CVSS: 5.9EPSS: 3%CPEs: 8EXPL: 3CVE-2024-31497 – Gentoo Linux Security Advisory 202407-11
https://notcve.org/view.php?id=CVE-2024-31497
15 Apr 2024 — In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. This is especially important in a scenario where an adversary is able to read messages signed by PuTTY or Pageant. The required set of signed messages may be publicly readable because they are stored in a public Git service that supports use of SSH for commit signing, and the signatures were made by Pageant through an agent-forw... • https://github.com/sh1k4ku/CVE-2024-31497 • CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) •
CVSS: 8.8EPSS: 3%CPEs: 1EXPL: 3CVE-2019-14422 – TortoiseSVN 1.12.1 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-14422
15 Aug 2019 — An issue was discovered in in TortoiseSVN 1.12.1. The Tsvncmd: URI handler allows a customised diff operation on Excel workbooks, which could be used to open remote workbooks without protection from macro security settings to execute arbitrary code. A tsvncmd:command:diff?path:[file1]?path2:[file2] URI will execute a customised diff on [file1] and [file2] based on the file extension. • https://www.exploit-db.com/exploits/47252 •
CVSS: 9.3EPSS: 2%CPEs: 99EXPL: 0CVE-2010-3199
https://notcve.org/view.php?id=CVE-2010-3199
10 Sep 2010 — Untrusted search path vulnerability in TortoiseSVN 1.6.10, Build 19898 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a file that is processed by Tortoise. NOTE: this is only a vulnerability when a file extension is associated with TortoiseProc or TortoiseMerge, which is not the default. Vulnerabilidad ruta de búsqueda no confiable en TortoiseSVN v1.6.10, Build 1989... • http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=2653163 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 1%CPEs: 2EXPL: 0CVE-2007-3846
https://notcve.org/view.php?id=CVE-2007-3846
28 Aug 2007 — Directory traversal vulnerability in Subversion before 1.4.5, as used by TortoiseSVN before 1.4.5 and possibly other products, when run on Windows-based systems, allows remote authenticated users to overwrite and create arbitrary files via a ..\ (dot dot backslash) sequence in the filename, as stored in the file repository. Vulnerabilidad de salto de directorio en Subversion anterior a 1.4.5, utilizado en TortoiseSVN anterior a 1.4.5 y posiblemente otros productos, cuando se ejecuta en sistemas basados en W... • http://crisp.cs.du.edu/?q=node/36 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •