Git

CVEs (58)

• CVE-2022-25648Apr 19, 2022
  Git

  Git
  risk 0.00cvss —epss 0.05

  The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags…

• CVE-2021-23632Mar 17, 2022
  Git

  Git
  risk 0.00cvss —epss 0.02

  All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. Steps to Reproduce 1. Create a file named exploit.js with the following content: js…

• CVE-2022-24975Feb 11, 2022
  Git

  Git
  risk 0.00cvss —epss 0.03

  The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option. Note: This has…

• CVE-2021-40330Aug 31, 2021
  Git

  Git
  risk 0.00cvss —epss 0.03

  git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring.

• CVE-2020-11008Apr 21, 2020
  Git

  Git
  risk 0.00cvss —epss 0.04

  Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an exploit where _some_…

• CVE-2020-5260Apr 14, 2020
  Git

  Git
  risk 0.00cvss —epss 0.10

  Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the…

• CVE-2019-1348Jan 24, 2020
  Git

  Git
  risk 0.00cvss —epss 0.00

  An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting…

• CVE-2019-1353Jan 24, 2020
  Git

  Git
  risk 0.00cvss —epss 0.02

  An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as "WSL") while accessing a working directory on a regular Windows drive, none…

• CVE-2019-1387Dec 18, 2019
  Git

  Git
  risk 0.00cvss —epss 0.04

  An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted…

• CVE-2019-19604Dec 10, 2019
  Git

  Git
  risk 0.00cvss —epss 0.04

  Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository.

• CVE-2018-19486Nov 23, 2018
  Git

  Git
  risk 0.00cvss —epss 0.04

  Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017.

• CVE-2015-7082Dec 11, 2015
  Git

  Git
  risk 0.00cvss —epss 0.02

  Multiple unspecified vulnerabilities in Git before 2.5.4, as used in Apple Xcode before 7.2, have unknown impact and attack vectors. NOTE: this CVE is associated only with Xcode use cases.

• CVE-2013-0308Mar 8, 2013
  Git

  Git
  risk 0.00cvss —epss 0.02

  The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…

• CVE-2010-2542Aug 11, 2010
  Git

  Git
  risk 0.00cvss —epss 0.03

  Stack-based buffer overflow in the is_git_directory function in setup.c in Git before 1.7.2.1 allows local users to gain privileges via a long gitdir: field in a .git file in a working copy.

• CVE-2008-5916Jan 21, 2009
  Git

  Git
  risk 0.00cvss —epss 0.00

  gitweb/gitweb.perl in gitweb in Git 1.6.x before 1.6.0.6, 1.5.6.x before 1.5.6.6, 1.5.5.x before 1.5.5.6, 1.5.4.x before 1.5.4.7, and other versions after 1.4.3 allows local repository owners to execute arbitrary commands by modifying the diff.external configuration variable and…

• CVE-2008-5516Jan 20, 2009
  Git

  Git
  risk 0.00cvss —epss 0.04

  The web interface in git (gitweb) 1.5.x before 1.5.5 allows remote attackers to execute arbitrary commands via shell metacharacters related to git_search.

• CVE-2008-3546Aug 7, 2008
  Git

  Git
  risk 0.00cvss —epss 0.04

  Stack-based buffer overflow in the (1) diff_addremove and (2) diff_change functions in GIT before 1.5.6.4 might allow local users to execute arbitrary code via a PATH whose length is larger than the system's PATH_MAX when running GIT utilities such as git-diff or git-grep.

• CVE-2006-0477Jan 31, 2006
  Git

  Git
  risk 0.00cvss —epss 0.03

  Buffer overflow in git-checkout-index in GIT before 1.1.5 allows remote attackers to execute arbitrary code via an index file with a long symbolic link.