Show filters
19 Total Results
Displaying 11-19 of 19
Sort by:
Attacker Value
Unknown
CVE-2017-1000116
Disclosure Date: October 05, 2017 (last updated November 26, 2024)
Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.
0
Attacker Value
Unknown
CVE-2017-9462
Disclosure Date: June 06, 2017 (last updated November 26, 2024)
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.
0
Attacker Value
Unknown
CVE-2016-3105
Disclosure Date: May 09, 2016 (last updated November 25, 2024)
The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.
0
Attacker Value
Unknown
CVE-2016-3068
Disclosure Date: April 13, 2016 (last updated November 25, 2024)
Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.
0
Attacker Value
Unknown
CVE-2016-3630
Disclosure Date: April 13, 2016 (last updated November 25, 2024)
The binary delta decoder in Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a (1) clone, (2) push, or (3) pull command, related to (a) a list sizing rounding error and (b) short records.
0
Attacker Value
Unknown
CVE-2016-3069
Disclosure Date: April 13, 2016 (last updated November 25, 2024)
Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.
0
Attacker Value
Unknown
CVE-2014-9462
Disclosure Date: March 31, 2015 (last updated October 05, 2023)
The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command.
0
Attacker Value
Unknown
CVE-2008-4297
Disclosure Date: September 27, 2008 (last updated October 04, 2023)
Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to read arbitrary files from a repository via an "hg pull" request.
0
Attacker Value
Unknown
CVE-2008-2942
Disclosure Date: June 30, 2008 (last updated October 04, 2023)
Directory traversal vulnerability in patch.py in Mercurial 1.0.1 allows user-assisted attackers to modify arbitrary files via ".." (dot dot) sequences in a patch file.
0
