Vulnerabilites related to websvn - websvn
cve-2011-5221
Vulnerability from cvelistv5
Published
2012-10-25 17:00
Modified
2024-08-07 00:30
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the getLog function in svnlook.php in WebSVN before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to (1) comp.php, (2) diff.php, or (3) revision.php.
References
http://www.securityfocus.com/bid/51109vdb-entry, x_refsource_BID
http://websvn.tigris.org/issues/show_bug.cgi?id=275x_refsource_CONFIRM
http://osvdb.org/77942vdb-entry, x_refsource_OSVDB
http://st2tea.blogspot.com/2011/12/websvn-cross-site-scripting.htmlx_refsource_MISC
http://www.securitytracker.com/id?1026438vdb-entry, x_refsource_SECTRACK
http://secunia.com/advisories/47288third-party-advisory, x_refsource_SECUNIA
http://osvdb.org/77941vdb-entry, x_refsource_OSVDB
https://exchange.xforce.ibmcloud.com/vulnerabilities/71888vdb-entry, x_refsource_XF
http://osvdb.org/77943vdb-entry, x_refsource_OSVDB
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T00:30:46.896Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "51109",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/51109"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://websvn.tigris.org/issues/show_bug.cgi?id=275"
          },
          {
            "name": "77942",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/77942"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://st2tea.blogspot.com/2011/12/websvn-cross-site-scripting.html"
          },
          {
            "name": "1026438",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1026438"
          },
          {
            "name": "47288",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/47288"
          },
          {
            "name": "77941",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/77941"
          },
          {
            "name": "websvn-path-xss(71888)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71888"
          },
          {
            "name": "77943",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/77943"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-12-17T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in the getLog function in svnlook.php in WebSVN before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to (1) comp.php, (2) diff.php, or (3) revision.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "51109",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/51109"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://websvn.tigris.org/issues/show_bug.cgi?id=275"
        },
        {
          "name": "77942",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/77942"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://st2tea.blogspot.com/2011/12/websvn-cross-site-scripting.html"
        },
        {
          "name": "1026438",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1026438"
        },
        {
          "name": "47288",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/47288"
        },
        {
          "name": "77941",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/77941"
        },
        {
          "name": "websvn-path-xss(71888)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71888"
        },
        {
          "name": "77943",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/77943"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-5221",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in the getLog function in svnlook.php in WebSVN before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to (1) comp.php, (2) diff.php, or (3) revision.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "51109",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/51109"
            },
            {
              "name": "http://websvn.tigris.org/issues/show_bug.cgi?id=275",
              "refsource": "CONFIRM",
              "url": "http://websvn.tigris.org/issues/show_bug.cgi?id=275"
            },
            {
              "name": "77942",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/77942"
            },
            {
              "name": "http://st2tea.blogspot.com/2011/12/websvn-cross-site-scripting.html",
              "refsource": "MISC",
              "url": "http://st2tea.blogspot.com/2011/12/websvn-cross-site-scripting.html"
            },
            {
              "name": "1026438",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1026438"
            },
            {
              "name": "47288",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/47288"
            },
            {
              "name": "77941",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/77941"
            },
            {
              "name": "websvn-path-xss(71888)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71888"
            },
            {
              "name": "77943",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/77943"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-5221",
    "datePublished": "2012-10-25T17:00:00",
    "dateReserved": "2012-10-25T00:00:00",
    "dateUpdated": "2024-08-07T00:30:46.896Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2011-2195
Vulnerability from cvelistv5
Published
2021-10-26 12:10
Modified
2024-08-06 22:53
Severity ?
Summary
A flaw was found in WebSVN 2.3.2. Without prior authentication, if the 'allowDownload' option is enabled in config.php, an attacker can invoke the dl.php script and pass a well formed 'path' argument to execute arbitrary commands against the underlying operating system.
