27 results · Feed
-
Medium 6.5
libgit2: HTTP transport can leak credentials to an offsite redirect target
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c f…
-
Medium 6.5
libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verify_server_cert in src/libgit2/streams/openssl.c uses an in…
-
Medium 5.3
libgit2: Unbounded Memory Allocation via Delta Object Result-Size Header
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, git_delta_apply in src/libgit2/delta.c trusts the attacker-con…
-
High 7.5CVE-2026-53587 Public exploit
libgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_data
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgi…
-
Medium 4.3
libgit2: Submodule path traversal
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule pa…
-
High 8.8
libgit2 Shell Command Injection via ssh_libssh2 Backend
libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository pat…
-
High 8.6
libgit2 is vulnerable to arbitrary code execution due to heap corruption in `git_index_add`
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_index_add` can cause heap corruption that could be lev…
-
High 7.5
libgit2 is vulnerable to a denial of service attack in `git_revparse_single`
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_revparse_single` can cause the function to enter an in…
-
Medium 5.3
libgit2 fails to verify SSH keys by default
libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the `certificate_che…
-
High 7.8
Bypass of safe.directory protections in Git
Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported …
-
Medium 6.0CVE-2022-24765 Public exploit
Uncontrolled search for the Git directory in Git for Windows
Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\.git`, …
-
Unscored —
An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15…
-
Unscored —
An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15…
-
Unscored —CVE-2019-1352 EPSS 24%
A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual…
-
Unscored —CVE-2019-1354 EPSS 23%
A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual…
-
Unscored —CVE-2019-1351 Public exploit
A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual…
-
Unscored —CVE-2019-1349 EPSS 34%
A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual…
-
Unscored —CVE-2019-1350 EPSS 26%
A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual…
-
Unscored —
An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15…
-
Unscored —
In ng_pkt in transports/smart_pkt.c in libgit2 before 0.26.6 and 0.27.x before 0.27.4, a remote attacker can send a cra…
-
Unscored —
A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delt…
-
Unscored —
A flaw was found in libgit2 before version 0.27.3. A missing check in git_delta_apply function in delta.c file, may lea…
-
Unscored —
The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a den…
-
Unscored —
The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the…
-
Unscored —
Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgi…
-
Unscored —
The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NU…
-
Unscored —
The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service …