Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
aping of html-like characters in the response-stream. To fix this vulnerability upgrade to version 1.1.1 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/urql-graphql/urql/security/advisories/GHSA-qhjf-hm5j-335w - https://github.com/urql-graphql/urql/commit/4b7011b70d5718728ff912d02a4dbdc7f703540d
CVE ID: CVE-2024-24557 State: PUBLISHED Published: 2024-02-01T16:26:29.685Z Last Updated: 2025-05-15T15:27:27.082Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L) Vendors: moby Products: moby Problem Types: CWE-346, CWE-345 Description: Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that w
owledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://
and 25.0.2 releases. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc - https://github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae
CVE ID: CVE-2024-24558 State: PUBLISHED Published: 2024-01-30T19:36:48.810Z Last Updated: 2024-08-23T18:20:15.958Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: TanStack Products: query Problem Types: CWE-79 Description: TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The `@tanstack/react-query-next-experimental` NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or arrange to have malicious input be returned from an endpoint. To fix this issue, please update to version 5.18.0 or later. Additional Analyst Notes
nput be returned from an endpoint. To fix this issue, please update to version 5.18.0 or later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TanStack/query/security/advisories/GHSA-997g-27x8-43rf - https://github.com/TanStack/query/commit/f2ddaf2536e8b71d2da88a9310ac9a48c13512a1
CVE ID: CVE-2024-24559 State: PUBLISHED Published: 2024-02-05T21:04:42.056Z Last Updated: 2024-08-26T18:13:59.422Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: vyperlang Products: vyper Problem Types: CWE-327 Description: Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the `IR` for `sha3_64`. Concretely, the `height` variable is miscalculated. The vulnerability can't be triggered without writing the `IR` by hand (that is, it cannot be triggered from regular vyper code). `sha3_64` is used for retrieval in mappings. No flow that would cache the `key` was found so the issue shouldn't be possible
_64` is used for retrieval in mappings. No flow that would cache the `key` was found so the issue shouldn't be possible to trigger when compiling the compiler-generated `IR`. This issue isn't triggered during normal compilation of vyper code so the impact is low. At the time of publication there is no patch available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vyperlang/vyper/security/advisories/GHSA-6845-xw22-ffxv - https://github.com/vyperlang/vyper/blob/c150fc49ee9375a930d177044559b83cb95f7963/vyper/ir/compile_ir.py#L585-L586
CVE ID: CVE-2024-24560 State: PUBLISHED Published: 2024-02-02T16:19:45.822Z Last Updated: 2024-08-01T23:19:52.915Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: vyperlang Products: vyper Problem Types: CWE-119 Description: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. When calls to external contracts are made, we write the input buffer starting at byte 28, and allocate the return buffer to start at byte 0 (overlapping with the input buffer). When checking RETURNDATASIZE for dynamic types, the size is compared only to the minimum allowed size for that type, and not to the returned value's length. As a result, malformed return da
only to the minimum allowed size for that type, and not to the returned value's length. As a result, malformed return data can cause the contract to mistake data from the input buffer for returndata. When the called contract returns invalid ABIv2 encoded data, the calling contract can read different invalid data (from the dirty buffer) than the called contract returned. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/vyperlang/vyper/security/advisories/GHSA-gp3w-2v2m-p686
CVE ID: CVE-2024-24561 State: PUBLISHED Published: 2024-02-01T16:37:01.007Z Last Updated: 2025-06-17T21:29:22.442Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: vyperlang Products: vyper Problem Types: CWE-119 Description: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and earlier, the bounds check for slices does not account for the ability for start + length to overflow when the values aren't literals. If a slice() function uses a non-literal argument for the start or length variable, this creates the ability for an attacker to overflow the bounds check. This issue can be used to do OOB access to storag
this creates the ability for an attacker to overflow the bounds check. This issue can be used to do OOB access to storage, memory or calldata addresses. It can also be used to corrupt the length slot of the respective array. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vyperlang/vyper/security/advisories/GHSA-9x7f-gwxq-6f2c - https://github.com/vyperlang/vyper/issues/3756 - https://github.com/vyperlang/vyper/blob/b01cd686aa567b32498fefd76bd96b0597c6f099/vyper/builtins/functions.py#L404-L457
