PT-2020-14634

Name of the Vulnerable Software and Affected Versions Polarion Subversion Webclient All versions Description A Cross-Site Request Forgery CSRF attack is possible through the web interface if a user is tricked into accessing a malicious link. The attack requires user interaction by an authenticate...

Siemens Polarion Subversion Webclient

1. EXECUTIVE SUMMARY CVSS v3 8.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: Polarion Subversion Webclient Vulnerabilities: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS, Cross-site Request Forgery CSRF 2. RISK EVALUATION...

USVN Arbitrary Code Execution Vulnerability

USVN is a web interface written in PHP for configuring Subversion repositories. An arbitrary code execution vulnerability exists in USVN versions prior to 1.0.10. An attacker can exploit this vulnerability to execute arbitrary code in the commit view...

USVN Cross-Site Request Forgery Vulnerability

USVN is a web interface written in PHP for configuring Subversion repositories. A cross-site request forgery vulnerability exists in versions prior to USVN 1.0.10. The vulnerability stems from the lack of SameSite Strict functionality. No detailed vulnerability details are provided at this time...

PT-2020-6583

Name of the Vulnerable Software and Affected Versions Subversion mod dav svn+mod authz svn versions prior to 1.10.7 Subversion mod dav svn+mod authz svn versions prior to 1.14.1 Description The mod authz svn module in Subversion will crash if the server is using in-repository authz rules with the...

jenkins-subversion-plugin: XSS in project repository base url

Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored cross-site scripting vulnerability...

Cross-site Scripting (XSS)

jenkins-subversion-plugin is vulnerable to cross-site scripting XSS. The vulnerability exists as it does not escape the error message for the Project Repository Base URL field form validation...

jenkins-subversion-plugin: XSS in project repository base url

Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored cross-site scripting vulnerability...

Revisiting old tools

Many, many years ago I was onsite and noticed that a company's internal website had checked out their website using the subversion code versioning system. This subversion archive contained the site's web.config which has a set of credentials for SQL server, which through many steps led to domain...

CloudBees Jenkins Subversion Partial Release Manager Plugin Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Subversion Partial Release Manager Plugin is...

CVE-2020-2199

Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation, resulting in a reflected cross-site scripting vulnerability...

CVE-2020-2199

Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation, resulting in a reflected cross-site scripting vulnerability...

Cross site scripting

Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation, resulting in a reflected cross-site scripting vulnerability...

CVE-2020-2199

The CVE-2020-2199 entry describes a reflected Cross-Site Scripting (XSS) vulnerability in the Jenkins Subversion Partial Release Manager Plugin (versions 1.0.1 and earlier). The issue arises because the error message for the repository URL field form validation is not properly escaped, enabling i...

CVE-2020-2199

Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation, resulting in a reflected cross-site scripting vulnerability...

CVE-2020-2199

Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation, resulting in a reflected cross-site scripting vulnerability...

CVE-2020-2199: Improper Neutralization of Input During Web Page Generation

Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation, resulting in a reflected cross-site scripting vulnerability...

PT-2020-15413 · Jenkins · Jenkins Subversion Partial Release Manager Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Subversion Partial Release Manager Plugin versions 1.0.1 and earlier Description: The issue is related to a reflected cross-site scripting vulnerability. It occurs because the error message for the repository URL field form validation...

Lexiglot Code Issue Vulnerability

Lexiglot is a translation platform written in PHP by the French software developer Damien Sorel. A code issue vulnerability exists in Lexiglot 2014-11-20 and earlier versions. An attacker can exploit the vulnerability with the help of the 'svnurl' parameter to cause the server to send a forged...

Going dark: encryption and law enforcement

UPDATE, 05/22/2020: In the advent of the EARN IT Act, the debate on government subversion of encryption has reignited. Given that the material conditions of the technology have not changed, and the arguments given in favor of the bill are not novel, we've decided to republish the following blog...