Fossil 2.18 on Windows allows attackers to cause a denial of service (daemon crash) via an XSS payload in a ticket. This occurs because the ticket data is stored in a temporary file, and the product does not properly handle the absence of this file after Windows Defender has flagged it as...
5.5CVSS
5.2AI Score
0.001EPSS
Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate...
7.5CVSS
7.4AI Score
0.001EPSS
Fossil before 2.10.2, 2.11.x before 2.11.2, and 2.12.x before 2.12.1 allows remote authenticated users to execute arbitrary code. An attacker must have check-in privileges on the...
8.8CVSS
8.6AI Score
0.011EPSS
http_transport.c in Fossil before 2.4, when the SSH sync protocol is used, allows user-assisted remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-14176,...
8.8CVSS
9.2AI Score
0.552EPSS