.0 Medium EPSS 1.1% KEV · Not listed
Vendors
Git-scm
Products
Git
CVE-2014-9390

git: arbitrary command execution vulnerability on case-insensitive file systems

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

CVSS 3.1 · 9.8 Critical EPSS 75.6% KEV · Not listed
Vendors
Apple Eclipse Git-scm and 3 more
Products
Mac Os X Xcode Egit and 5 more