CVE ID: CVE-2024-24562 State: PUBLISHED Published: 2024-03-14T18:52:31.109Z Last Updated: 2024-08-01T23:19:52.915Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: vantage6 Products: vantage6-UI Problem Types: CWE-693, CWE-668 Description: vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addressed in commit `68dfa6614` which is expected to be included in future releases. Users are advised to upgrade when a new release is made. While an upgrade path is not available users may modify the docker image build to insert the headers into nginx. Additional Analyst No
de path is not available users may modify the docker image build to insert the headers into nginx. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/vantage6/vantage6-UI/security/advisories/GHSA-gwq3-pvwq-4c9w - https://github.com/vantage6/vantage6-UI/commit/68dfa661415182da0e5717bd58db3d00aedcbd2e
CVE ID: CVE-2024-24563 State: PUBLISHED Published: 2024-02-07T17:10:08.385Z Last Updated: 2025-06-17T21:29:28.634Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: vyperlang Products: vyper Problem Types: CWE-129 Description: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. Arrays can be keyed by a signed integer, while they are defined for unsigned integers only. The typechecker doesn't throw when spotting the usage of an `int` as an index for an array. The typechecker allows the usage of signed integers to be used as indexes to arrays. The vulnerability is present in different forms in all versions, including `0.3.10`. For int
used as indexes to arrays. The vulnerability is present in different forms in all versions, including `0.3.10`. For ints, the 2's complement representation is used. Because the array was declared very large, the bounds checking will pass Negative values will simply be represented as very large numbers. As of time of publication, a fixed version does not exist. There are three potential vulnerability classes: unpredictable behavior, accessing inaccessible elements and denial of service. Class 1: If it is possible to index an array with a negative integer without reverting, this is most likely not anticipated by the developer and such accesses can cause unpredictable behavior for the contract
this is most likely not anticipated by the developer and such accesses can cause unpredictable behavior for the contract. Class 2: If a contract has an invariant in the form `assert index < x`, the developer will suppose that no elements on indexes `y | y >= x` are accessible. However, by using negative indexes, this can be bypassed. Class 3: If the index is dependent on the state of the contract, this poses a risk of denial of service. If the state of the contract can be manipulated in such way that the index will be forced to be negative, the array access can always revert (because most likely the array won't be declared extremely large). However, all these the scenarios are highly unlikel
t (because most likely the array won't be declared extremely large). However, all these the scenarios are highly unlikely. Most likely behavior is a revert on the bounds check. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vyperlang/vyper/security/advisories/GHSA-52xq-j7v9-v4v2 - https://github.com/vyperlang/vyper/blob/a1fd228cb9936c3e4bbca6f3ee3fb4426ef45490/vyper/codegen/core.py#L534-L541 - https://github.com/vyperlang/vyper/blob/c150fc49ee9375a930d177044559b83cb95f7963/vyper/semantics/types/subscriptable.py#L127-L137
CVE ID: CVE-2024-24564 State: PUBLISHED Published: 2024-02-26T20:16:13.604Z Last Updated: 2024-10-25T20:33:03.845Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: vyperlang Products: vyper Problem Types: CWE-125 Description: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`. This vulnerability is fixed in 0.4.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git
is fixed in 0.4.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vyperlang/vyper/security/advisories/GHSA-4hwq-4cpm-8vmx - https://github.com/vyperlang/vyper/commit/3d9c537142fb99b2672f21e2057f5f202cde194f
CVE ID: CVE-2024-24565 State: PUBLISHED Published: 2024-01-30T16:46:15.200Z Last Updated: 2024-08-23T19:32:35.447Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: crate Products: crate Problem Types: CWE-22 Description: CrateDB is a distributed SQL database that makes it simple to store and analyze massive amounts of data in real-time. There is a COPY FROM function in the CrateDB database that is used to import file data into database tables. This function has a flaw, and authenticated attackers can use the COPY FROM function to import arbitrary file content into database tables, resulting in information leakage. This vulnerability is patched in 5.3.9, 5.4.8
