CVE-2020-5283

CVE-2020-5283 - ViewVC XSS in show_subdir_lastmod is confirmed by connected sources: vulnerable before 1.1.28 and 1.2.1 due to unsafe handling of file names in CVS show_subdir_lastmod. Exploitation requires a user with CVS commit privileges on a trusted ViewVC instance with show_subdir_lastmod en...

CVE-2020-5283

ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS showsubdirlastmod support. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a CVS repository exposed by an otherwise trusted ViewVC instance that also has the...

CVE-2020-5283 XSS vulnerability in CVS show_subdir_lastmod support

ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS showsubdirlastmod support. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a CVS repository exposed by an otherwise trusted ViewVC instance that also has the...

CVE-2020-5283

Removed by vendor...

PT-2020-18373

Name of the Vulnerable Software and Affected Versions ViewVC versions prior to 1.1.28 ViewVC versions prior to 1.2.1 Description The issue is related to a XSS vulnerability in CVS show subdir lastmod support. The impact of this vulnerability is mitigated by the need for an attacker to have commit...

ViewVC Cross-Site Scripting Vulnerability (CNVD-2020-33722)

ViewVC is a Web-based CVS, SVN code repository browsing tool . A cross-site scripting vulnerability exists in ViewVC versions prior to 1.1.28 and 1.2.1. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerability...

CVE-2020-5283: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS showsubdirlastmod support. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a CVS repository exposed by an otherwise trusted ViewVC instance that also has the...

CVE-2007-5743

viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option...

Improper access control

viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option...

CVE-2007-5743

viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option...

CVE-2007-5743

viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option...

CVE-2007-5743

CVE-2007-5743 affects viewvc 1.0.3 and allows improper access control to files in a repository when using the "forbidden" configuration option. NVD lists CVSS‑2 base 4.3 (Network, Medium) and CVSS‑3.1 base 7.5 (Network, Low‑Impact? actually C:H I:N A:N) with confidentiality impact High; other imp...

CVE-2007-5743

Removed by vendor...

CVE-2007-5743: Incorrect Permission Assignment for Critical Resource

viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option...

PT-2019-6492

Name of the Vulnerable Software and Affected Versions viewvc version 1.0.3 Description The issue allows improper access control to files in a repository when using the forbidden configuration option. Recommendations For viewvc version 1.0.3, consider restricting access to the repository or...

CVE-2008-1292

ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtain sensitive information by reading 1 forbidden pathnames in the revision view, 2 log history that can only be reached by traversing a forbidden object, or 3...

CVE-2008-1291

ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder...

CVE-2008-1290

ViewVC before 1.0.5 includes "all-forbidden" files within search results that list CVS or Subversion SVN commits, which allows remote attackers to obtain sensitive information...

Debian: Security Advisory (DLA-820-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross site scripting

Cross-site scripting XSS vulnerability in the navpath function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web script or HTML via the navdata name...