SU
Product
Subversion
47
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 8Medium 6Low 0
Watch
Add Subversion to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-9800 | 9.8 | Aug 11 | A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command Affected: through 1.8.18; 1.9.0; 1.9.1; 1.9.2; 1.9.3; 1.9.4; +6 more |
| CVE-2013-4246 | 8.8 | Oct 30 | libsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated users with commit access to corrupt FSFS repositories and cause a denial of service… Affected: 1.8.0; 1.8.0; 1.8.0; 1.8.0; 1.8.1 |
| CVE-2015-5259 | 8.6 | Jan 8 | Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn://… Affected: 1.9.0; 1.9.1; 1.9.2 |
| CVE-2024-45720 | 7.8 | Oct 9 | On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables (e.g., svn.exe, etc.) may lead to unexpected command line… Affected: before 1.14.4 |
| CVE-2015-5343 | 7.6 | Apr 14 | Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service… Affected: 1.7.0 through 1.7.20; 1.8.0 before 1.8.15; 1.9.0 before 1.9.3 |
| CVE-2022-24070 | 7.5 | Apr 12 | Subversion's mod_dav_svn is vulnerable to memory corruption Affected: 1.10.0 before 1.10.8; 1.14.0 before 1.14.2 |
| CVE-2020-17525 | 7.5 | Mar 17 | Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client sends a request for a… Affected: 1.9.0 before 1.10.7; 1.11.0 before 1.14.1 |
| CVE-2019-0203 | 7.5 | Sep 26 | In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands Affected: through 1.9.10; 1.10.0 through 1.10.4; 1.11.0 through 1.11.1; 1.12.0 |
| CVE-2018-11803 | 7.5 | Feb 5 | Subversion's mod_dav_svn Apache HTTPD module versions 1.11.0 and 1.10.0 to 1.10.3 will crash after dereferencing an uninitialized pointer if the client omits the root path in a… Affected: 1.10.0 through 1.10.3; 1.11.0 |
| CVE-2016-2167 | 6.8 | May 5 | The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authentication is used, allows remote… Affected: through 1.8.15; 1.9.0; 1.9.1; 1.9.2; 1.9.3 |
| CVE-2018-11782 | 6.5 | Sep 26 | In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only request produces a particular… Affected: through 1.9.10; 1.10.0 through 1.10.4; 1.11.0 through 1.11.1; 1.12.0 |
| CVE-2016-8734 | 6.5 | Oct 16 | Apache Subversion's mod_dontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential XML… Affected: 1.4.0; 1.4.1; 1.4.2; 1.4.3; 1.4.4; 1.4.5; +34 more |
| CVE-2016-2168 | 6.5 | May 5 | The req_check_access function in the mod_authz_svn module in the httpd server in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4 allows remote authenticated users to cause… Affected: through 1.8.15; 1.9.0; 1.9.1; 1.9.2; 1.9.3 |
| CVE-2024-46901 | 4.3 | Dec 9 | Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit access to commit a… Affected: before 1.14.5 |
| CVE-2021-28544 | 4.3 | Apr 12 | Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization… Affected: 1.10.0 through 1.14.1 |
| CVE-2015-3187 | – | Aug 12 | The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to… Affected: through 1.7.20; 1.8.1; 1.8.2; 1.8.3; 1.8.4; 1.8.5; +7 more |
| CVE-2015-3184 | – | Aug 12 | mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote… Affected: 1.7.0; 1.7.1; 1.7.2; 1.7.3; 1.7.4; 1.7.5; +28 more |
| CVE-2015-0251 | – | Apr 8 | The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP… Affected: 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +34 more |
| CVE-2015-0248 | – | Apr 8 | The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and… Affected: 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; 1.6.5; +34 more |
| CVE-2015-0202 | – | Apr 8 | The mod_dav_svn server in Subversion 1.8.0 through 1.8.11 allows remote attackers to cause a denial of service (memory consumption) via a large number of REPORT requests, which… Affected: 1.8.0; 1.8.1; 1.8.2; 1.8.3; 1.8.4; 1.8.5; +6 more |
| CVE-2014-8108 | – | Dec 18 | The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer… Affected: 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +34 more |
| CVE-2014-3580 | – | Dec 18 | The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer… Affected: 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +34 more |
| CVE-2014-3528 | – | Aug 19 | Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier… Affected: 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +34 more |
| CVE-2014-3522 | – | Aug 19 | The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or subjectAltName field… Affected: 1.4.0; 1.4.1; 1.4.2; 1.4.3; 1.4.4; 1.4.5; +34 more |
| CVE-2014-3504 | – | Aug 19 | The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte… Affected: 1.4.0; 1.4.1; 1.4.2; 1.4.3; 1.4.4; 1.4.5; +34 more |
