{"vulnerability": "cve-2024-5200", "sightings": [{"uuid": "31bde226-f13c-4b53-aa99-eb19e30506dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-52008", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113550775070386580", "content": "", "creation_timestamp": "2024-11-26T18:55:27.609866Z"}, {"uuid": "122dad5c-e257-4cab-b728-43d0d2569bcf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-52006", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lfpxmla5dn2f", "content": "", "creation_timestamp": "2025-01-14T19:16:16.073807Z"}, {"uuid": "557df44c-b3ac-40c1-aa2a-a8b3bb93fd31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-52005", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lfsepahueh2n", "content": "", "creation_timestamp": "2025-01-15T18:15:43.803262Z"}, {"uuid": "0c3b43fa-6920-41c4-9f4e-cdf9577304bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-52006", "type": "seen", "source": "https://github.blog/open-source/git/git-security-vulnerabilities-announced-5/", "content": "", "creation_timestamp": "2025-01-14T17:04:36.000000Z"}, {"uuid": "3b0ae757-891f-4e4c-b336-118de49b4d84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-52005", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/113833796685369395", "content": "", "creation_timestamp": "2025-01-15T18:31:32.530597Z"}, {"uuid": "da2b9c0f-663e-4408-b100-318457aee66f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-52006", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lfpzwkv32g2r", "content": "", "creation_timestamp": "2025-01-14T19:57:38.815490Z"}, {"uuid": "dbdfe011-13d9-46c1-b6db-f435cfa2ffed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-52006", "type": "seen", "source": "https://bsky.app/profile/veit-schiele.de/post/3lfsb2aivbk2c", "content": "", "creation_timestamp": "2025-01-15T17:10:21.382610Z"}, {"uuid": "f122dba5-6dc7-4fda-884d-4917e93b1b0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-52006", "type": "seen", "source": "https://bsky.app/profile/elhackernet.extwitter.link/post/3lfwlcbf5fs26", "content": "", "creation_timestamp": "2025-01-17T10:24:23.442565Z"}, {"uuid": "ded7a502-be4b-4ba8-a8d1-dfeeb0e11203", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2024-52005", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "b4b42f75-78a2-45b8-879a-8454bd205cc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-52005", "type": "published-proof-of-concept", "source": "Telegram/Rk3Pm0xazzAxLfp-nWuprn3TjhkjdHjxxzptFTkeMZjK45M", "content": "", "creation_timestamp": "2025-12-29T09:00:05.000000Z"}, {"uuid": "6d0692e4-004a-4265-9601-451dc59bb72a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-52002", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/9576", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aRCE\n\u63cf\u8ff0\uff1aThis repository contains exploits for iTOP CVE-2024-52002, 52000, 31998, 31448 that involve CSRF+XSS chaining to get RCE\nURL\uff1ahttps://github.com/Harshit-Mashru/iTop-CVEs-exploit\n\n\u6807\u7b7e\uff1a#RCE", "creation_timestamp": "2024-12-23T20:02:12.000000Z"}, {"uuid": "bdd4a52e-dbed-4bc1-8d5f-17ecfb4df4bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-52006", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/1581", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-52006\n\ud83d\udd39 Description: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.1, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.\n\ud83d\udccf Published: 2025-01-14T18:39:52.748Z\n\ud83d\udccf Modified: 2025-01-14T18:52:11.014Z\n\ud83d\udd17 References:\n1. https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp\n2. https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g\n3. https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q\n4. https://github.com/git/git/commit/b01b9b81d36759cdcd07305e78765199e1bc2060", "creation_timestamp": "2025-01-14T19:10:45.000000Z"}, {"uuid": "6062204e-9d56-4380-a6f3-5cd8fb9fe47a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-52005", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/1810", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-52005\n\ud83d\udd39 Description: Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called \"sideband channel\". These messages will be prefixed with \"remote:\" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information, or to mislead the user into executing untrusted scripts. As requested on the git-security mailing list, the patches are under discussion on the public mailing list. Users are advised to update as soon as possible. Users unable to upgrade should avoid recursive clones unless they are from trusted sources.\n\ud83d\udccf Published: 2025-01-15T17:35:02.379Z\n\ud83d\udccf Modified: 2025-01-15T17:35:02.379Z\n\ud83d\udd17 References:\n1. https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329\n2. https://lore.kernel.org/git/1M9FnZ-1taoNo1wwh-00ESSd@mail.gmx.net", "creation_timestamp": "2025-01-15T17:54:46.000000Z"}, {"uuid": "de194420-7db1-4422-9612-aa6b94b87a94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-52006", "type": "seen", "source": "https://t.me/cvedetector/15346", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-52006 - Git Carriage Return Newline Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-52006 \nPublished : Jan. 14, 2025, 7:15 p.m. | 26\u00a0minutes ago \nDescription : Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.1, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"14 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-14T20:42:24.000000Z"}, {"uuid": "3776df02-1096-4e72-8377-bbfce86dbf2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-52005", "type": "seen", "source": "https://t.me/cvedetector/15507", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-52005 - Git ANSI Escape Sequence Injection Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-52005 \nPublished : Jan. 15, 2025, 6:15 p.m. | 42\u00a0minutes ago \nDescription : Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called \"sideband channel\". These messages will be prefixed with \"remote:\" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information, or to mislead the user into executing untrusted scripts. As requested on the git-security mailing list, the patches are under discussion on the public mailing list. Users are advised to update as soon as possible. Users unable to upgrade should avoid recursive clones unless they are from trusted sources. