Joernchen

Specially crafted Git repositories can cause `jj` to write files outside the clone. This issue can be achieved by having file objects which contain path traversals. To exploit this, an attacker would need to create a crafted Git repository and have the victim clone it using `jj`. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue is related to insufficient server-side request validation, allowing an attacker to perform Server-Side Request Forgery (SSRF) attacks using a custom Maven Dependency Proxy URL. This enables the attacker to make requests to internal resources.

The issue is related to an incorrect restriction of the path name to a directory with limited access. This allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include the ability to write arbitrary files while creating a workspace. No specific API endpoints, vulnerable parameters, or function names are mentioned in the provided descriptions.

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. An attacker can exploit this issue by making a victim navigate to a malicious website and guiding them through the OIDC flow, stealing the OAuth authorization code in the process. The authorization code can then be exchanged for a token, gaining access to applications accepting that token.

The issue is related to OS command injection, which can result in shell execution if an RPM contains a malicious `payload compressor` field. This impacts the `extract` and `files` methods of the `RPM::File` class. To mitigate, ensure RPMs being processed contain valid payload compressor values such as `gzip`, `bzip2`, `xz`, `zstd`, and `lzma`. The payload compressor field in an RPM can be checked using the `rpm` command line tool.

Discourse is an open source platform for community discussion. In affected versions, maliciously crafted requests could lead to remote code execution. This resulted from a lack of validation in `subscribe url` values. It is estimated that around 14,300 sites are potentially vulnerable, with 8,639 potentially vulnerable systems located in the USA.

Name of the Vulnerable Software and Affected Versions: GitLab versions 5.0 through 5.4.2 GitLab Community Edition versions 5.0 through 6.2.4 GitLab Enterprise Edition versions 5.0 through 6.2.1 gitlab-shell versions prior to 1.7.8 Description: The issue allows remote authenticated users to gain privileges and clone arbitrary repositories due to a problem in the `parse cmd` function. Recommendations: For GitLab versions 5.0 through 5.4.2, update to version 5.4.2 or later. For GitLab Community Edition versions 5.0 through 6.2.4, update to version 6.2.4 or later. For GitLab Enterprise Edition versions 5.0 through 6.2.1, update to version 6.2.1 or later. For gitlab-shell versions prior to 1.7.8, update to version 1.7.8 or later.

Name of the Vulnerable Software and Affected Versions: GitLab versions 5.0 through 5.4.2 GitLab Community Edition versions prior to 6.2.4 GitLab Enterprise Edition versions prior to 6.2.1 gitlab-shell versions prior to 1.7.8 Description: The issue allows remote authenticated users to include information from local files into the metadata of a Git repository via the web interface. This is due to vulnerabilities in the `create branch`, `create tag`, `import project`, and `fork project` functions in lib/gitlab projects.rb. Recommendations: For GitLab versions 5.0 through 5.4.2, update to version 5.4.2 or later. For GitLab Community Edition versions prior to 6.2.4, update to version 6.2.4 or later. For GitLab Enterprise Edition versions prior to 6.2.1, update to version 6.2.1 or later. For gitlab-shell versions prior to 1.7.8, update to version 1.7.8 or later.

The issue is related to the incorrect handling of the recursive `git clone` task applied to a superproject, where the .gitmodules file has a URL field starting with a '-' character. This can allow a remote attacker to execute arbitrary code.

The issue allows remote authenticated users to execute arbitrary code via the -O or --open-files-in-pager flags when the string `master` is in any of the wiki documents. This is due to a vulnerability in the gollum-grit adapter Ruby gem dependency in gollum and the gollum-lib gem dependency in gollum-lib.

The issue is related to the use of unsafe Perl scripts to support subcommands such as `cvsserver`, allowing attackers to execute arbitrary OS commands via shell metacharacters in a module name. This can be exploited remotely to execute commands as the git user. The vulnerable code can be reached via `git-shell` even without CVS support.

Name of the Vulnerable Software and Affected Versions: rubyonrails rails (affected versions not specified) Description: The issue concerns a problem in rubyonrails rails. No specific details about the nature of the issue, affected devices, or real-world incidents are provided. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows remote attackers to bypass the whitelisted ips protection mechanism via a crafted request. This is due to the improper restriction of X-Forwarded-For headers in determining a client's IP address.

The issue allows remote attackers to impersonate arbitrary users and bypass authentication via unspecified API calls when using a MySQL backend.

The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment. Multiple vulnerabilities in the sup-mail package of the Debian GNU/Linux operating system can be exploited remotely, potentially leading to a breach of confidentiality, integrity, and availability of protected information.

The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the `content type` of an email attachment. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be carried out remotely.

The issue allows remote attackers to conduct data-type injection attacks against Ruby on Rails applications. This is due to the Active Record component not ensuring that the declared data type of a database column is used during comparisons of input values to stored values in that column. The attack can be carried out via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.

The issue allows remote attackers to bypass the `attr protected` protection mechanism and modify protected model attributes via a crafted request. This enables attackers to manipulate attributes that should be protected, potentially leading to unauthorized data modifications.

The issue allows remote authenticated users to obtain sensitive information via unknown vectors.

The issue allows remote attackers to execute arbitrary commands via unknown vectors.