CVE-2024-35241
- EPSS 0.48%
- Published 10.06.2024 22:15:09
- Last modified 21.04.2025 16:15:54
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository ca...
CVE-2024-35242
- EPSS 25.51%
- Published 10.06.2024 22:15:09
- Last modified 13.02.2025 18:18:05
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cl...
CVE-2024-24821
- EPSS 0.1%
- Published 09.02.2024 00:15:08
- Last modified 21.11.2024 08:59:47
Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation of Composer and in the context of the executing user. As such, under certain conditions ar...
CVE-2023-43655
- EPSS 2.26%
- Published 29.09.2023 20:15:09
- Last modified 23.04.2025 17:31:40
Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_...
CVE-2015-8371
- EPSS 0.72%
- Published 21.09.2023 06:15:11
- Last modified 21.11.2024 02:38:23
Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache ...
CVE-2022-24828
- EPSS 0.22%
- Published 13.04.2022 21:15:07
- Last modified 21.11.2024 06:51:11
Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads t...
CVE-2021-41116
- EPSS 0.72%
- Published 05.10.2021 18:15:08
- Last modified 21.11.2024 06:25:30
Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL ar...
CVE-2021-29472
- EPSS 3.3%
- Published 27.04.2021 21:15:08
- Last modified 21.11.2024 06:01:11
Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow code to be executed in the HgDriver if hg/Mercuria...