trary file content into database tables, resulting in information leakage. This vulnerability is patched in 5.3.9, 5.4.8, 5.5.4, and 5.6.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/crate/crate/security/advisories/GHSA-475g-vj6c-xf96 - https://github.com/crate/crate/commit/4e857d675683095945dd524d6ba03e692c70ecd6
CVE ID: CVE-2024-24566 State: PUBLISHED Published: 2024-01-31T16:33:44.129Z Last Updated: 2025-06-17T21:29:21.984Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: lobehub Products: lobe-chat Problem Types: CWE-284 Description: Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected (deployed with the `ACCESS_CODE` option), it is possible to access plugins without proper authorization (without password). This vulnerability is patched in 0.122.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/
n 0.122.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lobehub/lobe-chat/security/advisories/GHSA-pf55-fj96-xf37 - https://github.com/lobehub/lobe-chat/commit/2184167f09ab68e4efa051ee984ea0c4e7c48fbd
CVE ID: CVE-2024-24567 State: PUBLISHED Published: 2024-01-30T20:17:53.955Z Last Updated: 2025-06-16T18:48:26.606Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: vyperlang Products: vyper Problem Types: CWE-754 Description: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin raw_call even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics of the respective opcodes, and vyper will silently ignore the value= argument. If the semantics of the EVM are unknown to the developer, he coul
s, and vyper will silently ignore the value= argument. If the semantics of the EVM are unknown to the developer, he could suspect that by specifying the `value` kwarg, exactly the given amount will be sent along to the target. This vulnerability affects 0.3.10 and earlier versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vyperlang/vyper/security/advisories/GHSA-x2c2-q32w-4w6m - https://github.com/vyperlang/vyper/blob/9136169468f317a53b4e7448389aa315f90b95ba/vyper/builtins/functions.py#L1100
CVE ID: CVE-2024-24568 State: PUBLISHED Published: 2024-02-26T15:54:52.314Z Last Updated: 2025-02-13T17:40:11.287Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: OISF Products: suricata Problem Types: CWE-284 Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, the rules inspecting HTTP2 headers can get bypassed by crafted traffic. The vulnerability has been patched in 7.0.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OISF/suricata/security/advisories/GHSA-gv29-5hqw-5h8c - https://github.com/OISF/sur
nt: References: - https://github.com/OISF/suricata/security/advisories/GHSA-gv29-5hqw-5h8c - https://github.com/OISF/suricata/commit/478a2a38f54e2ae235f8486bff87d7d66b6307f0 - https://redmine.openinfosecfoundation.org/issues/6717 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GOCOBFUTIFHOP2PZOH4ENRFXRBHIRKK4/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZXJIT7R53ZXROO3I256RFUWTIW4ECK6P/
CVE ID: CVE-2024-24569 State: PUBLISHED Published: 2024-02-01T19:02:17.452Z Last Updated: 2025-06-17T21:29:22.586Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: pixee Products: java-security-toolkit Problem Types: CWE-22 Description: The Pixee Java Code Security Toolkit is a set of security APIs meant to help secure Java code. `ZipSecurity#isBelowCurrentDirectory` is vulnerable to a partial-path traversal bypass. To be vulnerable to the bypass, the application must use toolkit version <=1.1.1, use ZipSecurity as a guard against path traversal, and have an exploit path. Although the control still protects attackers from escaping the application path into hi
rsal, and have an exploit path. Although the control still protects attackers from escaping the application path into higher level directories (e.g., /etc/), it will allow "escaping" into sibling paths. For example, if your running path is /my/app/path you an attacker could navigate into /my/app/path-something-else. This vulnerability is patched in 1.1.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pixee/java-security-toolkit/security/advisories/GHSA-qh4g-4m4w-jgv2 - https://github.com/pixee/java-security-toolkit/commit/b885b03c9cfae53d62d239037f9654d973dd54d9 - https://github.com/pixee/java-security-toolkit/blob/7c8e93e6fb2420
kit/commit/b885b03c9cfae53d62d239037f9654d973dd54d9 - https://github.com/pixee/java-security-toolkit/blob/7c8e93e6fb2420fb6003c54a741e267c4f883bab/src/main/java/io/github/pixee/security/ZipSecurity.java#L82-L87
CVE ID: CVE-2024-24570 State: PUBLISHED Published: 2024-02-01T16:42:57.717Z Last Updated: 2025-06-17T21:29:22.712Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: statamic Products: cms Problem Types: CWE-79 Description: Statamic is a Laravel and Git powered CMS. HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects the front-end forms with asset fields without any mime type validation, asset fields in the control panel, and asset browser in the control panel. Additionally, if the XSS is crafted in a specific way, the "copy password reset link" feature may be exploited to gain access to a user's password reset token