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"15 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-15T20:09:09.000000Z"}, {"uuid": "841f950a-bb77-4f03-a3a5-874aebe7f589", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-52002", "type": "seen", "source": "https://t.me/cvedetector/10245", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-52002 - Combodo iTop CSRF Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-52002 \nPublished : Nov. 8, 2024, 11:15 p.m. | 19\u00a0minutes ago \nDescription : Combodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to a Cross-Site Request Forgery (CSRF) vulnerability. Please refer to the linked GHSA for the complete list. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. \nSeverity: 7.6 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"09 Nov 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-11-09T00:44:27.000000Z"}, {"uuid": "6931d077-a21b-444c-adb5-d7ac2809ee95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-52004", "type": "seen", "source": "https://t.me/cvedetector/10246", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-52004 - MediaCMS ReDoS Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-52004 \nPublished : Nov. 8, 2024, 11:15 p.m. | 19\u00a0minutes ago \nDescription : MediaCMS is an open source video and media CMS, written in Python/Django and React, featuring a REST API. MediaCMS has been prone to vulnerabilities that upon special cases can lead to remote code execution. All versions before v4.1.0 are susceptible, and users are highly recommended to upgrade.\u00a0The vulnerabilities are related with insufficient input validation while uploading media content. The condition to exploit the vulnerability is that the portal allows users to upload content. This issue has been patched in version 4.1.0. There are no known workarounds for this vulnerability. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"09 Nov 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-11-09T00:44:27.000000Z"}, {"uuid": "010039e2-5821-4199-9a27-ef74e8ace53e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-52000", "type": "seen", "source": "https://t.me/cvedetector/10249", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-52000 - ITop Cross-Site Scripting (XSS) Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-52000 \nPublished : Nov. 8, 2024, 11:15 p.m. | 19\u00a0minutes ago \nDescription : Combodo iTop is a simple, web based IT Service Management tool. Affected versions are subject to a reflected Cross-site Scripting (XSS) exploit by way of editing a request's payload which can lead to malicious javascript execution. This issue has been addressed in version 3.2.0 via systematic escaping of error messages when rendering on the page. All users are advised to upgrade. There are no known workarounds for this vulnerability. \nSeverity: 8.1 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"09 Nov 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-11-09T00:44:32.000000Z"}, {"uuid": "63783535-88f1-40d3-9f08-a711fd020793", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-52001", "type": "seen", "source": "https://t.me/cvedetector/10244", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-52001 - Combodo iTop Unauthenticated Service Information Disclosure\", \n  \"Content\": \"CVE ID : CVE-2024-52001 \nPublished : Nov. 8, 2024, 11:15 p.m. | 19\u00a0minutes ago \nDescription : Combodo iTop is a simple, web based IT Service Management tool. In affected versions portal users are able to access forbidden services information. This issue has been addressed in version 3.2.0. All users are advised to upgrade. There are no known workarounds for this vulnerability. \nSeverity: 4.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"09 Nov 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-11-09T00:44:26.000000Z"}, {"uuid": "4446417b-38a1-4f3c-99ea-0b231fc50069", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-52007", "type": "seen", "source": "https://t.me/cvedetector/10243", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-52007 - HAPI FHIR XML External Entity Injection Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-52007 \nPublished : Nov. 8, 2024, 11:15 p.m. | 19\u00a0minutes ago \nDescription : HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag (  ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This is related to GHSA-6cr6-ph3p-f5rf, in which its fix (#1571 & #1717) was incomplete. This issue has been addressed in release version 6.4.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. \nSeverity: 8.6 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"09 Nov 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-11-09T00:44:25.000000Z"}, {"uuid": "54ef58bc-f66f-4ec8-af0b-49c2be5d4420", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-52009", "type": "seen", "source": "https://t.me/cvedetector/10242", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-52009 - GitHub Atlantis GitHub Credential Exposure\", \n  \"Content\": \"CVE ID : CVE-2024-52009 \nPublished : Nov. 8, 2024, 11:15 p.m. | 19\u00a0minutes ago \nDescription : Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials (tokens `ghs_...`) when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on GitHub. When Atlantis is used to administer a GitHub organization, this enables getting administration privileges on the organization. This was reported in #4060 and fixed in #4667 . The fix was included in Atlantis v0.30.0. All users are advised to upgrade. There are no known workarounds for this vulnerability. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"09 Nov 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-11-09T00:44:25.000000Z"}, {"uuid": "e8d40ac4-bc36-42f3-9758-83bf469f1a80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2024-52002", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mptuexvdd62v", "content": "", "creation_timestamp": "2026-07-04T20:07:07.126860Z"}]}