usvn vulnerabilities

Products

• usvn 4
• user-friendly svn 3

Latest usvn CVEs

Newest publication first

1. CVE-2020-17363 USVN (aka User-friendly SVN) before 1.0.9 allows remote code execution via shell metacharacters in the number_start or number_end parameter to LastHundredRequest (aka lasthundredrequestAction) in the....

   Published 2020-12-31

   Critical·CVSS 9.9 EPSS 4.6%

   USVN (aka User-friendly SVN) before 1.0.9 allows remote code execution via shell metacharacters in the number_start or number_end parameter to LastHundredRequest (aka lasthundredrequestAction) in the Timeline module. NOTE: this may overlap CVE-2020-25069.

2. CVE-2020-25069 USVN (aka User-friendly SVN) before 1.0.10 allows attackers to execute arbitrary code in the commit view.

   Published 2020-09-01

   Critical·CVSS 9.8 EPSS 1.9%

   USVN (aka User-friendly SVN) before 1.0.10 allows attackers to execute arbitrary code in the commit view.

3. CVE-2020-25070 USVN (aka User-friendly SVN) before 1.0.10 allows CSRF, related to the lack of the SameSite Strict feature.

   Published 2020-09-01

   High·CVSS 8.8 EPSS 0.49%

   USVN (aka User-friendly SVN) before 1.0.10 allows CSRF, related to the lack of the SameSite Strict feature.

4. CVE-2020-17364 USVN (aka User-friendly SVN) before 1.0.9 allows XSS via SVN logs.

   Published 2020-08-05

   Medium·CVSS 6.1 EPSS 0.78%

   USVN (aka User-friendly SVN) before 1.0.9 allows XSS via SVN logs.

5. CVE-2018-0695 Cross-site scripting vulnerability in User-friendly SVN (USVN) Version 1.0.7 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

   Published 2018-11-15

   Medium·CVSS 6.1 EPSS 0.79%

   Cross-site scripting vulnerability in User-friendly SVN (USVN) Version 1.0.7 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

6. CVE-2014-4719 Cross-site scripting (XSS) vulnerability in the login panel (svn/login/) in User-Friendly SVN (aka USVN) before 1.0.7 allows remote attackers to inject arbitrary web script or HTML via the username fi...

   Published 2014-07-03

   Medium·CVSS 4.3 EPSS 1.4%

   Cross-site scripting (XSS) vulnerability in the login panel (svn/login/) in User-Friendly SVN (aka USVN) before 1.0.7 allows remote attackers to inject arbitrary web script or HTML via the username field.

7. CVE-2007-5945 USVN before 0.6.5 allows remote attackers to obtain a list of repository contents via unspecified vectors.

   Published 2007-11-14

   Medium·CVSS 5.0 EPSS 1.4%

   USVN before 0.6.5 allows remote attackers to obtain a list of repository contents via unspecified vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.