References
https://seclists.org/bugtraq/2011/Jun/34x_refsource_MISC
Impacted products
Vendor Product Version
n/a websvn Version: websvn 2.3.2
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T22:53:17.304Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2011/Jun/34"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "websvn",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "websvn 2.3.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in WebSVN 2.3.2. Without prior authentication, if the \u0027allowDownload\u0027 option is enabled in config.php, an attacker can invoke the dl.php script and pass a well formed \u0027path\u0027 argument to execute arbitrary commands against the underlying operating system."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-26T12:10:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://seclists.org/bugtraq/2011/Jun/34"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2011-2195",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "websvn",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "websvn 2.3.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A flaw was found in WebSVN 2.3.2. Without prior authentication, if the \u0027allowDownload\u0027 option is enabled in config.php, an attacker can invoke the dl.php script and pass a well formed \u0027path\u0027 argument to execute arbitrary commands against the underlying operating system."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-78"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://seclists.org/bugtraq/2011/Jun/34",
              "refsource": "MISC",
              "url": "https://seclists.org/bugtraq/2011/Jun/34"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2011-2195",
    "datePublished": "2021-10-26T12:10:00",
    "dateReserved": "2011-05-31T00:00:00",
    "dateUpdated": "2024-08-06T22:53:17.304Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2016-1236
Vulnerability from cvelistv5
Published
2016-05-11 21:00
Modified
2024-08-05 22:48
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in (1) revision.php, (2) log.php, (3) listing.php, and (4) comp.php in WebSVN allow context-dependent attackers to inject arbitrary web script or HTML via the name of a (a) file or (b) directory in a repository.
References
http://www.openwall.com/lists/oss-security/2016/05/05/22mailing-list, x_refsource_MLIST
https://bugzilla.redhat.com/show_bug.cgi?id=1333673x_refsource_CONFIRM
http://www.debian.org/security/2016/dsa-3572vendor-advisory, x_refsource_DEBIAN
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T22:48:13.636Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20160506 CVE-2016-1236 - XSS Vulnerability in websvn 2.3.3-1.2+deb8u1",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/05/05/22"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1333673"
          },
          {
            "name": "DSA-3572",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3572"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-05-06T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in (1) revision.php, (2) log.php, (3) listing.php, and (4) comp.php in WebSVN allow context-dependent attackers to inject arbitrary web script or HTML via the name of a (a) file or (b) directory in a repository."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-05-11T20:57:01",
        "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
        "shortName": "debian"
      },
      "references": [
        {
          "name": "[oss-security] 20160506 CVE-2016-1236 - XSS Vulnerability in websvn 2.3.3-1.2+deb8u1",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/05/05/22"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1333673"
        },
        {
          "name": "DSA-3572",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3572"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@debian.org",
          "ID": "CVE-2016-1236",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in (1) revision.php, (2) log.php, (3) listing.php, and (4) comp.php in WebSVN allow context-dependent attackers to inject arbitrary web script or HTML via the name of a (a) file or (b) directory in a repository."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[oss-security] 20160506 CVE-2016-1236 - XSS Vulnerability in websvn 2.3.3-1.2+deb8u1",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/05/05/22"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1333673",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1333673"
            },
            {
              "name": "DSA-3572",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3572"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
    "assignerShortName": "debian",
    "cveId": "CVE-2016-1236",
    "datePublished": "2016-05-11T21:00:00",
    "dateReserved": "2015-12-27T00:00:00",
    "dateUpdated": "2024-08-05T22:48:13.636Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2013-6892
Vulnerability from cvelistv5
Published
2015-01-21 18:00
Modified
2024-08-06 17:53
Severity ?
Summary
WebSVN 2.3.3 allows remote authenticated users to read arbitrary files via a symlink attack in a commit.
References
http://secunia.com/advisories/62233third-party-advisory, x_refsource_SECUNIA
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682x_refsource_MISC
http://www.debian.org/security/2015/dsa-3137vendor-advisory, x_refsource_DEBIAN
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T17:53:45.465Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "62233",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62233"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682"
          },
          {
            "name": "DSA-3137",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2015/dsa-3137"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-01-18T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "WebSVN 2.3.3 allows remote authenticated users to read arbitrary files via a symlink attack in a commit."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-03-13T15:57:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "62233",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62233"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682"
        },
        {
          "name": "DSA-3137",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2015/dsa-3137"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2013-6892",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "WebSVN 2.3.3 allows remote authenticated users to read arbitrary files via a symlink attack in a commit."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "62233",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/62233"
            },
            {
              "name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682",
              "refsource": "MISC",
              "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682"
            },
            {
              "name": "DSA-3137",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2015/dsa-3137"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2013-6892",
    "datePublished": "2015-01-21T18:00:00",
    "dateReserved": "2013-11-28T00:00:00",
    "dateUpdated": "2024-08-06T17:53:45.465Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2021-32305
Vulnerability from cvelistv5
Published
2021-05-18 16:11
Modified
2024-08-03 23:17
Severity ?