| CVE-2013-7393 | – | Jul 28 | The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges via a symlink attack on the pid file created for (1) svnwcsub.py or (2)… Affected: 1.8.0; 1.8.1 |
| CVE-2013-4262 | – | Jul 28 | svnwcsub.py in Subversion 1.8.0 before 1.8.3, when using the --pidfile option and running in foreground mode, allows local users to gain privileges via a symlink attack on the pid… Affected: 1.8.0; 1.8.1; 1.8.2 |
| CVE-2014-0032 | – | Feb 14 | The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote… Affected: 1.8.0; 1.8.1; 1.8.2; 1.8.3; 1.8.4; 1.8.5; +15 more |
| CVE-2013-4558 | – | Dec 7 | The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions… Affected: 1.7.11; 1.7.12; 1.7.13; 1.8.1; 1.8.2; 1.8.3; +1 more |
| CVE-2013-4505 | – | Dec 7 | The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and… Affected: 1.4.0; 1.4.1; 1.4.2; 1.4.3; 1.4.4; 1.4.5; +34 more |
| CVE-2013-4277 | – | Sep 16 | Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite arbitrary files or kill arbitrary processes via a symlink attack on the… Affected: 1.4.0; 1.4.1; 1.4.2; 1.4.3; 1.4.4; 1.4.5; +34 more |
| CVE-2013-4131 | – | Jul 31 | The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.10 and 1.8.x before 1.8.1 allows remote authenticated users to cause a denial of service (assertion… Affected: 1.7.0; 1.7.1; 1.7.2; 1.7.3; 1.7.4; 1.7.5; +6 more |
| CVE-2013-2112 | – | Jul 31 | The svnserve server in Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote attackers to cause a denial of service (exit) by aborting a connection Affected: through 1.6.21; 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; +26 more |
| CVE-2013-2088 | – | Jul 31 | contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands via shell… Affected: through 1.6.21; 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; +16 more |
| CVE-2013-1968 | – | Jul 31 | Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote authenticated users to cause a denial of service (FSFS repository corruption) via a newline character in a file name Affected: through 1.6.21; 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; +26 more |
| CVE-2013-1884 | – | May 2 | The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentation fault and crash) via a log REPORT… Affected: 1.7.0; 1.7.1; 1.7.2; 1.7.3; 1.7.4; 1.7.5; +2 more |
| CVE-2013-1849 | – | May 2 | The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer… Affected: 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; 1.6.5; +24 more |
| CVE-2013-1847 | – | May 2 | The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer… Affected: 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; 1.6.5; +24 more |
| CVE-2013-1846 | – | May 2 | The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (NULL pointer… Affected: through 1.6.20; 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; +23 more |
| CVE-2013-1845 | – | May 2 | The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory… Affected: 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; 1.6.5; +24 more |
| CVE-2011-1921 | – | Jun 6 | The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is disabled, does… Affected: 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +20 more |
| CVE-2011-1783 | – | Jun 6 | The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is enabled, allows… Affected: 1.5.0 through 1.5.8; 1.6.0 before 1.6.17 |
| CVE-2011-1752 | – | Jun 6 | The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.17, allows remote attackers to cause a denial of service (NULL pointer… Affected: before 1.6.17 |
| CVE-2011-0715 | – | Mar 11 | The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.16, allows remote attackers to cause a denial of service (NULL pointer… Affected: through 1.6.15; 0.6; 0.7; 0.8; 0.9; 0.10.0; +34 more |
| CVE-2010-4539 | – | Jan 7 | The walk function in repos.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.15, allows remote authenticated users to cause a… Affected: through 1.6.14; 0.6; 0.7; 0.8; 0.9; 0.10.0; +34 more |
| CVE-2010-4644 | – | Jan 7 | Multiple memory leaks in rev_hunt.c in Apache Subversion before 1.6.15 allow remote authenticated users to cause a denial of service (memory consumption and daemon crash) via the… Affected: through 1.6.14; 0.6; 0.7; 0.8; 0.9; 0.10.0; +34 more |
| CVE-2010-3315 | – | Oct 4 | authz.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x before 1.5.8 and 1.6.x before 1.6.13, when SVNPathAuthz short_circuit is… Affected: 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; 1.6.5; +15 more |
Showing 47