EUVD-2008-1298

Malware in sbrugna...

SUSE CVE-2004-0915

Multiple unknown vulnerabilities in viewcvs before 0.9.2, when exporting a repository as a tar archive, does not properly implement the hidecvsroot and forbidden settings, which could allow remote attackers to gain sensitive information...

SUSE CVE-2008-1291

ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder...

CVE-2008-1291

ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder...

SuSE 10 Security Update : Subversion (ZYPP Patch Number 5362)

This update of subversion fixes multiple vulnerabilities. - list CVS or SVN commits on 'all-forbidden' files. CVE-2008-1290 - directly access hidden CVSROOT folders. CVE-2008-1291 - expose restricted content via the revision view, the log history, or the diff view. CVE-2008-1292 %NASLMINLEVEL 703...

CVE-2008-1291

ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder...

CVE-2008-1291

Removed by vendor...

Fedora 7 : viewvc-1.0.5-1.fc7 (2008-2143)

These security issues have been fixed: - omit commits of all-forbidden files from query results - disallow direct URL navigation to hidden CVSROOT folder - strip forbidden paths from revision view - don't traverse log history thru forbidden locations - honor forbiddenness via diff view path...

CVSTrac CVSROOT/passwd arbitrary account deletion

The remote host seems to be running cvstrac, a web-based bug and patch-set tracking system for CVS. This version of CVSTRAC is vulnerable to a flaw wherein a remote attacker can overwrite a critical file, thereby giving them elevated access and potentially control over other user accounts...

CVE-2004-1471

Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service application crash and possibly execute arbitrary code via format string specifiers in a wrapper line...

CVS pserver CVSROOT Passwd File Arbitrary Code Execution

Binary data 1181.prm...

CVS PServer CVSROOT Passwd File Arbitrary Code Execution

According to its version number, the remote CVS server has an arbitrary code execution vulnerability. Any user with the ability to write the CVSROOT/passwd file could execute arbitrary code as root. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid11970; scriptversion...