debian/viewvc vulnerabilities

Latest debian/viewvc CVEs

Newest publication first

1. DLA-3266-1 viewvc - security update

   Published 2023-01-11

   Unknown

2. DSA-3784-1 viewvc - security update

   Published 2017-02-09

   Unknown

3. DLA-820-1 viewvc - security update

   Published 2017-02-09

   Unknown

4. DSA-2563-1 viewvc - several

   Published 2012-10-23

   Unknown

5. CVE-2009-3619 Unspecified vulnerability in ViewVC 1.0 before 1.0.9 and 1.1 before 1.1.2 has unknown impact and remote attack vectors related to "printing illegal parameter names and values."

   Published 2009-11-10

   Medium·CVSS 5.0 EPSS 1.8%

   Unspecified vulnerability in ViewVC 1.0 before 1.0.9 and 1.1 before 1.1.2 has unknown impact and remote attack vectors related to "printing illegal parameter names and values."

6. CVE-2009-3618 Cross-site scripting (XSS) vulnerability in viewvc.py in ViewVC 1.0 before 1.0.9 and 1.1 before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the view parameter. NOTE: some....

   Published 2009-11-10

   Medium·CVSS 4.3 EPSS 1.6%

   Cross-site scripting (XSS) vulnerability in viewvc.py in ViewVC 1.0 before 1.0.9 and 1.1 before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the view parameter. NOTE: some of these details are obtained from third party information.

7. CVE-2008-4325 lib/viewvc.py in ViewVC 1.0.5 uses the content-type parameter in the HTTP request for the Content-Type header in the HTTP response, which allows remote attackers to cause content to be misinterpreted....

   Published 2008-09-30

   Medium·CVSS 5.8 EPSS 1.4%

   lib/viewvc.py in ViewVC 1.0.5 uses the content-type parameter in the HTTP request for the Content-Type header in the HTTP response, which allows remote attackers to cause content to be misinterpreted by the browser via a content-type parameter that is inconsistent with the reques...

8. CVE-2005-4831 viewcvs in ViewCVS 0.9.2 allows remote attackers to set the Content-Type header to arbitrary values via the content-type parameter, which can be leveraged for cross-site scripting (XSS) and other atta...

   Published 2007-03-03

   Medium·CVSS 4.3 EPSS 1.1%

   viewcvs in ViewCVS 0.9.2 allows remote attackers to set the Content-Type header to arbitrary values via the content-type parameter, which can be leveraged for cross-site scripting (XSS) and other attacks, as demonstrated using (1) "text/html", or (2) "image/jpeg" with an image th...

9. CVE-2005-4830 CRLF injection vulnerability in viewcvs in ViewCVS 0.9.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the content-type par...

   Published 2007-03-03

   High·CVSS 7.6 EPSS 2.2%

   CRLF injection vulnerability in viewcvs in ViewCVS 0.9.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the content-type parameter.

10. CVE-2006-5442 ViewVC 1.0.2 and earlier does not specify a charset in its HTTP headers or HTML documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks that inject arbitrary UTF-7 encod...

    Published 2006-10-21

    Medium·CVSS 6.8 EPSS 1.5%

    ViewVC 1.0.2 and earlier does not specify a charset in its HTTP headers or HTML documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks that inject arbitrary UTF-7 encoded JavaScript code via a view.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.