Gitlist
Monthly
GitList 2.0.0's XML-based commit parser in CommandLine.php can be remotely triggered without authentication to cause a denial-of-service condition, crashing or hanging the PHP process that renders the GitList interface. The root cause is PHP's SimpleXMLElement being used to parse git log output formatted as XML - commit content can be crafted to cause pathological resource consumption or unhandled parse failures (CWE-404). A public proof-of-concept exists per GitHub issue #948 and the CVSS 4.0 E:P exploitability modifier; the flaw is not listed in CISA KEV, so mass active exploitation is not confirmed at time of analysis.
klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` function that can result in Execute any code as PHP user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Repository.php in Gitter, as used in Gitlist, allows remote attackers with commit privileges to execute arbitrary commands via shell metacharacters in a branch name, as demonstrated by a "git. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1) blame, (2) file, or (3) stats page, as. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.6%.
Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
GitList 2.0.0's XML-based commit parser in CommandLine.php can be remotely triggered without authentication to cause a denial-of-service condition, crashing or hanging the PHP process that renders the GitList interface. The root cause is PHP's SimpleXMLElement being used to parse git log output formatted as XML - commit content can be crafted to cause pathological resource consumption or unhandled parse failures (CWE-404). A public proof-of-concept exists per GitHub issue #948 and the CVSS 4.0 E:P exploitability modifier; the flaw is not listed in CISA KEV, so mass active exploitation is not confirmed at time of analysis.
klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` function that can result in Execute any code as PHP user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Repository.php in Gitter, as used in Gitlist, allows remote attackers with commit privileges to execute arbitrary commands via shell metacharacters in a branch name, as demonstrated by a "git. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1) blame, (2) file, or (3) stats page, as. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.6%.
Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.