Summary
WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter.
References
https://github.com/websvnphp/websvn/pull/142x_refsource_MISC
http://packetstormsecurity.com/files/163225/Websvn-2.6.0-Remote-Code-Execution.htmlx_refsource_MISC
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:17:29.282Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/websvnphp/websvn/pull/142"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/163225/Websvn-2.6.0-Remote-Code-Execution.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-22T20:06:14",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/websvnphp/websvn/pull/142"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/163225/Websvn-2.6.0-Remote-Code-Execution.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-32305",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/websvnphp/websvn/pull/142",
              "refsource": "MISC",
              "url": "https://github.com/websvnphp/websvn/pull/142"
            },
            {
              "name": "http://packetstormsecurity.com/files/163225/Websvn-2.6.0-Remote-Code-Execution.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/163225/Websvn-2.6.0-Remote-Code-Execution.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-32305",
    "datePublished": "2021-05-18T16:11:10",
    "dateReserved": "2021-05-07T00:00:00",
    "dateUpdated": "2024-08-03T23:17:29.282Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2007-3056
Vulnerability from cvelistv5
Published
2007-06-06 01:00
Modified
2024-08-07 14:05
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in filedetails.php in WebSVN 2.0rc4, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the path parameter.
References
http://bugs.gentoo.org/show_bug.cgi?id=180879x_refsource_MISC
http://www.securityfocus.com/bid/24310vdb-entry, x_refsource_BID
http://osvdb.org/36409vdb-entry, x_refsource_OSVDB
http://websvn.tigris.org/servlets/ReadMsg?list=dev&msgNo=1328x_refsource_CONFIRM
http://secunia.com/advisories/25532third-party-advisory, x_refsource_SECUNIA
http://www.attrition.org/pipermail/vim/2007-August/001771.htmlmailing-list, x_refsource_VIM
http://bugs.gentoo.org/show_bug.cgi?id=180879x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/34726vdb-entry, x_refsource_XF
http://www.nabble.com/CVE-2007-3056-tf4246678.htmlx_refsource_CONFIRM
http://securitytracker.com/id?1018601vdb-entry, x_refsource_SECTRACK
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T14:05:27.887Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bugs.gentoo.org/show_bug.cgi?id=180879"
          },
          {
            "name": "24310",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/24310"
          },
          {
            "name": "36409",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/36409"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://websvn.tigris.org/servlets/ReadMsg?list=dev\u0026msgNo=1328"
          },
          {
            "name": "25532",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25532"
          },
          {
            "name": "20070823 ACK for CVE-2007-3056 (WebSVN)",
            "tags": [
              "mailing-list",
              "x_refsource_VIM",
              "x_transferred"
            ],
            "url": "http://www.attrition.org/pipermail/vim/2007-August/001771.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugs.gentoo.org/show_bug.cgi?id=180879"
          },
          {
            "name": "websvn-filedetails-xss(34726)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34726"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.nabble.com/CVE-2007-3056-tf4246678.html"
          },
          {
            "name": "1018601",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1018601"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-06-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in filedetails.php in WebSVN 2.0rc4, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the path parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bugs.gentoo.org/show_bug.cgi?id=180879"
        },
        {
          "name": "24310",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/24310"
        },
        {
          "name": "36409",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/36409"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://websvn.tigris.org/servlets/ReadMsg?list=dev\u0026msgNo=1328"
        },
        {
          "name": "25532",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25532"
        },
        {
          "name": "20070823 ACK for CVE-2007-3056 (WebSVN)",
          "tags": [
            "mailing-list",
            "x_refsource_VIM"
          ],
          "url": "http://www.attrition.org/pipermail/vim/2007-August/001771.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugs.gentoo.org/show_bug.cgi?id=180879"
        },
        {
          "name": "websvn-filedetails-xss(34726)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34726"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.nabble.com/CVE-2007-3056-tf4246678.html"
        },
        {
          "name": "1018601",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1018601"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-3056",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in filedetails.php in WebSVN 2.0rc4, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the path parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://bugs.gentoo.org/show_bug.cgi?id=180879",
