12 matches found
DLA-4094-1 mercurial - security update
Bulletin has no description...
CVE-2025-2361
CVE-2025-2361 affects Mercurial SCM’s Web Interface (hgweb). A cross-site scripting vulnerability arises from improper sanitization of user-controlled input passed via the cmd parameter in the Web Interface, enabling remote exploitation. Affected is Mercurial 4.5.3/71.19.145.211 with hgweb; multi...
Linux Distros Unpatched Vulnerability : CVE-2016-3069
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository. CVE-2016-3069 Note that Nessus...
GHSA-HVR9-WR9P-GRGR Mercurial missing symlink check
Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository...
Mercurial subrepo.py Data Compromise
The vulnerability of several functions in the Mercurial version control software’s subrepo.py module is related to an incorrect definition of the reference before accessing a file. Exploiting this vulnerability could allow a remote attacker to compromise data integrity and also cause service...
CVE-2018-17983
cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry...
CVE-2018-13347
mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002...
DLA-1331-1 mercurial - security update
Bulletin has no description...
DSA-3963-1 mercurial - security update
Bulletin has no description...
SUSE-SU-2015:0836-1 Security update for mercurial
Mercurial was updated to fix a command injection via sshpeer.validaterepo CVE-2014-9462, bnc923070:...
CVE-2008-4297
Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to read arbitrary files from a repository via an "hg pull" request...