a specific way, the "copy password reset link" feature may be exploited to gain access to a user's password reset token and gain access to their account. The authorized user is required to execute the XSS in order for the vulnerability to occur. In versions 4.46.0 and 3.4.17, the XSS vulnerability has been patched, and the copy password reset link functionality has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/statamic/cms/security/advisories/GHSA-vqxq-hvxw-9mv9 - http://seclists.org/fulldisclosure/2024/Feb/17 - http://packetstormsecurity.com/files/177133/Statamic-CMS-Cross-Site-Scripting.html
CVE ID: CVE-2024-24571 State: PUBLISHED Published: 2024-01-31T22:32:51.646Z Last Updated: 2025-05-29T15:03:05.207Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: WillyXJ Products: facileManager Problem Types: CWE-80 Description: facileManager is a modular suite of web apps built with the sysadmin in mind. For the facileManager web application versions 4.5.0 and earlier, we have found that XSS was present in almost all of the input fields as there is insufficient input validation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/WillyXJ/facileManager/security/advisories/GHSA-h7w3-xv88-2xqj - https:/
P Vulnrichment: References: - https://github.com/WillyXJ/facileManager/security/advisories/GHSA-h7w3-xv88-2xqj - https://github.com/WillyXJ/facileManager/commit/0aa850d4b518f10143a4c675142b15caa5872877
CVE ID: CVE-2024-24572 State: PUBLISHED Published: 2024-01-31T22:33:08.498Z Last Updated: 2024-10-17T17:08:31.130Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: WillyXJ Products: facileManager Problem Types: CWE-89 Description: facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, the $_REQUEST global array was unsafely called inside an extract() function in admin-logs.php. The PHP file fm-init.php prevents arbitrary manipulation of $_SESSION via the GET/POST parameters. However, it does not prevent manipulation of any other sensitive variables such as $search_sql. Knowing this, an authenticated user w
oes not prevent manipulation of any other sensitive variables such as $search_sql. Knowing this, an authenticated user with privileges to view site logs can manipulate the search_sql variable by appending a GET parameter search_sql in the URL. The information above means that the checks and SQL injection prevention attempts were rendered unusable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/WillyXJ/facileManager/security/advisories/GHSA-xw34-8pj6-75gc - https://github.com/WillyXJ/facileManager/commit/0aa850d4b518f10143a4c675142b15caa5872877
CVE ID: CVE-2024-24573 State: PUBLISHED Published: 2024-01-31T22:33:11.697Z Last Updated: 2025-06-16T18:24:44.392Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: WillyXJ Products: facileManager Problem Types: CWE-863 Description: facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, when a user updates their profile, a POST request containing user information is sent to the endpoint server/fm-modules/facileManager/ajax/processPost.php. It was found that non-admins can arbitrarily set their permissions and grant their non-admin accounts with super user privileges. Additional Analyst Notes: - CVE Program Co
ir permissions and grant their non-admin accounts with super user privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/WillyXJ/facileManager/security/advisories/GHSA-w67q-pp62-j4pf - https://github.com/WillyXJ/facileManager/commit/0aa850d4b518f10143a4c675142b15caa5872877
CVE ID: CVE-2024-24574 State: PUBLISHED Published: 2024-02-05T20:57:13.115Z Last Updated: 2025-06-17T14:01:12.409Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: thorsten Products: phpMyFAQ Problem Types: CWE-79, CWE-80 Description: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leads to allowed execution of JavaScript code in client side (XSS). This vulnerability has been patched in version 3.2.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/thorsten/phpMyFAQ/security/advi
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7m8g-fprr-47fx - https://github.com/thorsten/phpMyFAQ/pull/2827 - https://github.com/thorsten/phpMyFAQ/commit/5479b4a4603cce71aa7eb4437f1c201153a1f1f5
CVE ID: CVE-2024-24575 State: PUBLISHED Published: 2024-02-06T21:27:57.328Z Last Updated: 2025-02-13T17:40:13.105Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: libgit2 Products: libgit2 Problem Types: CWE-400 Description: libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_revparse_single` can cause the function to enter an infinite loop, potentially causing a Denial of Service attack in the calling application. The revparse function in `src/libgit2/revparse.c` uses a loop to parse the user-provided spec st