CocoaPods records
5 published records for vendor cocoapods.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 3
- With a fix record
- 40%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')2
- CWE-488 Exposure of Data Element to Wrong Session1
- CWE-668 Exposure of Resource to Wrong Sphere1
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
5 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
45Plan | CVE-2024-38366Proof of concept | CoacoaPods trunk RCE in email verification system rfc-822cocoapods · trunk.cocoapods.org · CWE-74 | Critical10.0 | — | 17.7% | Jul 1, 2024 |
41Plan | CVE-2024-38368No exploit | Trunk's 'Claim your pod' could be used to obtain un-used podscocoapods · trunk.cocoapods.org · CWE-668 | Critical9.3 | — | 14.8% | Jul 1, 2024 |
41Plan | CVE-2024-38367No exploit | CoacoaPods trunk sessions verification step could be manipulated for owner session hijackingcocoapods · trunk.cocoapods.org · CWE-488 | Critical9.6 | — | 11.1% | Jul 1, 2024 |
40Plan | CVE-2022-24440No exploit | The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection.cocoapods · cocoapods-downloader · CWE-88 | Critical9.8 | — | 2.6% | Apr 1, 2022 |
40Plan | CVE-2022-21223No exploit | The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection.cocoapods · cocoapods-downloader · CWE-88 | Critical9.8 | — | 1.6% | Apr 1, 2022 |
- CVE-2024-3836645Plan
CoacoaPods trunk RCE in email verification system rfc-822
CriticalCVSS 10.0Proof of conceptEPSS 17%cocoapods · trunk.cocoapods.orgJul 1, 2024
- CVE-2024-3836841Plan
Trunk's 'Claim your pod' could be used to obtain un-used pods
CriticalCVSS 9.3No exploitEPSS 14%cocoapods · trunk.cocoapods.orgJul 1, 2024
- CVE-2024-3836741Plan
CoacoaPods trunk sessions verification step could be manipulated for owner session hijacking
CriticalCVSS 9.6No exploitEPSS 11%cocoapods · trunk.cocoapods.orgJul 1, 2024
- CVE-2022-2444040Plan
The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection.
CriticalCVSS 9.8No exploitEPSS 2%cocoapods · cocoapods-downloaderApr 1, 2022
- CVE-2022-2122340Plan
The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection.
CriticalCVSS 9.8No exploitEPSS 1%cocoapods · cocoapods-downloaderApr 1, 2022