              "refsource": "MISC",
              "url": "http://bugs.gentoo.org/show_bug.cgi?id=180879"
            },
            {
              "name": "24310",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/24310"
            },
            {
              "name": "36409",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/36409"
            },
            {
              "name": "http://websvn.tigris.org/servlets/ReadMsg?list=dev\u0026msgNo=1328",
              "refsource": "CONFIRM",
              "url": "http://websvn.tigris.org/servlets/ReadMsg?list=dev\u0026msgNo=1328"
            },
            {
              "name": "25532",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/25532"
            },
            {
              "name": "20070823 ACK for CVE-2007-3056 (WebSVN)",
              "refsource": "VIM",
              "url": "http://www.attrition.org/pipermail/vim/2007-August/001771.html"
            },
            {
              "name": "http://bugs.gentoo.org/show_bug.cgi?id=180879",
              "refsource": "CONFIRM",
              "url": "http://bugs.gentoo.org/show_bug.cgi?id=180879"
            },
            {
              "name": "websvn-filedetails-xss(34726)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34726"
            },
            {
              "name": "http://www.nabble.com/CVE-2007-3056-tf4246678.html",
              "refsource": "CONFIRM",
              "url": "http://www.nabble.com/CVE-2007-3056-tf4246678.html"
            },
            {
              "name": "1018601",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1018601"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-3056",
    "datePublished": "2007-06-06T01:00:00",
    "dateReserved": "2007-06-05T00:00:00",
    "dateUpdated": "2024-08-07T14:05:27.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2016-2511
Vulnerability from cvelistv5
Published
2016-04-07 21:00
Modified
2024-08-05 23:32
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in WebSVN 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the path parameter to log.php.
References
http://packetstormsecurity.com/files/135886/WebSVN-2.3.3-Cross-Site-Scripting.htmlx_refsource_MISC
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179168.htmlvendor-advisory, x_refsource_FEDORA
http://www.debian.org/security/2016/dsa-3490vendor-advisory, x_refsource_DEBIAN
http://seclists.org/fulldisclosure/2016/Feb/99mailing-list, x_refsource_FULLDISC
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:32:20.124Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/135886/WebSVN-2.3.3-Cross-Site-Scripting.html"
          },
          {
            "name": "FEDORA-2016-657a1305aa",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179168.html"
          },
          {
            "name": "DSA-3490",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3490"
          },
          {
            "name": "20160222 Vulnerability in WebSVN 2.3.3",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2016/Feb/99"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-02-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in WebSVN 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the path parameter to log.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-30T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/135886/WebSVN-2.3.3-Cross-Site-Scripting.html"
        },
        {
          "name": "FEDORA-2016-657a1305aa",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179168.html"
        },
        {
          "name": "DSA-3490",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3490"
        },
        {
          "name": "20160222 Vulnerability in WebSVN 2.3.3",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2016/Feb/99"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-2511",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in WebSVN 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the path parameter to log.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://packetstormsecurity.com/files/135886/WebSVN-2.3.3-Cross-Site-Scripting.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/135886/WebSVN-2.3.3-Cross-Site-Scripting.html"
            },
            {
              "name": "FEDORA-2016-657a1305aa",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179168.html"
            },
            {
              "name": "DSA-3490",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3490"
            },
            {
              "name": "20160222 Vulnerability in WebSVN 2.3.3",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2016/Feb/99"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-2511",
    "datePublished": "2016-04-07T21:00:00",
    "dateReserved": "2016-02-19T00:00:00",
    "dateUpdated": "2024-08-05T23:32:20.124Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerability from fkie_nvd
Published
2012-10-25 17:55
Modified
2024-11-21 01:33
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the getLog function in svnlook.php in WebSVN before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to (1) comp.php, (2) diff.php, or (3) revision.php.
