VI
Product
Viewvc
21
CVEs
0
On KEV
7.5
Max CVSS
0
New 30D
Severity mix
Critical 0High 2Medium 3Low 1
Watch
Add Viewvc to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-54141 | 7.5 | Jul 22 | ViewVC is a browser interface for CVS and Subversion version control repositories Affected: 1.1.0 before 1.1.31; 1.2.0 before 1.2.4 |
| CVE-2007-5743 | 7.5 | Nov 7 | viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option Affected: 1.0.3 |
| CVE-2023-22456 | 6.1 | Jan 3 | ViewVC, a browser interface for CVS and Subversion version control repositories, as a cross-site scripting vulnerability that affects versions prior to 1.2.2 and 1.1.29 Affected: before 1.1.29; 1.2.0 before 1.2.2 |
| CVE-2017-5938 | 6.1 | Mar 15 | Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web… Affected: through 1.1.25 |
| CVE-2023-22464 | 5.4 | Jan 4 | ViewVC is a browser interface for CVS and Subversion version control repositories Affected: before 1.1.30; 1.2.0 before 1.2.3 |
| CVE-2020-5283 | 3.5 | Apr 3 | ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support Affected: before 1.1.28; 1.2.0 before 1.2.1 |
| CVE-2012-4533 | – | Nov 19 | Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows… Affected: 1.0.0 before 1.0.13; 1.1.0 before 1.1.16 |
| CVE-2012-3357 | – | Jul 22 | The SVN revision view (lib/vclib/svn/svn_repos.py) in ViewVC before 1.1.15 does not properly handle log messages when a readable path is copied from an unreadable path, which… Affected: through 1.1.14; 0.8; 0.9; 0.9.1; 0.9.2; 0.9.3; +27 more |
| CVE-2012-3356 | – | Jul 22 | The remote SVN views functionality (lib/vclib/svn/svn_ra.py) in ViewVC before 1.1.15 does not properly perform authorization, which allows remote attackers to bypass intended… Affected: through 1.1.14; 0.8; 0.9; 0.9.1; 0.9.2; 0.9.3; +27 more |
| CVE-2009-5024 | – | May 23 | ViewVC before 1.1.11 allows remote attackers to bypass the cvsdb row_limit configuration setting, and consequently conduct resource-consumption attacks, via the limit parameter,… Affected: through 1.1.10; 0.8; 0.9; 0.9.1; 0.9.2; 0.9.3; +23 more |
| CVE-2010-0132 | – | Mar 31 | Cross-site scripting (XSS) vulnerability in ViewVC 1.1 before 1.1.5 and 1.0 before 1.0.11, when the regular expression search functionality is enabled, allows remote attackers to… Affected: 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +10 more |
| CVE-2010-0736 | – | Mar 19 | Cross-site scripting (XSS) vulnerability in the view_queryform function in lib/viewvc.py in ViewVC before 1.0.10, and 1.1.x before 1.1.4, allows remote attackers to inject… Affected: through 1.0.9; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +7 more |
| CVE-2010-0005 | – | Jan 29 | query.py in the query interface in ViewVC before 1.1.3 does not reject configurations that specify an unsupported authorizer for a root, which might allow remote attackers to… Affected: through 1.1.2; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +5 more |
| CVE-2010-0004 | – | Jan 29 | ViewVC before 1.1.3 composes the root listing view without using the authorizer for each root, which might allow remote attackers to discover private root names by reading this… Affected: 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; 1.0.6; +5 more |
| CVE-2009-3619 | – | Nov 10 | Unspecified vulnerability in ViewVC 1.0 before 1.0.9 and 1.1 before 1.1.2 has unknown impact and remote attack vectors related to "printing illegal parameter names and values." Affected: 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; 1.0.6; +4 more |
| CVE-2009-3618 | – | Nov 10 | Cross-site scripting (XSS) vulnerability in viewvc.py in ViewVC 1.0 before 1.0.9 and 1.1 before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the view… Affected: 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; 1.0.6; +4 more |
| CVE-2008-4325 | – | Sep 30 | lib/viewvc.py in ViewVC 1.0.5 uses the content-type parameter in the HTTP request for the Content-Type header in the HTTP response, which allows remote attackers to cause content… Affected: 1.0.5 |
| CVE-2008-1291 | – | Mar 24 | ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden… Affected: 1.0.2; 1.0.3 |
| CVE-2008-1292 | – | Mar 24 | ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtain sensitive information by reading (1)… Affected: 1.0.2; 1.0.3 |
| CVE-2008-1290 | – | Mar 24 | ViewVC before 1.0.5 includes "all-forbidden" files within search results that list CVS or Subversion (SVN) commits, which allows remote attackers to obtain sensitive information Affected: 1.0.2; 1.0.3 |
| CVE-2006-5442 | – | Oct 21 | ViewVC 1.0.2 and earlier does not specify a charset in its HTTP headers or HTML documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks that inject… Affected: through 1.0.2 |
Showing 21