CVE-2018-13385

There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system. Versions of Sourcetree...

CVE-2013-4246

libsvnfsfs/fsfs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated users with commit access to corrupt FSFS repositories and cause a denial of service or obtain sensitive information by editing packed revision properties...

Scientific Linux Security Update : subversion on SL5.x, SL6.x i386/x86_64 (20140305)

A flaw was found in the way the moddavsvn module handled OPTIONS requests. A remote attacker with read access to an SVN repository served via HTTP could use this flaw to cause the httpd process that handled such a request to crash. CVE-2014-0032 A flaw was found in the way Subversion handled file...

MGASA-2013-0244 Updated subversion packages fixes security vulnerability

Subversion's moddavsvn Apache HTTPD server module will trigger an assertion on some requests made against a revision root. This can lead to a DoS. If assertions are disabled it will trigger a read overflow which may cause a SEGFAULT or equivalent or undefined behavior. Commit access is required t...

subversion -- remotely triggerable "Assertion failed" DoS vulnerability or read overflow.

Subversion Project reports: Subversion's moddavsvn Apache HTTPD server module will trigger an assertion on some requests made against a revision root. This can lead to a DoS. If assertions are disabled it will trigger a read overflow which may cause a SEGFAULT or equivalent or undefined behavior...

Cross site scripting

Cross-site scripting XSS vulnerability in the "extra" details in the DiffSource.getrow function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via the "function name" lin...

CVE-2012-4533

Cross-site scripting XSS vulnerability in the "extra" details in the DiffSource.getrow function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via the "function name" lin...

PT-2011-1048 · Viewvc · Viewvc

Name of the Vulnerable Software and Affected Versions: ViewVC versions 1.0.x through 1.0.12 ViewVC versions 1.1.x through 1.1.15 Description: The issue allows remote authenticated users with repository commit access to inject arbitrary web script or HTML. This can be achieved via the function nam...

SVN < 1.5.6 / 1.6.0-1.6.3 Multiple Integer Overflows (deprecated)

Binary data 5140.prm...

GLSA-200908-05 : Subversion: Remote execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-200908-05 Subversion: Remote execution of arbitrary code Matt Lewis of Google reported multiple integer overflows in the libsvndelta library, possibly leading to heap-based buffer overflows. Impact : A remote attacker with commit...

Subversion: Remote execution of arbitrary code

Background Subversion is a versioning system designed to be a replacement for CVS. Description Matt Lewis of Google reported multiple integer overflows in the libsvndelta library, possibly leading to heap-based buffer overflows. Impact A remote attacker with commit access could exploit this...

Subversion libsvn_delta库整数溢出漏洞

BUGTRAQ ID: 35983 CVECAN ID: CVE-2009-2411 Subversion是一款开放源码的多用户版本控制系统，支持非ASCII 文本和二进制数据。 Subversion的libsvndelta库没有充分地验证svndiff流，处理带有超大窗口的流可能触发最终可导致堆溢出的整数溢出漏洞。拥有对代码库commit访问权限的攻击者可以利用这个漏洞在Subversion Server服务器上执行任意代码。 Subversion Subversion 1.5.7 Subversion Subversion 1.6.0 - 1.6.3 厂商补丁： Subversion...

ikiwiki -- improper symlink verification vulnerability

The ikiwiki development team reports: Ikiwiki did not check if path to the srcdir to contained a symlink. If an attacker had commit access to the directories in the path, they could change it to a symlink, causing ikiwiki to read and publish files that were not intended to be published. But not...

CVE-2004-1471

Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service application crash and possibly execute arbitrary code via format string specifiers in a wrapper line...