492 matches found
Exposure of Sensitive Information to an Unauthorized Actor in Ansible
A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from...
ALPINE-CVE-2020-17525
Subversion's modauthzsvn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL. This can lead to disruption for users of the service. This issue was fixed in...
[SECURITY] Fedora 33 Update: python-py-1.10.0-1.fc33
The py lib is a Python development support library featuring the following tools and modules: py.path: uniform local and svn path objects py.apipkg: explicit API control and lazy-importing py.iniconfig: easy parsing of .ini files py.code: dynamic code generation and introspection py.path: uniform...
CVE-2020-17363
USVN aka User-friendly SVN before 1.0.9 allows remote code execution via shell metacharacters in the numberstart or numberend parameter to LastHundredRequest aka lasthundredrequestAction in the Timeline module. NOTE: this may overlap CVE-2020-25069...
CVE-2020-17363
USVN aka User-friendly SVN before 1.0.9 allows remote code execution via shell metacharacters in the numberstart or numberend parameter to LastHundredRequest aka lasthundredrequestAction in the Timeline module. NOTE: this may overlap CVE-2020-25069...
CVE-2020-17363
USVN (PHP web interface for Subversion) is affected by CVE-2020-17363. All versions before 1.0.9 are vulnerable to remote code execution via shell metacharacters in number_start/number_end of LastHundredRequest (Timeline module). Red Hat and CNVD entries corroborate impact up to 1.0.9/1.0.10; exp...
RHEL 8 : subversion:1.10 (RHSA-2020:4712)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4712 advisory. Subversion SVN is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of fil...
CVE-2020-27986
SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it...
Code injection
SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it...
CVE-2020-27986
The CVE-2020-27986 entry applies to SonarQube 8.4.2.36762, where remote attackers can discover cleartext credentials (SMTP, SVN, GitLab) via the api/settings/values URI. The connected nuclei template explicitly calls this an authentication-related exposure, and related sources reiterate plaintext...
RHEL 7 : subversion (RHSA-2020:3972)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3972 advisory. Subversion SVN is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of fil...
CVE-2020-25070
USVN aka User-friendly SVN before 1.0.10 allows CSRF, related to the lack of the SameSite Strict feature...
Code injection
USVN aka User-friendly SVN before 1.0.10 allows attackers to execute arbitrary code in the commit view...
Cross site request forgery (csrf)
USVN aka User-friendly SVN before 1.0.10 allows CSRF, related to the lack of the SameSite Strict feature...
CVE-2020-25069
USVN (User-friendly SVN) prior to version 1.0.10 exposes an arbitrary code execution vulnerability in the commit view. Multiple connected sources confirm that the issue affects USVN up through 1.0.10, with the fix implemented in 1.0.10. Root cause details are not fully specified in the provided d...
CVE-2020-25070
CVE-2020-25070 affects USVN (User-friendly SVN) prior to version 1.0.10. The issue is a cross-site request forgery (CSRF) flaw caused by the absence of the SameSite Strict cookie attribute. Impact is described as CSRF risk; no exploit details are provided in the sources. Remediation: upgrade to U...
CVE-2020-25070
USVN aka User-friendly SVN before 1.0.10 allows CSRF, related to the lack of the SameSite Strict feature...
CVE-2020-17364
USVN aka User-friendly SVN before 1.0.9 allows XSS via SVN logs...