References
cve@mitre.orghttp://osvdb.org/77941
cve@mitre.orghttp://osvdb.org/77942
cve@mitre.orghttp://osvdb.org/77943
cve@mitre.orghttp://secunia.com/advisories/47288Vendor Advisory
cve@mitre.orghttp://st2tea.blogspot.com/2011/12/websvn-cross-site-scripting.htmlExploit
cve@mitre.orghttp://websvn.tigris.org/issues/show_bug.cgi?id=275
cve@mitre.orghttp://www.securityfocus.com/bid/51109
cve@mitre.orghttp://www.securitytracker.com/id?1026438
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/71888
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/77941
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/77942
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/77943
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/47288Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://st2tea.blogspot.com/2011/12/websvn-cross-site-scripting.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://websvn.tigris.org/issues/show_bug.cgi?id=275
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/51109
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1026438
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/71888
Impacted products
Vendor Product Version
websvn websvn *
websvn websvn 1.61
websvn websvn 2.0
websvn websvn 2.1.0
websvn websvn 2.2.0
websvn websvn 2.2.1


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:websvn:websvn:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "027433C8-EAD7-4AF4-B7B1-0C866122B383",
              "versionEndIncluding": "2.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:websvn:websvn:1.61:*:*:*:*:*:*:*",
              "matchCriteriaId": "D194CBDC-E4D4-47DE-9562-5B0FCE65E017",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:websvn:websvn:2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "AE678446-BD20-4E5A-8C94-0C6E81B37184",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:websvn:websvn:2.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F59B7EFC-0409-4255-823F-A33FAFC2EDA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:websvn:websvn:2.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "A9620BAB-DDEE-48E2-ADF7-A6A1C7B01590",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:websvn:websvn:2.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "842AEBF8-1A25-4D94-A583-4C391A548304",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in the getLog function in svnlook.php in WebSVN before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to (1) comp.php, (2) diff.php, or (3) revision.php."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en la funci\u00f3n getLog en svnlook.php en WebSVN anteriores a v2.3.1, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s del par\u00e1metro path sobre (1) comp.php, (2) diff.php, o (3) revision.php."
    }
  ],
  "id": "CVE-2011-5221",
  "lastModified": "2024-11-21T01:33:55.650",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2012-10-25T17:55:04.547",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/77941"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/77942"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/77943"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/47288"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://st2tea.blogspot.com/2011/12/websvn-cross-site-scripting.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://websvn.tigris.org/issues/show_bug.cgi?id=275"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/51109"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1026438"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71888"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/77941"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/77942"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/77943"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/47288"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://st2tea.blogspot.com/2011/12/websvn-cross-site-scripting.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://websvn.tigris.org/issues/show_bug.cgi?id=275"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/51109"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1026438"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71888"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2007-06-06 01:30
Modified
2024-11-21 00:32
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in filedetails.php in WebSVN 2.0rc4, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the path parameter.
References
cve@mitre.orghttp://bugs.gentoo.org/show_bug.cgi?id=180879
cve@mitre.orghttp://bugs.gentoo.org/show_bug.cgi?id=180879
cve@mitre.orghttp://osvdb.org/36409
cve@mitre.orghttp://secunia.com/advisories/25532Vendor Advisory
cve@mitre.orghttp://securitytracker.com/id?1018601
cve@mitre.orghttp://websvn.tigris.org/servlets/ReadMsg?list=dev&msgNo=1328
cve@mitre.orghttp://www.attrition.org/pipermail/vim/2007-August/001771.html
cve@mitre.orghttp://www.nabble.com/CVE-2007-3056-tf4246678.html
cve@mitre.orghttp://www.securityfocus.com/bid/24310
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/34726
af854a3a-2127-422b-91ae-364da2661108http://bugs.gentoo.org/show_bug.cgi?id=180879
af854a3a-2127-422b-91ae-364da2661108http://bugs.gentoo.org/show_bug.cgi?id=180879
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/36409
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/25532Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1018601
af854a3a-2127-422b-91ae-364da2661108http://websvn.tigris.org/servlets/ReadMsg?list=dev&msgNo=1328
af854a3a-2127-422b-91ae-364da2661108http://www.attrition.org/pipermail/vim/2007-August/001771.html
af854a3a-2127-422b-91ae-364da2661108http://www.nabble.com/CVE-2007-3056-tf4246678.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/24310
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/34726
Impacted products
Vendor Product Version
websvn websvn *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:websvn:websvn:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "028B6085-0D1C-4F35-9881-02C11D116DC6",
              "versionEndIncluding": "2.0rc4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in filedetails.php in WebSVN 2.0rc4, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the path parameter."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de tipo cross-site scripting (XSS) en el archivo filedetails.php en WebSVN versi\u00f3n 2.0rc4, y posiblemente anteriores, permite a atacantes remotos inyectar script web o HTML arbitrario por medio del par\u00e1metro path."
