CVE-2019-10802

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

giting version prior to 0.0.8 allows execution of arbritary commands. The first argument "repo" of function "pull()" is executed by the package without any validation.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
n/agitingAll versions prior to 0.0.8

References

Timeline

Published
Feb 28, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-108039.8push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable "opt.branch" is not validated befoCVE-2019-108049.8serial-number through 1.3.0 allows execution of arbritary commands. The "cmdPrefix" argument in serialNumber function is used by the "exec" CVE-2019-108057.5valib through 2.0.0 allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provCVE-2019-108064.3vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into addiCVE-2019-108079.8Blamer versions prior to 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of the arguments CVE-2019-108088.8utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of CVE-2019-10814.2An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker who successCVE-2019-10827.8An elevation of privilege vulnerability exists in Microsoft Windows where a certain DLL, with Local Service privilege, is vulnerable to raceCVE-2019-10837.5A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests, aka '.NET Denial of SCVE-2019-10846.5An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters.CVE-2019-108429.8Arbitrary code execution (via backdoor code) was discovered in bootstrap-sass 3.2.0.3, when downloaded from rubygems.org. An unauthenticatedCVE-2019-108449.8nbla/logger.cpp in libnnabla.a in Sony Neural Network Libraries (aka nnabla) through v1.0.14 relies on the HOME environment variable, which
CVE-2019-10802: Critical severity, CVSS 9.8 | Vulnix