Unscored severity · published Oct 20, 2000
CVE-2000-0679
The CVS 1.10.8 client trusts pathnames that are provided by the CVS server, which allows the server to force the client to create arbitrary files
–
CVSS
0.7%
EPSS
No
On KEV
Description
The CVS 1.10.8 client trusts pathnames that are provided by the CVS server, which allows the server to force the client to create arbitrary files.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CV
Cvs · Cvs
1.10.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2000-0679
CVE.org
https://www.cve.org/CVERecord?id=CVE-2000-0679
Exploit
http://www.securityfocus.com/bid/1523
Exploit
http://www.securityfocus.com/frames/?content=/templates/archive.pike%3Flist%3D1%26msg%3Dhvou2daoebb.fsf%40serein.m17n.org
More from Cvs
–
CVE-2012-0804
Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a denial of service (crash) and possibly…
–
CVE-2005-2693
cvsbug in CVS 1.12.12 and earlier creates temporary files insecurely, which allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack
–
CVE-2004-1342
CVS 1.12 and earlier on Debian GNU/Linux, when using the repouid patch, allows remote attackers to bypass authentication via the pserver access method
–
CVE-2005-0753
Buffer overflow in CVS before 1.11.20 allows remote attackers to execute arbitrary code
–
CVE-2004-1343
CVS 1.12 and earlier on Debian GNU/Linux does not properly handle when a mapping for the current repository does not exist in the cvs-repouids file, which allows remote attackers…