CVSS: 5.8EPSS: 1%CPEs: 1EXPL: 0CVE-2008-4325
https://notcve.org/view.php?id=CVE-2008-4325
lib/viewvc.py in ViewVC 1.0.5 uses the content-type parameter in the HTTP request for the Content-Type header in the HTTP response, which allows remote attackers to cause content to be misinterpreted by the browser via a content-type parameter that is inconsistent with the requested object. NOTE: this issue might not be a vulnerability, since it requires attacker access to the repository that is being viewed. lib/viewvc.py en ViewVC v1.0.5 utiliza el parametro "content-type" en la peticion HTTP para la cabecera "content-type" en la respuesta HTTP, que permite a los atacantes remotos provocar una malinterpretacion del contenido por parte del navegador, a traves de el parametro "content-type" que no corresponde con el objeto solicitado. NOTA: Esta caracteristica puede no ser una vulnerabilidad, dado que requiere que el atacante acceda al repositorio que esta viendo. • http://viewvc.tigris.org/issues/show_bug.cgi?id=354 http://viewvc.tigris.org/source/browse/viewvc/trunk/lib/viewvc.py?rev=2011&r1=1968&r2=1978 http://viewvc.tigris.org/source/browse/viewvc?rev=1978&view=rev http://www.openwall.com/lists/oss-security/2008/09/19/4 http://www.openwall.com/lists/oss-security/2008/09/20/1 https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01101.html https://www.redhat.com/archives/fedora-package-announce/2008-September&# •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2008-1290
https://notcve.org/view.php?id=CVE-2008-1290
ViewVC before 1.0.5 includes "all-forbidden" files within search results that list CVS or Subversion (SVN) commits, which allows remote attackers to obtain sensitive information. ViewVC antes de 1.0.5 incluye archivos "all-forbidden" (todo prohibido) dentro de resultados de búsqueda que listan asignaciones CVS o Subversion (SVN), lo que permite a atacantes remotos obtener información sensible. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380 http://bugs.gentoo.org/show_bug.cgi?id=212288 http://secunia.com/advisories/29176 http://secunia.com/advisories/29460 http://security.gentoo.org/glsa/glsa-200803-29.xml http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?rev=HEAD http://www.securityfocus.com/bid/28055 http://www.vupen.com/english/advisories/2008/0734/references • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2008-1291
https://notcve.org/view.php?id=CVE-2008-1291
ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder. ViewVC before 1.0.5 almacena información sensible bajo la raíz web con un control de acceso insuficiente, lo que permite a atacantes remotos leer archivos y listar carpetas bajo la carpeta oculta CVSROOT. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380 http://bugs.gentoo.org/show_bug.cgi?id=212288 http://secunia.com/advisories/29176 http://secunia.com/advisories/29460 http://security.gentoo.org/glsa/glsa-200803-29.xml http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?rev=HEAD http://www.securityfocus.com/bid/28055 http://www.vupen.com/english/advisories/2008/0734/references • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2008-1292
https://notcve.org/view.php?id=CVE-2008-1292
ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtain sensitive information by reading (1) forbidden pathnames in the revision view, (2) log history that can only be reached by traversing a forbidden object, or (3) forbidden diff view path parameters. ViewVC before 1.0.5 proporciona revisión de metadatos sin comprobar correctamente si el acceso fue intencionado, lo que permite a atacantes remotos obtener información sensible leyendo (1) rutas prohibidas en la vista de revisión, (2)el historial del log que sólo se puede alcanzar saltando un objeto prohibido, o (3)parámetros de ruta de vista diff prohibidos. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380 http://bugs.gentoo.org/show_bug.cgi?id=212288 http://secunia.com/advisories/29176 http://secunia.com/advisories/29460 http://security.gentoo.org/glsa/glsa-200803-29.xml http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?rev=HEAD http://www.securityfocus.com/bid/28055 http://www.vupen.com/english/advisories/2008/0734/references • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.8EPSS: 1%CPEs: 1EXPL: 0CVE-2006-5442
https://notcve.org/view.php?id=CVE-2006-5442
ViewVC 1.0.2 and earlier does not specify a charset in its HTTP headers or HTML documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks that inject arbitrary UTF-7 encoded JavaScript code via a view. ViewVC 1.0.2 y anteriores no especifica un charset en su cabecera HTTP o documentos HTML, lo cual permite a un atacante remoto llevar a cabo un ataque de secuencias de comandos en sitios cruzados que inyectan código JavaScript UTF-7 de su elección a a través de una vista. • http://secunia.com/advisories/22395 http://securityreason.com/securityalert/1755 http://viewvc.tigris.org/servlets/ReadMsg?list=announce&msgNo=5&raw=true http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?rev=HEAD http://www.hardened-php.net/advisory_102006.134.html http://www.securityfocus.com/archive/1/448762/100/0/threaded http://www.securityfocus.com/bid/20543 https://exchange.xforce.ibmcloud.com/vulnerabilities/29576 •