Gitolite

Gitolite

7 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.8

CVE-2010-2447

  • EPSS 0.51%
  • Veröffentlicht 07.11.2019 20:15:10
  • Zuletzt bearbeitet 21.11.2024 01:16:40

gitolite before 1.4.1 does not filter src/ or hooks/ from path names.

8.1

CVE-2018-20683

  • EPSS 0.48%
  • Veröffentlicht 10.01.2019 01:29:00
  • Zuletzt bearbeitet 21.11.2024 04:01:59

commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles the rsync command line, which allows attackers to have a "bad" impact by triggering use of an option other than -v, -n, -q, or -P.

5.5

CVE-2013-7203

  • EPSS 0.07%
  • Veröffentlicht 21.09.2018 17:29:01
  • Zuletzt bearbeitet 21.11.2024 02:00:29

gitolite before commit fa06a34 might allow local users to read arbitrary files in repositories via vectors related to the user umask when running gitolite setup.

9.8

CVE-2013-4451

  • EPSS 1.39%
  • Veröffentlicht 21.09.2018 17:29:00
  • Zuletzt bearbeitet 21.11.2024 01:55:35

gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving world-writable permissions when creating (1) ~/.gitolite.rc, (2) ~/.gitolite, or (3) ~/repositories/gitolite-admin.git on fresh installs.

8.1

CVE-2018-16976

  • EPSS 0.23%
  • Veröffentlicht 12.09.2018 22:29:00
  • Zuletzt bearbeitet 21.11.2024 03:53:37

Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of being migrated until the full set of migration steps has been completed. This can allow valid ...

4.6

CVE-2012-4506

  • EPSS 0.55%
  • Veröffentlicht 22.10.2012 23:55:07
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Directory traversal vulnerability in gitolite 3.x before 3.1, when wild card repositories and a pattern matching "../" are enabled, allows remote authenticated users to create arbitrary repositories and possibly perform other actions via a .. (dot do...

6.8

CVE-2011-1572

  • EPSS 0.59%
  • Veröffentlicht 04.10.2011 10:55:09
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Directory traversal vulnerability in the Admin Defined Commands (ADC) feature in gitolite before 1.5.9.1 allows remote attackers to execute arbitrary commands via .. (dot dot) sequences in admin-defined commands.