Vulnerabilities

TI-2024-25625 CVE-2024-38368

Trunk's 'Claim your pod' could be used to obtain un-used pods

MEDIUM 62

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.14851 Published 2024-07-01 Fixed in 71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4 CWE-668

TI-2024-25624 CVE-2024-38367

HIGH 74

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.11131 Published 2024-07-01 No fix listed CWE-488

TI-2024-25623 CVE-2024-38366

HIGH 76

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.17786 Published 2024-07-01 Fixed in 001cc3a430e75a16307f5fd6cdff1363ad2f40f3 CWE-74

TI-2022-05616 CVE-2022-21223 · GHSA-g397-v4w5-4m79

MEDIUM 45

The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01687 Published 2022-04-01 Fixed in 1.6.2 CWE-88

TI-2022-08312 CVE-2022-24440 · GHSA-7627-mp87-jf6q

MEDIUM 47

The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0262 Published 2022-04-01 Fixed in 1.6.0, 1.6.3 CWE-88