Cgit Project

cgit_project

4 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-14912 2Cgit Project Debian 2Cgit Debian Linux Nov 21, 2024 Aug 3, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.
CVE-2016-1901 2Cgit Project Fedoraproject 2Cgit Fedora May 6, 2026 Jan 20, 2016 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Integer overflow in the authenticate_post function in CGit before 0.12 allows remote attackers to have unspecified impact via a large value in the Content-Length HTTP header, which triggers a buffer overflow.
CVE-2016-1900 2Cgit Project Fedoraproject 2Cgit Fedora May 6, 2026 Jan 20, 2016 N/A· v4 3.7 LOW· v3 4.3 MEDIUM· v2 CRLF injection vulnerability in the cgit_print_http_headers function in ui-shared.c in CGit before 0.12 allows remote attackers with permission to write to a repository to inject arbitrary HTTP headers and conduct HTTP r...Show more CRLF injection vulnerability in the cgit_print_http_headers function in ui-shared.c in CGit before 0.12 allows remote attackers with permission to write to a repository to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via newline characters in a filename.Show less
CVE-2016-1899 2Cgit Project Fedoraproject 2Cgit Fedora May 6, 2026 Jan 20, 2016 N/A· v4 3.7 LOW· v3 4.3 MEDIUM· v2 CRLF injection vulnerability in the ui-blob handler in CGit before 0.12 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via CRLF...Show more CRLF injection vulnerability in the ui-blob handler in CGit before 0.12 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via CRLF sequences in the mimetype parameter, as demonstrated by a request to blob/cgit.c.Show less