Known vulnerabilities in cgit

Vendor: Jason A. Donenfeld
Software: cgit
Software CPE: cpe:2.3:a:jason_a_donenfeld:cgit:*:*:*:*:*:*:*:*
Website: https://github.com/zx2c4
Total vulnerabilities: 9
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting cgit cgit is affected by 9 known vulnerabilities: 2 high, 2 medium, 5 low Critical High Medium Low

Vulnerabilities (9)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU14196 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2018-14912		 CWE-22 High
Available
No
 1.2.1 03.08.2018 SB2018080609
SB2018080610
SB2018080611
and 3 more
#VU32343 - Memory corruption
CVE-2016-1901		 CWE-119 High
No
No
 0.12 20.01.2016 SB2016012006
SB2016021104
SB2016011602
and 3 more
#VU32342 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2016-1900		 CWE-79 Low
No
No
 0.12 20.01.2016 SB2016012005
SB2016021103
SB2016011602
and 3 more
#VU32341 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2016-1899		 CWE-79 Low
No
No
 0.12 20.01.2016 SB2016012004
SB2016021102
SB2016011602
and 3 more
#VU32667 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2013-2117		 CWE-22 Medium
No
No
 0.9.2 09.08.2013 SB2013080901
SB2013052801
SB2013052803
and 1 more
#VU43344 - Improper input validation
CVE-2012-4548		 CWE-20 Low
No
No
 - 11.11.2012 SB2012101004
SB2012111502
SB2012111503
and 1 more
#VU43403 - Heap-based Buffer Overflow
CVE-2012-4465		 CWE-122 Low
No
No
 - 10.10.2012 SB2012101004
#VU44852 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2011-2711		 CWE-79 Low
No
No
 - 03.08.2011 SB2011080305
SB2011072202
SB2011072203
#VU45181 - Improper input validation
CVE-2011-1027		 CWE-20 Medium
No
No
 - 20.03.2011 SB2011032002
SB2011030601
SB2011030602