Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    GHSA-VJFR-P6HP-JQQW

    Vulnerability from github – Published: 2020-08-31 23:00 – Updated: 2021-09-23 21:01
    VLAI
    Summary
    Command Injection in ungit
    Details

    Versions of ungit prior to 0.9.0 are affected by a command injection vulnerability in the url parameter.

    Recommendation

    Update version 0.9.0 or later.

    Show details on source website
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.8.4"
      },
      "package": {
        "ecosystem": "npm",
        "name": "ungit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2015-4130"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:08:53Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "Versions of `ungit` prior to 0.9.0 are affected by a command injection vulnerability in the `url` parameter.\n\n\n## Recommendation\n\nUpdate version 0.9.0 or later.",
  "id": "GHSA-vjfr-p6hp-jqqw",
  "modified": "2021-09-23T21:01:14Z",
  "published": "2020-08-31T23:00:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4130"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FredrikNoren/ungit/issues/486"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/FredrikNoren/ungit"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/40"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Command Injection in ungit"
}

    GSD-2015-4130

    Vulnerability from gsd - Updated: 2023-12-13 01:19
    Details
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
    Aliases
    Aliases
    CVE-2015-4130
    To clipboard 

    {
  "GSD": {
    "alias": "CVE-2015-4130",
    "id": "GSD-2015-4130"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2015-4130"
      ],
      "id": "GSD-2015-4130",
      "modified": "2023-12-13T01:19:59.600943Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2015-4130",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c=0.8.4",
          "affected_versions": "All versions up to 0.8.4",
          "credit": "CodingTwinky",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2015-01-22",
          "description": "Due to the use of `child_process.exec` when executing git commands, ungit allows for commands to be injectied from user input fields that end up in an executed git command.",
          "fixed_versions": [
            "0.9.0"
          ],
          "identifier": "CVE-2015-4130",
          "identifiers": [
            "CVE-2015-4130"
          ],
          "package_slug": "npm/ungit",
          "pubdate": "2015-01-22",
          "solution": "Update to the version \u003e=0.9.0",
          "title": "Command Injection",
          "urls": [
            "https://github.com/FredrikNoren/ungit/issues/486"
          ],
          "uuid": "4fa4b2a3-8858-4b56-bd1d-fee5ec49c8e3"
        }
      ]
    }
  }
}