3 results · Clear filters · Feed
-
High 7.3
PHP_CodeSniffer gitblame report command injection via crafted filename
PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHP_CodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame repo…
-
High —
Arbitrary shell execution
A properly crafted filename would allow for arbitrary code execution when using the --filter=gitmodified command line option
-
High —
Arbitrary shell execution
Uses of shell_exec() and exec() were not escaping filenames and configuration settings in most cases