CVE-2020-24614

Fossil vulnerability CVE-2020-24614 affects Fossil releases before 2.12.1 (and older branches: 2.10.2; 2.11.x before 2.11.2). Remote code execution is possible for authenticated users with repository check-in privileges. Open advisories confirm the fix in Fossil 2.12.1. Remediation: upgrade to Fo...

CVE-2021-36377

CVE-2021-36377 affects Fossil prior to 2.14.2 and 2.15.x before 2.15.2, where TLS hostname verification can be bypassed due to hostname checks being skipped during certificate validation. Impact: potential MITM spoofing of Fossil repositories and information disclosure. Remediation: upgrade Fossi...

CVE-2022-34009

CVE-2022-34009 affects Fossil 2.18 on Windows. The vulnerability arises from ticket data being stored in a temporary file and the software not properly handling the absence of that file after Windows Defender flags it as malware, enabling a denial-of-service via an XSS payload in a ticket that cr...