Page 3 of 59 results (0.002 seconds)

CVSS: 7.5EPSS: 25%CPEs: 46EXPL: 0

CVE-2015-3184 – subversion: Mixed anonymous/authenticated path-based authz with httpd 2.4

https://notcve.org/view.php?id=CVE-2015-3184

12 Aug 2015 — mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name. Vulnerabilidad en mod_authz_svn en Apache Subversion 1.7.x en versiones anteriores a 1.7.21 y 1.8.x en versiones anteriores a 1.8.14, al utilizar Apache httpd 2.4.x, no restringe correctamente el acceso anónimo, lo que permite a usuarios anónimos remotos leer archivos ocultos a t... • http://lists.apple.com/archives/security-announce/2016/Mar/msg00003.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-285: Improper Authorization •

CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 0

CVE-2015-3187 – subversion: svn_repos_trace_node_locations() reveals paths hidden by authz

https://notcve.org/view.php?id=CVE-2015-3187

12 Aug 2015 — The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by reading the history of a node that has been moved from a hidden path. Vulnerabilidad en la función svn_repos_trace_node_locations en Apache Subversion en versiones anteriores a 1.7.21 y 1.8.x en versiones anteriores a 1.8.14, cuando se utiliza autorización basada en ruta, permite a usuarios rem... • http://lists.apple.com/archives/security-announce/2016/Mar/msg00003.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 7.8EPSS: 2%CPEs: 14EXPL: 0

CVE-2015-0202 – Gentoo Linux Security Advisory 201610-05

https://notcve.org/view.php?id=CVE-2015-0202

03 Apr 2015 — The mod_dav_svn server in Subversion 1.8.0 through 1.8.11 allows remote attackers to cause a denial of service (memory consumption) via a large number of REPORT requests, which trigger the traversal of FSFS repository nodes. El servidor mod_dav_svn en Subversion 1.8.0 hasta 1.8.11 permite a atacantes remotos causar una denegación de servicio (consumo de memoria) a través de un número grande de solicitudes REPORT, lo que provoca el salto de nodos del repositorio FSFS. It was discovered that the Subversion mo... • http://lists.opensuse.org/opensuse-updates/2015-04/msg00008.html • CWE-399: Resource Management Errors •

CVSS: 7.5EPSS: 15%CPEs: 64EXPL: 0

CVE-2015-0248 – subversion: (mod_dav_svn) remote denial of service with certain requests with dynamically evaluated revision numbers

https://notcve.org/view.php?id=CVE-2015-0248

03 Apr 2015 — The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and abort) via crafted parameter combinations related to dynamically evaluated revision numbers. Los servidores (1) mod_dav_svn yd (2) svnserve en Subversion 1.6.0 hasta 1.7.19 y 1.8.0 hasta 1.8.11 permiten a atacantes remotos causar una denegación de servicio (fallo de aserción y abortar) a través de combinaciones de parámetros relac... • http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html • CWE-399: Resource Management Errors CWE-617: Reachable Assertion •

CVSS: 7.5EPSS: 1%CPEs: 73EXPL: 0

CVE-2015-0251 – subversion: (mod_dav_svn) spoofing svn:author property values for new revisions

https://notcve.org/view.php?id=CVE-2015-0251

03 Apr 2015 — The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protocol request sequences. El servidor mod_dav_svn en Subversion 1.5.0 hasta 1.7.19 y 1.8.0 hasta 1.8.11 permite a usuarios remotos autenticados falsificar la propiedad svn:author a través de secuencias manipuladas de solicitudes del protocolo v1 HTTP. It was found that the mod_dav_svn module did not properly validate the svn:author prop... • http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html • CWE-345: Insufficient Verification of Data Authenticity CWE-348: Use of Less Trusted Source •

CVSS: 7.5EPSS: 14%CPEs: 103EXPL: 0

CVE-2014-3580 – subversion: NULL pointer dereference flaw in mod_dav_svn when handling REPORT requests

https://notcve.org/view.php?id=CVE-2014-3580

18 Dec 2014 — The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist. El módulo mod_dav_svn Apache HTTPD del servidor Apache Subversion 1.x anterior a 1.7.19 y 1.8.x anterior a 1.8.11 permite a atacantes remotos llevar a cabo una denegación de servicio (referencia a puntero nulo y caída de servidor) mediante una petición... • http://lists.apple.com/archives/security-announce/2015/Mar/msg00003.html • CWE-476: NULL Pointer Dereference •

CVSS: 7.5EPSS: 5%CPEs: 96EXPL: 0

CVE-2014-8108 – subversion: NULL pointer dereference flaw in mod_dav_svn when handling URIs for virtual transaction names

https://notcve.org/view.php?id=CVE-2014-8108

18 Dec 2014 — The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request for a URI that triggers a lookup for a virtual transaction name that does not exist. El módulo mod_dav del servidor Apache HTTPD en Apache Subversion 1.7.x anterior a 1.7.19 y 1.8.x anterior a 1.8.11 permite a atacantes remotos provocar una denegación de servicio (referencia a puntero nulo y caída) ... • http://lists.apple.com/archives/security-announce/2015/Mar/msg00003.html • CWE-476: NULL Pointer Dereference •

CVSS: 5.9EPSS: 2%CPEs: 94EXPL: 0

CVE-2014-3504 – Ubuntu Security Notice USN-2315-1

https://notcve.org/view.php?id=CVE-2014-3504

14 Aug 2014 — The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. Las funciones (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate en Se... • http://lists.opensuse.org/opensuse-updates/2014-08/msg00038.html •

CVSS: 5.9EPSS: 1%CPEs: 72EXPL: 0

CVE-2014-3522 – Ubuntu Security Notice USN-2316-1

https://notcve.org/view.php?id=CVE-2014-3522

14 Aug 2014 — The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof servers via a crafted certificate. La capa Serf RA en Apache Subversion 1.4.0 hasta 1.7.x anterior a 1.7.18 y 1.8.x anterior a 1.8.10 no maneja debidamente los comodines (wildcards) en el campo Common Name (CN) o subjectAltName de un certificado X.509, lo ... • http://lists.apple.com/archives/security-announce/2015/Mar/msg00003.html • CWE-297: Improper Validation of Certificate with Host Mismatch •

CVSS: 7.4EPSS: 3%CPEs: 103EXPL: 0

CVE-2014-3528 – subversion: credentials leak via MD5 collision

https://notcve.org/view.php?id=CVE-2014-3528

14 Aug 2014 — Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm. Apache Subversion 1.0.0 hasta 1.7.x anterior a 1.7.17 y 1.8.x anterior a 1.8.10 utiliza un hash MD5 de la URL y el reino (realm) de la autenticación para almacenar las credenciales de caché, lo que facilita a servidores remotos obtener credenciales a ... • http://lists.apple.com/archives/security-announce/2015/Mar/msg00003.html • CWE-201: Insertion of Sensitive Information Into Sent Data CWE-255: Credentials Management Errors •