    }
  ],
  "id": "CVE-2007-3056",
  "lastModified": "2024-11-21T00:32:18.553",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2007-06-06T01:30:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://bugs.gentoo.org/show_bug.cgi?id=180879"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://bugs.gentoo.org/show_bug.cgi?id=180879"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/36409"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/25532"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securitytracker.com/id?1018601"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://websvn.tigris.org/servlets/ReadMsg?list=dev\u0026msgNo=1328"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.attrition.org/pipermail/vim/2007-August/001771.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.nabble.com/CVE-2007-3056-tf4246678.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/24310"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34726"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://bugs.gentoo.org/show_bug.cgi?id=180879"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://bugs.gentoo.org/show_bug.cgi?id=180879"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/36409"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/25532"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1018601"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://websvn.tigris.org/servlets/ReadMsg?list=dev\u0026msgNo=1328"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.attrition.org/pipermail/vim/2007-August/001771.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.nabble.com/CVE-2007-3056-tf4246678.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/24310"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34726"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2015-01-21 18:59
Modified
2024-11-21 01:59
Severity ?
Summary
WebSVN 2.3.3 allows remote authenticated users to read arbitrary files via a symlink attack in a commit.
References
cve@mitre.orghttp://secunia.com/advisories/62233
cve@mitre.orghttp://www.debian.org/security/2015/dsa-3137Third Party Advisory
cve@mitre.orghttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/62233
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2015/dsa-3137Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682Issue Tracking, Third Party Advisory
Impacted products
Vendor Product Version
websvn websvn 2.3.3
debian debian_linux 7.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:websvn:websvn:2.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "0AA6ED11-1712-4510-8452-0223CF22A64D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WebSVN 2.3.3 allows remote authenticated users to read arbitrary files via a symlink attack in a commit."
    },
    {
      "lang": "es",
      "value": "WebSVN 2.3.3 permite a usuarios remotos autenticados leer archivos arbitrarios a trav\u00e9s de un ataque symlink en un commit"
    }
  ],
  "id": "CVE-2013-6892",
  "lastModified": "2024-11-21T01:59:55.677",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2015-01-21T18:59:00.060",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/62233"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://www.debian.org/security/2015/dsa-3137"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/62233"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://www.debian.org/security/2015/dsa-3137"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2016-05-11 21:59
Modified
2024-11-21 02:46
Severity ?
6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Multiple cross-site scripting (XSS) vulnerabilities in (1) revision.php, (2) log.php, (3) listing.php, and (4) comp.php in WebSVN allow context-dependent attackers to inject arbitrary web script or HTML via the name of a (a) file or (b) directory in a repository.
References
security@debian.orghttp://www.debian.org/security/2016/dsa-3572
security@debian.orghttp://www.openwall.com/lists/oss-security/2016/05/05/22
security@debian.orghttps://bugzilla.redhat.com/show_bug.cgi?id=1333673
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2016/dsa-3572
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/05/05/22
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1333673
Impacted products
Vendor Product Version
websvn websvn *
debian debian_linux 8.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:websvn:websvn:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5C70370-1F0B-4F83-AB3C-1C4F9D431263",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in (1) revision.php, (2) log.php, (3) listing.php, and (4) comp.php in WebSVN allow context-dependent attackers to inject arbitrary web script or HTML via the name of a (a) file or (b) directory in a repository."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de XSS en (1) revision.php, (2) log.php, (3) listing.php y (4) comp.php en WebSVN permite a atacantes dependientes de contexto inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de el nombre de un (a) archivo o (b) directorio en un repositorio."
    }
  ],
  "id": "CVE-2016-1236",
  "lastModified": "2024-11-21T02:46:00.600",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2016-05-11T21:59:00.123",
  "references": [
    {
      "source": "security@debian.org",
      "url": "http://www.debian.org/security/2016/dsa-3572"
    },
    {
      "source": "security@debian.org",
      "url": "http://www.openwall.com/lists/oss-security/2016/05/05/22"
    },
    {
      "source": "security@debian.org",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1333673"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2016/dsa-3572"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2016/05/05/22"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1333673"
    }
  ],
  "sourceIdentifier": "security@debian.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2021-05-18 17:15
Modified
2024-11-21 06:06
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter.
