https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 11:56:12 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-46904 EUVD-2026-46904 https://cve.radiocsirt.org/vuln/euvd-2026-46904 https://cve.radiocsirt.org/vuln/fkie_cve-2020-28086 <p>pass through 1.7.3 has a possibility of using a password for an unintended resource. For exploitation to occur, the user must do a git pull, decrypt a password, and log into a remote service with the password. If an attacker controls the central Git server or one of the other members&#39; machines, and also controls one of the services already in the password store, they can rename one of the password files in the Git repository to something else: pass doesn&#39;t correctly verify that the content of a file matches the filename, so a user might be tricked into decrypting the wrong password and sending that to a service that the attacker controls. NOTE: for environments in which this threat model is of concern, signing commits can be a solution.</p> <p>pass through 1.7.3 has a possibility of using a password for an unintended resource. For exploitation to occur, the user must do a git pull, decrypt a password, and log into a remote service with the password. If an attacker controls the central Git server or one of the other members&#39; machines, and also controls one of the services already in the password store, they can rename one of the password files in the Git repository to something else: pass doesn&#39;t correctly verify that the content of a file matches the filename, so a user might be tricked into decrypting the wrong password and sending that to a service that the attacker controls. NOTE: for environments in which this threat model is of concern, signing commits can be a solution.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-28086 https://cve.radiocsirt.org/vuln/ghsa-phjf-vhjh-qv5p <p>pass through 1.7.3 has a possibility of using a password for an unintended resource. For exploitation to occur, the user must do a git pull, decrypt a password, and log into a remote service with the password. If an attacker controls the central Git server or one of the other members&#39; machines, and also controls one of the services already in the password store, they can rename one of the password files in the Git repository to something else: pass doesn&#39;t correctly verify that the content of a file matches the filename, so a user might be tricked into decrypting the wrong password and sending that to a service that the attacker controls. NOTE: for environments in which this threat model is of concern, signing commits can be a solution.</p> <p>pass through 1.7.3 has a possibility of using a password for an unintended resource. For exploitation to occur, the user must do a git pull, decrypt a password, and log into a remote service with the password. If an attacker controls the central Git server or one of the other members&#39; machines, and also controls one of the services already in the password store, they can rename one of the password files in the Git repository to something else: pass doesn&#39;t correctly verify that the content of a file matches the filename, so a user might be tricked into decrypting the wrong password and sending that to a service that the attacker controls. NOTE: for environments in which this threat model is of concern, signing commits can be a solution.</p> https://cve.radiocsirt.org/vuln/ghsa-phjf-vhjh-qv5p https://cve.radiocsirt.org/vuln/gsd-2020-28086 gsd-2020-28086 https://cve.radiocsirt.org/vuln/gsd-2020-28086 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-28086 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: password-store, Ubuntu:18.04:LTS: password-store, Ubuntu:20.04:LTS: password-store, Ubuntu:22.04:LTS: password-store, Ubuntu:24.04:LTS: password-store, Ubuntu:25.10: password-store, Ubuntu:26.10: password-store, Ubuntu:26.04:LTS: password-store</p> <p>pass through 1.7.3 has a possibility of using a password for an unintended resource. For exploitation to occur, the user must do a git pull, decrypt a password, and log into a remote service with the password. If an attacker controls the central Git server or one of the other members&#39; machines, and also controls one of the services already in the password store, they can rename one of the password files in the Git repository to something else: pass doesn&#39;t correctly verify that the content of a file matches the filename, so a user might be tricked into decrypting the wrong password and sending that to a service that the attacker controls. NOTE: for environments in which this threat model is of concern, signing commits can be a solution.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: password-store, Ubuntu:18.04:LTS: password-store, Ubuntu:20.04:LTS: password-store, Ubuntu:22.04:LTS: password-store, Ubuntu:24.04:LTS: password-store, Ubuntu:25.10: password-store, Ubuntu:26.10: password-store, Ubuntu:26.04:LTS: password-store</p> <p>pass through 1.7.3 has a possibility of using a password for an unintended resource. For exploitation to occur, the user must do a git pull, decrypt a password, and log into a remote service with the password. If an attacker controls the central Git server or one of the other members&#39; machines, and also controls one of the services already in the password store, they can rename one of the password files in the Git repository to something else: pass doesn&#39;t correctly verify that the content of a file matches the filename, so a user might be tricked into decrypting the wrong password and sending that to a service that the attacker controls. NOTE: for environments in which this threat model is of concern, signing commits can be a solution.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-28086