CVE-2024-41956

HIGH Year: 2024
CVSS v3 Score
8.1
High
Weakness Type
CWE-78
View all →

Vulnerability Description

Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve passes all environment variables given by the client to git subprocesses. This includes environment variables that control program execution, such as LD_PRELOAD. This vulnerability is fixed in 0.7.5.

Related Vulnerabilities

CVE-2015-7611

HIGH
CVSS:8.1(High)

Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.

CWE-782015

CVE-2016-1482

HIGH
CVSS:8.1(High)

Cisco WebEx Meetings Server 2.6 allows remote attackers to execute arbitrary commands by injecting these commands into an application script, aka Bug ID CSCuy83130.

CWE-782016

CVE-2017-11318

HIGH
CVSS:8.1(High)

Cobian Backup 11 client allows man-in-the-middle attackers to add and execute new backup tasks when the master server is spoofed. In addition, the attacker can execute system commands remotely by abus...

CWE-782017

CVE-2017-12581

HIGH
CVSS:8.1(High)

GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earl...

CWE-782017

CVE-2017-14705

HIGH
CVSS:8.1(High)

DenyAll WAF before 6.4.1 allows unauthenticated remote command execution via TCP port 3001 because shell metacharacters can be inserted into the type parameter to the tailDateFile function in /webserv...

CWE-782017

CVE-2017-2824

HIGH
CVSS:8.1(High)

An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a command injection resulting in remote cod...

CWE-782017