References
cve@mitre.orghttp://packetstormsecurity.com/files/163225/Websvn-2.6.0-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
cve@mitre.orghttps://github.com/websvnphp/websvn/pull/142Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/163225/Websvn-2.6.0-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://github.com/websvnphp/websvn/pull/142Issue Tracking, Patch, Third Party Advisory
Impacted products
Vendor Product Version
websvn websvn *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:websvn:websvn:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B4E50B81-A0DA-41D6-B463-DABAEED84296",
              "versionEndExcluding": "2.6.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter."
    },
    {
      "lang": "es",
      "value": "WebSVN versiones anteriores a 2.6.1, permite a atacantes remotos ejecutar comandos arbitrarios por medio de metacaracteres shell en el par\u00e1metro search"
    }
  ],
  "id": "CVE-2021-32305",
  "lastModified": "2024-11-21T06:06:59.497",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-05-18T17:15:07.263",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/163225/Websvn-2.6.0-Remote-Code-Execution.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/websvnphp/websvn/pull/142"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/163225/Websvn-2.6.0-Remote-Code-Execution.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/websvnphp/websvn/pull/142"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2021-10-26 13:15
Modified
2024-11-21 01:27
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
A flaw was found in WebSVN 2.3.2. Without prior authentication, if the 'allowDownload' option is enabled in config.php, an attacker can invoke the dl.php script and pass a well formed 'path' argument to execute arbitrary commands against the underlying operating system.
References
secalert@redhat.comhttps://seclists.org/bugtraq/2011/Jun/34Exploit, Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://seclists.org/bugtraq/2011/Jun/34Exploit, Mailing List, Third Party Advisory
Impacted products
Vendor Product Version
websvn websvn 2.3.2


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:websvn:websvn:2.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "6A63BADD-8F47-4BA8-8350-20AB8EF02775",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in WebSVN 2.3.2. Without prior authentication, if the \u0027allowDownload\u0027 option is enabled in config.php, an attacker can invoke the dl.php script and pass a well formed \u0027path\u0027 argument to execute arbitrary commands against the underlying operating system."
    },
    {
      "lang": "es",
      "value": "Se ha encontrado un fallo en WebSVN versi\u00f3n 2.3.2. Sin autenticaci\u00f3n previa, si la opci\u00f3n \"allowDownload\" est\u00e1 habilitada en el archivo config.php, un atacante puede invocar el script dl.php y pasar un argumento \"path\" bien formado para ejecutar comandos arbitrarios contra el sistema operativo subyacente"
    }
  ],
  "id": "CVE-2011-2195",
  "lastModified": "2024-11-21T01:27:47.537",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-10-26T13:15:07.167",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://seclists.org/bugtraq/2011/Jun/34"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://seclists.org/bugtraq/2011/Jun/34"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2016-04-07 21:59
Modified
2024-11-21 02:48
Severity ?
6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Cross-site scripting (XSS) vulnerability in WebSVN 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the path parameter to log.php.
References
cve@mitre.orghttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/179168.html
cve@mitre.orghttp://packetstormsecurity.com/files/135886/WebSVN-2.3.3-Cross-Site-Scripting.htmlExploit
cve@mitre.orghttp://seclists.org/fulldisclosure/2016/Feb/99Exploit
cve@mitre.orghttp://www.debian.org/security/2016/dsa-3490
af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179168.html
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/135886/WebSVN-2.3.3-Cross-Site-Scripting.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2016/Feb/99Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2016/dsa-3490
Impacted products
Vendor Product Version
debian debian_linux 7.0
debian debian_linux 8.0
websvn websvn *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:websvn:websvn:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0DC8DA06-6B9D-4CC6-863C-A4961A0AECDE",
              "versionEndIncluding": "2.3.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in WebSVN 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the path parameter to log.php."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de XXS en WebSVN 2.3.3 y versiones anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del par\u00e1metro path a log.php."
    }
  ],
  "id": "CVE-2016-2511",
  "lastModified": "2024-11-21T02:48:35.540",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2016-04-07T21:59:03.637",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179168.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.com/files/135886/WebSVN-2.3.3-Cross-Site-Scripting.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://seclists.org/fulldisclosure/2016/Feb/99"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2016/dsa-3490"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179168.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.com/files/135886/WebSVN-2.3.3-Cross-Site-Scripting.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://seclists.org/fulldisclosure/2016/Feb/99"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2016/dsa-3490"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}